Loop exists to share one thing — your work schedule — with the people you choose. We keep the least we can to do that, and nothing sensitive off your screenshot.
What Loop stores
- Your account: email, the name you choose to show family, your airline, home town, home base and home airports, your timezone, and a securely hashed password.
- Your trips: flight numbers, airport codes, scheduled and (when tracking) actual times, deadhead/cancelled flags, and layover cities.
- Your commute flights, and any home events or reminders you or your family add.
- The private share links and family accounts you create.
- If you subscribe: the App Store transaction id, which plan, when it renews or ends, and whether it is set to renew. That is how Loop knows the subscription is active. Apple takes the payment; Loop never sees your card.
- On an iPhone or iPad: the tokens Apple gives the app for notifications and Live Activities, a random id for the app install, and the device's timezone so notification times read in your own clock. They are used only to deliver Loop's notifications and keep its Live Activities and widgets current. They are removed when you sign out or stop following someone on that device, and deleted with the account.
What Loop never keeps
None of the following is ever saved. It may be visible on the screenshots you upload, and in that case they pass through the reading service described below, but it is not extracted and not stored.
- Names of crew members or any other person on the schedule.
- Phone numbers, employee/badge/ID numbers.
- Hotel names, addresses, or confirmation numbers — only the layover city.
- Ground-transport companies or drivers.
- Pay, per diem, credit hours, fares, ticket numbers, or record locators.
Your screenshot
When you upload a schedule, the screenshots are sent to Anthropic, which reads them and returns the structured trips above for you to review. Each whole image goes across, including anything else visible on it, because that is how it is read.
Loop's operator also uses Claude, from Anthropic, to check each day that flights were tracked correctly. That check reads Loop's two-week record of how each flight was tracked: flight numbers, airports, times and crew first names, never email addresses.
Loop never stores the screenshots. They are held in memory for the seconds the request takes and are not written to any database, file store, cache or log. Only the schedule fields you confirm are saved, and the app is built to keep only those: the model is instructed not to return names, phone numbers, employee numbers, hotel names, ground transport or pay, and the server independently checks every saved field before storing it — airports must look like airport codes, cities like city names — so anything else is dropped rather than kept.
How long it's kept
Trips and commutes are kept for a year: anything that ended before the 1st of this month a year ago is removed automatically, whether or not you upload anything. You can shorten that to as little as a month under Remove past trips on your profile; accounts made before that setting existed stay at a year until you change it. Your schedule shows them from the 1st of last month on; the older ones are in the download of your data. Home events and reserve days go sooner: anything ending before the previous calendar month is removed. You can also delete any trip on your schedule yourself at any time, and you can download everything Loop holds on you: in the iPhone and iPad app under You → Download my data, or on the website under Account.
Sharing
Nobody sees your schedule unless you share a link or invite them. A “schedule only” link shows flights and live status but never your home events or reminders. You can revoke any link or remove any family member instantly, which cuts off both reading and adding.
Who else touches your data
- Cloudflare hosts the app and the database.
- Anthropic reads your uploaded schedule screenshots.
- Anthropic also runs the operator's daily check that flights were tracked correctly.
- FlightAware receives flight numbers and airport codes to return live status. It is never told who you are.
- Resend sends sign-in and verification emails, so it sees your email address.
- Apple sells the subscription and takes the payment. A purchase carries your Loop account number, a random id, so Apple's renewal notices reach the right account. Apple also delivers the iPhone and iPad app's notifications and Live Activities.
- Apple, Google or Mozilla deliver notifications to your browser. Their contents are encrypted so only your device can read them.
The services above get only what their job needs, and must protect it as well as this policy does.
Operator access
Loop is run by one person, who can reach the database it lives in and sees an admin page listing account email addresses and usage counts. Nobody else has access, and there is no advertising code in the app and nothing is shared with anyone.
The operator also gets a daily email with the same counts and the names and email addresses of new sign-ups.
Loop keeps an activity record so it can be run and repaired: that you signed up, uploaded a schedule, created a share link, started or ended a subscription, and whether an upload failed or was turned away, and why — with your account attached, kept for up to a year. The why is a kind or a count, never anything written on the screenshot: that it looked like reserve days or a month calendar, that two times came back blank, that nine images were sent. When the reading service turns an upload away, the record also keeps its error message and the three-letter code of the Cloudflare data centre the upload came through, which shows roughly where you were. It never records what was in a trip, an event or a reminder. The operator sees counts built from it on the admin page, and a list of recent failures with the account's email address beside each.
If you delete your account, that record goes with it, with one exception: the rows that record what running Loop cost — how much AI work reading your screenshots took, and how many alerts were sent — are kept for two more months so the bills still add up. Your account is taken off them first: no name, no email, no account number, no trip or flight details. After two months they are deleted too.
Loop also keeps short-term diagnostic logs: which page was requested, error messages, and whether an outside service failed. Cloudflare holds those for a few days. They contain no schedule details, no event or reminder text, and no screenshots.
Security & your controls
Passwords are hashed, never stored in the clear. Sessions are private to your device and expire. You can change your password, verify your email, revoke any share link, and permanently delete your account and all its data: in the iPhone and iPad app under You → Delete account, or on the website under Account.
Questions, or a request to see or delete your data: support@loopcal.net. Last updated 28 September 2026.