Privacy

Loaf is made and sold by Edward Lee, an individual. There is no company behind this and no advertising in it. We do not sell your data, we do not share it with data brokers, and nothing in Loaf tracks you across other apps or websites.

Your pet’s photo, which is the part that matters

When you take or choose a photo, it is uploaded to our storage and sent to OpenAI, who check that there is an animal in it and then draw your pet’s poses from it. That is the only thing the photo is used for, and it is the only reason Loaf asks for one.

We delete the photo from our servers as soon as the drawings are finished, usually within a minute. OpenAI may keep API inputs for a period under their own policy; that is their retention, not ours, and we cannot shorten it for you.

Your own copy stays yours. The photo you took or chose is still in your photo library, and Loaf does not move it, copy it anywhere else, or delete it — that is your library, not ours. Deleting your pet ends our side of it; what is in Photos is for you to keep or remove.

Everything that leaves your phone

This is the whole list. It is the same list the App Store privacy labels are written from, so the two cannot drift apart.

1. The photo of your pet

   Cloudflare R2 → Trigger.dev → OpenAI

   It is the drawing. The photo is checked for an animal and then used to draw your pet’s eight poses.

   Kept: Deleted from our servers the moment the drawings are finished — usually inside a minute. OpenAI may keep API inputs for a time under its own policy. The app keeps one copy on the phone for the share card until a retake or Delete [Name].

2. The drawings of your pet

   Cloudflare R2 → Supabase

   They are drawn on our servers, so they are stored there and downloaded to your phone. The app, the widget and the Lock Screen all draw from the same pack.

   Kept: Until you delete your pet or your account.

3. Your account

   Supabase → Apple → Google

   The app signs you in before the camera opens, so the drawings have somewhere to belong. That account is anonymous — a random number, no name and no email — unless you choose Sign in with Apple or Google.

   Kept: Until you delete it. Deleting takes the drawings and the job records with it.

4. Your email address, only if you sign in

   Apple → Google → Supabase

   Apple and Google hand it over when you sign in, so the same account can be found again. Apple’s Hide My Email gives us a relay address instead, and that works exactly as well.

   Kept: Until you delete your account. We never send marketing to it.

5. Your subscription

   Apple → RevenueCat

   Apple takes the payment and tells us whether Loaf Pro is on. We never see your card, and we never hold it.

   Kept: RevenueCat keeps the purchase history against a random app user id for as long as the account exists.

6. Your nights and goals, once you sign in

   Supabase

   A copy of your pet’s log, so a new phone can bring your pet back: each goodnight and morning, the times your pet stirred, woke or settled back to sleep when you opened Loaf in the night, what your pet was given, your first name, your pet’s name and bedtime, the goals you chose, which goals you met each day, your steps in blocks of 2,000, and when each workout, focus nap and breathe started. Never your exact step counts, heart rate, or other health readings.

   Kept: Until you delete your pet or your account. Delete [Name] deletes it with the account.

7. Crash reports

   Sentry

   When Loaf falls over we get the stack trace, the device model, the iOS version and the build — enough to fix it. No photo, no pet’s name, nothing you typed.

   Kept: Ninety days, then deleted by Sentry.

8. Your email address, if you join the waitlist on this website

   Supabase

   To tell you once when Loaf opens.

   Kept: Until you ask us to remove it. One email, and it is not linked to anything in the app.

Not yet, but soon

These are built and switched off in the build this page was published against. They are listed now rather than added quietly the day they are turned on, because a policy nobody re-reads is a policy that only ever told you the old truth.

1. How far you got, if you leave Share usage data on

   PostHog

   Eleven moments — the photo picked, the pet revealed, the first goodnight, the first morning, a gift opened and six like them — against a random id. They tell us where Loaf loses people. No pet’s name and no free text can reach them: nine of the eleven carry no detail at all.

   Kept: Turn the switch off in Settings and nothing more is sent. In the UK and Ireland the switch starts off, and turning it on is the consent.

2. Your day as yes or no, and your night streak, only if you add friends

   Supabase → Your friends in the park

   So a friend’s park can show your pet’s week. For each of the last seven days, four answers and nothing else: did you meet your Move goal, your Focus goal, your Breathe goal, and did you say goodnight. Also your current night streak, as one number. Never your steps, minutes, workouts, bedtime or any time of day, no Apple Health readings, only whether you met each goal. Loaf sends these at most once every six hours, and each time it sends things as they stood at the start of that six hours, so a goodnight reaches friends only in the next six hours, usually the next morning. What does show: a friend who checks often can tell roughly when you are active in Loaf, including when you first open it in each six-hour window, when you accept their request, and when you bark. Nothing is sent while you have no friends, and never from an account that is not signed in with Apple, Google or email.

