Privacy

Loaf is made and sold by Edward Lee, an individual. There is no company behind this and no advertising in it. We do not sell your data, we do not share it with data brokers, and nothing in Loaf tracks you across other apps or websites.

Your pet’s photo, which is the part that matters

When you take or choose a photo, it is uploaded to our storage and sent to OpenAI, who check that there is an animal in it and then draw your pet’s poses from it. That is the only thing the photo is used for, and it is the only reason Loaf asks for one.

We delete the photo from our servers as soon as the drawings are finished, usually within a minute. OpenAI may keep API inputs for a period under their own policy; that is their retention, not ours, and we cannot shorten it for you.

Your own copy stays yours. The photo you took or chose is still in your photo library, and Loaf does not move it, copy it anywhere else, or delete it — that is your library, not ours. Deleting your pet ends our side of it; what is in Photos is for you to keep or remove.

Everything that leaves your phone

This is the whole list. It is the same list the App Store privacy labels are written from, so the two cannot drift apart.

1. The photo of your pet

   Cloudflare R2 → Trigger.dev → OpenAI

   It is the drawing. The photo is checked for an animal and then used to draw your pet’s eight poses.

   Kept: Deleted from our servers the moment the drawings are finished — usually inside a minute. OpenAI may keep API inputs for a time under its own policy. Your own copy stays in your photo library, which Loaf never touches.

2. The drawings of your pet

   Cloudflare R2 → Supabase

   They are drawn on our servers, so they are stored there and downloaded to your phone. The app, the widget and the Lock Screen all draw from the same pack.

   Kept: Until you delete your pet or your account.

3. Your account

   Supabase → Apple → Google

   The app signs you in before the camera opens, so the drawings have somewhere to belong. That account is anonymous — a random number, no name and no email — unless you choose Sign in with Apple or Google.

   Kept: Until you delete it. Deleting takes the drawings and the job records with it.

4. Your email address, only if you sign in

   Apple → Google → Supabase

   Apple and Google hand it over when you sign in, so the same account can be found again. Apple’s Hide My Email gives us a relay address instead, and that works exactly as well.

   Kept: Until you delete your account. We never send marketing to it.

5. Your subscription

   Apple → RevenueCat

   Apple takes the payment and tells us whether Loaf Pro is on. We never see your card, and we never hold it.

   Kept: RevenueCat keeps the purchase history against a random app user id for as long as the account exists.

Not yet, but soon

These are built and switched off in the build this page was published against. They are listed now rather than added quietly the day they are turned on, because a policy nobody re-reads is a policy that only ever told you the old truth.

1. Crash reports

   Sentry

   When Loaf falls over we get the stack trace, the device model, the iOS version and the build — enough to fix it. No photo, no pet’s name, nothing you typed.

   Kept: Ninety days, then deleted by Sentry.

2. How far you got, if you leave Share usage data on

   PostHog

   Eleven moments — the photo picked, the pet revealed, the first goodnight, the first morning, a gift opened and six like them — against a random id. They tell us where Loaf loses people. No pet’s name and no free text can reach them: nine of the eleven carry no detail at all.

   Kept: Turn the switch off in Settings and nothing more is sent. In the UK and Ireland the switch starts off, and turning it on is the consent.

What never leaves your phone

• Your nights. Every goodnight, every morning, your streak and everything your pet has been given live in a database on your phone. In 1.0 none of it is copied anywhere, which is also why deleting the app starts you over.
• Your pet’s name and their bedtime. On the phone, in the same place.
• Your health and screen time. Loaf asks for neither. It scores one thing — whether the phone was put down — and it scores it on the phone. We never claim to know how you slept.
• Your location. Never asked for, never collected. The app reads your time zone, because a bedtime needs one, and that stays on the phone.

What we do not claim

Loaf does not know how you slept. It knows whether the phone was put down, which is a different thing, and it is scored on the device. Loaf makes no health claim of any kind and asks for no health data.

Deleting everything

Settings › Delete [your pet’s name] and my data deletes your account, the drawings on our servers, the job records and your nights. It happens on our side first, not just in the app: the account row is removed and every file attached to it goes with it, with no thirty-day grace period. Your photo library is not touched — that was never ours to delete from — and deleting the app clears whatever Loaf had left on the device.

Cancelling your subscription is separate and is done in the App Store — see Support. Deleting your data does not cancel a subscription, and cancelling does not delete your data.

Your rights

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it — write to hello@loaf-app.com and we will answer within thirty days. In practice the Delete button in Settings does all of it at once, immediately.

If you are in the United Kingdom or Ireland, usage analytics start off and stay off until you turn them on; turning the switch on is your consent, and turning it off withdraws it — while analytics are off in a build, Settings names the row with nothing to switch. You can complain to the ICO (UK) or the Data Protection Commission (Ireland). If you are in California, we do not sell or share personal information as those words are defined there, and we will not treat you differently for exercising any right.

Our lawful basis for the photo and the drawings is performing the contract you entered into — without them there is no pet. Crash reports rest on our legitimate interest in Loaf not crashing. Usage analytics rest on your consent where consent is required, and on the same legitimate interest elsewhere; the switch works either way.

Children

Loaf is not directed at children under 13 and we do not knowingly collect anything from them. If you believe a child has used Loaf, write to hello@loaf-app.com and we will delete the account.

Where the data sits

Our processors — Supabase, Cloudflare, Trigger.dev, OpenAI, RevenueCat, Sentry and PostHog — store data on servers in the United States. If you are in the UK, Ireland or the EEA, that is a transfer, and it is covered by each processor’s standard contractual clauses.

If this changes

The date at the top moves when the words do. If a change means something materially different for you, the app will say so before it takes effect rather than leaving it here to be found.

Write to us

hello@loaf-app.com. One person reads it, and you will get a reply.

Edward Lee, Washington, United States. Written from one list of 7 things, checked against the app itself.