YOUR VOICE. YOUR LOCATION. YOUR CHOICE.

Privacy, made clear.

Use the map, connect with people and choose what you share. Here is what Loopmigo keeps—and what it does not.

Updated September 21, 2026 · Revision 2 · Privacy questions & support

GPS starts privateUsing your location for directions does not publish it to other people.

No radio archiveWe do not save radio recordings or send radio audio to AI services.

You choose publicBeacons, profile details and shared locations have separate sharing choices.

Your map and GPS

Ping my stop and Location request your phone’s location permission. GPS for your own map stays separate from radio sharing. In a room, choose Only me, selected people or everyone in the channel. Public channels can include people who join later. Private invitations should only go to people you trust.

Directions send the requested coordinates to a routing provider. Your destination, route geometry—including its starting point—and preferences can stay on this device until you select Clear destination or clear site data. Favorites, contacts, waypoints and downloaded map areas are also stored locally.

The server can read shared coordinates; GPS sharing is not end-to-end encrypted. We do not keep a relay movement-history archive. Other people can copy information you deliberately share.

Your voice

Joining hands-free requests microphone permission and starts speaking after you allow it. You can choose Push-to-talk or Listen only, mute incoming sound, turn Radio off or leave. Joining does not enable GPS. After phone sleep, the app attempts to reconnect; your browser may require Resume audio or permission again.

Relayed voice is encrypted on your device and briefly buffered for delivery, without a recording archive. Nearby radio uses a separate WebRTC connection and an in-person verification code. Listeners can still record you. Group identities are not independently verified, and the system has not had an independent security audit. Radio is not an emergency service.

Your account, profile and collection

Registration stores your username, display name, password and recovery-code hashes, sign-in sessions and agreement receipts. It requires an 18+ self-declaration, not an identity document or verified age. A personal phone number is not required. Keep your recovery code safe; there is no email password-reset service.

Accepted radio connections stay with your account. Profiles start private. A public profile linked to your beacons shows only your chosen public details; it does not expose saved routes, credentials or private GPS. Photo uploads remain disabled until image-safety screening is connected.

Arena stores your generated game alias, choices, rating and results. The leaderboard is opt-in; opponents do not receive your account username, GPS or radio data. Match details are retained for up to 90 days. Account deletion removes your Arena identity and account links from retained opponent records.

Public beacons and community posts

Publishing a sign shares the text, nickname, chosen map point and expiry you confirm. It does not attach your live GPS. Posts and replies are text-only; links open external sites. Public information can be copied by others.

We store publisher-key hashes, signs, replies, reports and posting-agreement receipts. A private account association applies your membership allowance across your publishers; this does not make your profile public. Daily usage is retained through the Chicago calendar day, even after a sign is deleted. Signs expire by midnight. Closed or expired signs remain in owner history; deleting removes their details and replies from the live database. Keep your local publisher key to manage them.

Public sign and reply text may be sent to OpenAI and DeepSeek for advisory moderation, including personal information you put in that text. Separate map coordinates, contacts, profile fields and private radio audio are not included. Automated review can be wrong; operator action is separate.

Membership and payments

When checkout is available, Stripe processes subscription payments and card details. Loopmigo stores Stripe customer and subscription identifiers, plan and status, billing dates and your recurring-payment consent. We do not store your card number. Free registration does not start a subscription or a trial. Membership & billing shows availability, price, trial and cancellation details.

Retention times and service providers +

Encrypted radio packets: removed after delivery acknowledgment or about 15 seconds. Radio shared GPS: about 45 seconds. Paired-device GPS: about 25 seconds.
Radio text: up to 15 minutes. Meeting beacons: up to 30 minutes. Room access metadata: up to seven days. Sign-in sessions: up to 30 days.
Accounts, accepted connections and profile data remain until removed. Community history, moderation reports, billing records and agreement receipts are separate records. Contact support for deletion questions.

Address search can send entered addresses to the U.S. Census geocoder. Routing coordinates and travel mode go to FOSSGIS. USGS receives tile/image requests, requested map areas and network addresses. The National Weather Service receives rounded public map-area coordinates from our server for hourly forecasts, not your account, microphone or continuous GPS stream. Hosting, map and connection providers may receive network addresses and connection metadata needed to serve requests; WebRTC peers may see connection information.

Public maps use OpenStreetMap, Chicago, CTA and regional datasets; see source credits. Directory searches send text and filters to Loopmigo. Optional external websites and social links use their own privacy policies. Stripe, OpenAI and DeepSeek also apply their own data practices.

The service worker does not cache private API responses, GPS or radio audio. Temporary retention times describe normal application behavior, not guaranteed forensic erasure. Copies in backups, operating-system memory, recipient devices or legally preserved records can outlast deletion from active systems.

Your controls and requests

Use account settings to sign out, manage recovery and delete your account. Account deletion closes open website checkouts and cancels your website subscription as part of deletion, without waiting for the paid period to end. Paid access ends; a refund is not automatic. Stripe may retain records needed for financial obligations. Separate community posts and device data need their own deletion controls. We may retain records required by law or to resolve billing, abuse or security matters.

We review government and other requests for validity and scope, limit disclosure to legally required information we hold, and aim to notify users when permitted. To ask about access, correction, deletion, backups or privacy concerns, contact Loopmigo. Never send a password, recovery code or full card number.