   Kept: Two weeks: older days are deleted every day on our side. When your last friend is gone, your days are deleted the next time Loaf opens. Delete [Name] deletes them at once.

3. Your pet’s card, and what you send friends

   Supabase → Cloudflare R2 → Whoever opens your invite link → Your friends in the park

   Your pet’s name, your name, and your pet’s drawings. They are shared with whoever opens an invite link you create, before they tap Add, and with anyone you send a friend request to, so they can see who is asking. Friends see them in the park, with your night streak. A friend request waits until the person you asked says yes or no; if they say no, the request is deleted and you are not told. A bark says who barked at whom on which day. A block is kept so it holds. A report sends us the reported pet’s name, drawing and their owner’s name to review. Never the photo: everyone sees the drawings only.

   Kept: Your card is deleted every day on our side once you have no friends and no open invite link. Requests nobody answers are deleted after 30 days, invite links after a week or once used. Removing or blocking a friend ends what they see. A report is kept until either account is deleted. Delete [Name] deletes every friendship, request, bark, block, report and invite with the account.

What never leaves your phone

• Your nights. Every goodnight, every morning, your streak and everything your pet has been given live in a database on your phone. Until you sign in, none of it is copied anywhere, which is also why deleting the app starts you over. If you add friends, your streak as one number and a yes or no per day go to them (above).
• Your pet’s name and their bedtime. On the phone, in the same place, and in your backup once you sign in (above). If you make an invite link or add friends, your pet’s name goes to them too (above).
• Your step counts and health readings. Loaf reads your steps, walking distance and floors climbed from Apple Health and the phone’s motion sensor, and from Loaf 1.1 your workouts, to count your Move goal. The readings stay on the phone; only what the backup row above names leaves it, and friends you add see only a yes or no for each goal (above). Loaf never reads heart rate, sleep or screen time, and we never claim to know how you slept.
• Your location. Never asked for, never collected. The app reads your time zone, because a bedtime needs one, and that stays on the phone.

What we do not claim

Loaf does not know how you slept. It knows whether the phone was put down, which is a different thing, and it is scored on the device. Loaf makes no health claim of any kind. It reads your steps to count a goal, not to tell you anything about your health.

Deleting everything

Settings › Account › Delete account deletes your account, the drawings on our servers, the job records and your nights. It happens on our side first, not just in the app: the account row is removed and every file attached to it goes with it, with no thirty-day grace period. Your photo library is not touched — that was never ours to delete from — and deleting the app clears whatever Loaf had left on the device.

Cancelling your subscription is separate and is done in the App Store — see Support. Deleting your data does not cancel a subscription, and cancelling does not delete your data.

Your rights

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it — write to [email protected] and we will answer within thirty days. In practice the Delete button in Settings does all of it at once, immediately.

If you are in the United Kingdom or Ireland, usage analytics start off and stay off until you turn them on; turning the switch on is your consent, and turning it off withdraws it — while analytics are off in a build, Settings names the row with nothing to switch. You can complain to the ICO (UK) or the Data Protection Commission (Ireland). If you are in California, we do not sell or share personal information as those words are defined there, and we will not treat you differently for exercising any right.

Our lawful basis for the photo and the drawings is performing the contract you entered into — without them there is no pet. Crash reports rest on our legitimate interest in Loaf not crashing. Usage analytics rest on your consent where consent is required, and on the same legitimate interest elsewhere; the switch works either way.

Children

Loaf is not directed at children under 13 and we do not knowingly collect anything from them. If you believe a child has used Loaf, write to [email protected] and we will delete the account.

Where the data sits

Our processors — Supabase, Cloudflare, Trigger.dev, OpenAI, RevenueCat, Sentry and PostHog — store data on servers in the United States. If you are in the UK, Ireland or the EEA, that is a transfer, and it is covered by each processor’s standard contractual clauses.

If this changes

The date at the top moves when the words do. If a change means something materially different for you, the app will say so before it takes effect rather than leaving it here to be found.

Write to us

[email protected]. One person reads it, and you will get a reply.

Edward Lee, Washington, United States. Written from one list of 11 things, checked against the app itself.