Privacy, made clear.

Your map and GPS

Ping my stop and Location request your phone’s location permission. GPS for your own map stays separate from radio sharing. In a room, choose Only me, selected people or everyone in the channel. Public channels can include people who join later. Private invitations should only go to people you trust.

Directions send the requested coordinates to Loopmigo’s routing server. Your destination, route geometry—including its starting point—and preferences can stay on this device until you select Clear destination or clear site data. Favorites, contacts, waypoints and downloaded map areas are also stored locally.

The server can read shared coordinates; GPS sharing is not end-to-end encrypted. We do not keep a relay movement-history archive. Other people can copy information you deliberately share.

Your voice

Joining hands-free requests microphone permission and starts speaking after you allow it. You can choose Push-to-talk or Listen only, mute incoming sound, turn Radio off or leave. Joining does not enable GPS. After phone sleep, the app attempts to reconnect; your browser may require Resume audio or permission again.

Relayed voice is encrypted on your device and briefly buffered for delivery, without a recording archive. Nearby radio uses a separate WebRTC connection and an in-person verification code. Listeners can still record you. Group identities are not independently verified, and the system has not had an independent security audit. Radio is not an emergency service.

Your account, profile and collection

Registration stores your username, display name, password and recovery-code hashes, sign-in sessions and agreement receipts. It requires an 18+ self-declaration, not an identity document or verified age. A personal phone number is not required. Keep your recovery code safe; there is no email password-reset service. If you connect Google, you can also sign in with that Google account when you forget your Loopmigo password.

Optional Google sign-in stores your Google account identifier and can suggest a display name. It does not request Gmail, contacts or Drive access, copy your Google photo, or start a subscription. Google handles your Google password under its privacy policy. Temporary sign-in checks expire within 10 minutes; the account connection remains until account deletion. Use the same connected Google account to return to your existing membership.

Optional Sign in with Apple in the iPhone and iPad app stores an Apple account identifier and can suggest your name. It does not request your email, contacts or photos. Apple handles your Apple credentials under its privacy policy. The server verifies sign-in proofs, keeps the Apple refresh token encrypted for account disconnection, and revokes that access when you delete your account. Short-lived sign-in checks expire; tokens are never placed in public links.

Accepted radio connections, your saved map outfit and beacon/avatar choice stay with your account until deletion. A room receives your appearance only within your chosen GPS-sharing audience. Saving a look does not enable GPS or public visibility. Profiles start private. A public profile linked to your beacons shows only your chosen public details; it does not expose saved routes, credentials or private GPS. My Community profiles and posts can each include up to three separately screened photos.

Seller settings save your shop name, public link, pickup note and preferred post duration privately to your account until deletion. They fill new sales posts but become public only when you confirm publishing the post.

Saved beacons keep the public post title, category, map location and save date privately in your account until you remove them or delete your account. They sync across signed-in devices. Opening directions checks the current post and requests location access if needed; saving a beacon does not start GPS or publish your location. Guest bookmarks and saved searches stay on the browser.

Stop Beacons automatically collects active public Community posts attached to the bus stops or L stations you save, open, or reach with a ride you follow while Loopmigo is open. Matching sends public stop identifiers to Loopmigo, not your precise GPS. The received post reference, source stop, receive time and dismissal are private to your signed-in account; publishers do not receive your saved stops or rider identity. Delete a beacon to keep it out of your collection. Closed or expired posts disappear, and their inbox records are cleared during later inbox activity; account deletion removes the collection. A publisher must confirm a transit-stop attachment before publishing.

Your collection is private until you choose to show it on your public profile. When shared, visitors see your owned character cards, counts and fallen status, without your account credentials or purchase history.

Arena stores your generated game alias, choices, rating and results. The leaderboard is opt-in; opponents do not receive your account username, GPS or radio data. Match details are retained for up to 90 days. For new duels under the permanent-loss rules, the losing card stays in your collection as fallen and cannot battle or trade. That card status remains until account deletion. Account deletion removes your Arena identity and account links from retained opponent records.

Private Community meeting locations

Dating posts do not show a public map pin or place instructions. Those details are shared within an accepted private connection. Text, links and photos you publish remain public, so keep private addresses out of them. Other Community categories retain public map pins. Copy location saves a meeting reference privately to your account; dating directions require the connection to remain accepted and the post available.

Optional live GPS in a private Community board uses its encryption keys. Sharing requires your choice and phone permission, and stops when you leave, close or pause the board. The relay holds encrypted location updates in memory for up to 60 seconds, with no movement history. Recipients can still copy or screenshot shared information. Radio GPS is a separate feature with separate privacy rules.

Public beacons and community posts

Pro members can separately publish an avatar at a chosen place or their live GPS location, with the public details they select. Choose My Community or the shared transit and travel maps; the avatar appears only in that selected world. This starts off and requires confirmation. Live sharing stops when the page leaves the screen; an out-of-date live marker becomes invisible within 90 seconds. Chosen pins stay until stopped or their selected expiry, no later than midnight Chicago. We store one current point, not a movement trail. Expired records may remain until the next publication or account deletion.

Publishing a sign shares the text, nickname and expiry you confirm. Its chosen map point is public except for dating posts, whose meeting details require an accepted private connection. It does not attach your live GPS. Posts can include up to three screened photos; replies are text-only and links open external sites. Public information can be copied by others.

Before you publish a Community photo, we remove embedded location metadata, resize it and send the image to OpenAI for automated safety screening. The photo may contain personal information you choose to include. Accepted checks have a green mark in Account → Photos. Rejected checks have a red mark; rejected image files are discarded immediately. A private check result, title and date stay in your account for 30 days. Failed checks stay unpublished; this screening cannot guarantee safety. Post photos become public with their posts; showcase photos become visible with your Community profile after you explicitly save them for sharing. Unpublished uploads are removed after 24 hours during subsequent upload activity. Published photos stay with their posts until replaced, deleted or the account is deleted; closed or expired post photos are not publicly served. Harmful-content reports hide photos while the operator reviews them. Safety records and blocked image fingerprints may be retained to prevent repeat abuse.

We store publisher-key hashes, signs, replies, reports and posting-agreement receipts. A private account association applies your membership allowance across your publishers; this does not make your profile public. Daily usage is retained through the Chicago calendar day, even after a sign is deleted. Transit and travel-map signs expire by midnight Chicago. Community posts use their category’s duration or Auto while eligible membership remains active. Closed or expired signs remain in owner history; deleting removes their details and replies from the live database. Keep your local publisher key to manage them.

Public sign and reply text may be sent to OpenAI and DeepSeek for advisory moderation, including personal information you put in that text. Separate map coordinates, contacts, profile fields and private radio audio are not included. Automated review can be wrong; operator action is separate.

Keeping Loopmigo running smoothly

We count broad feature taps, recent active sessions and server response times to find slowdowns and plan capacity. This first-party measurement does not record search text, exact locations, private messages, photos or card details. A short-lived browser cookie helps avoid counting the same open browser repeatedly. Recent member activity is grouped by membership using your signed-in session; temporary visitor identifiers stay in server memory for up to three minutes after the last update. Only daily totals and peak counts are retained for 30 days. These counts are private to the operator and are not sold or used for advertising profiles. Browsers with Do Not Track or Global Privacy Control enabled do not send feature activity.

Membership and payments

When checkout is available, Stripe processes subscription payments and card details. Loopmigo stores Stripe customer and subscription identifiers, plan and status, billing dates and your recurring-payment consent. We do not store your card number. Free registration does not start a subscription or the 30-day Pro subscription trial. New accounts receive a separate 7-day travel preview. We store its start and expiry times with your account to manage access; it ends without a charge. Membership & billing shows availability, price, trial and cancellation details.

Apple purchase verification

For purchases through Apple, we verify Apple-signed transaction records and subscription updates. We keep the product, purchase date, access end date, renewal or refund state, transaction identifiers and an opaque account link to restore the correct membership and prevent duplicate use. Apple manages your payment details; Loopmigo does not receive your card number. After account deletion, retained transaction records are detached from your Loopmigo account for purchase reconciliation and fraud prevention. Apple subscriptions must be canceled separately with Apple.

Your controls and requests

Use account settings to sign out, manage recovery and delete your account. Account deletion closes open website checkouts and cancels your website subscription as part of deletion, without waiting for the paid period to end. Paid access ends; a refund is not automatic. Stripe may retain records needed for financial obligations. Separate community posts and device data need their own deletion controls. We may retain records required by law or to resolve billing, abuse or security matters.

We review government and other requests for validity and scope, limit disclosure to legally required information we hold, and aim to notify users when permitted. To ask about access, correction, deletion, backups or privacy concerns, contact Loopmigo. Never send a password, recovery code or full card number.

Private Community links and alerts

Private links require both people to agree. Post text is encrypted in your browser before transmission. Only encrypted posts, public encryption keys and connection metadata are stored on the server; private decryption keys stay in your browser’s protected website storage. Closing the app keeps unexpired posts. Each private post automatically expires 14 days after it was sent and is removed from the active service; opening the board, reading or replying does not extend that deadline. Either person can choose Delete conversation to remove all posts sooner for both participants. Clearing browser storage loses that browser’s decryption key. These boards are tied to the browsers that first opened them; recipients can still copy or screenshot content. The encryption has not had an independent security audit.

Alert preferences, optional contact details and read status are private to your account. Email and SMS are not connected; saving a contact does not enable sending. In-app alerts never include private post text. Closed invitation records expire after seven days; block records remain until account deletion. Community showcases hold up to three approved photos until you remove them, delete your account, or moderation removes them.