Effective date: October 6, 2026 · This is the authoritative English version.
1. Who we are
Loci ("we", "us") is the mobile app Loci (Android package com.lociar.app) and its
companion website at lociar.com. Our family edition, Loci Go
(com.lociar.go), collects far less and has its
own privacy policy. For anything in this policy, contact
lociar.com [at] gmail.com.
2. Information we collect
| Data | Details |
|---|---|
| Account | A random account ID is created when you first open the app (guest account). If you register, we also store your email address, or your Google account email if you sign in with Google. We never see or store your Google password. |
| Profile | The handle and display name you choose. These are visible to other users. |
| Precise location | Loci's core function is placing and finding content at exact real-world spots, so the app requires precise GPS location while you use it. The locations of memories and game markers you place are stored and shared with users who can see that content. We do not collect your location while the app is closed. |
| Camera | The camera feed powers the AR view and is processed on your device. Camera images are only uploaded in two cases: photos you deliberately take and post, and anonymized visual feature data used for AR anchors (see section 3). |
| Content you create | Text notes, photos, comments, likes, quiz questions and answers, game scores, follows, friend connections, reports, and blocks. |
| Push token | A Firebase Cloud Messaging token so we can deliver notifications (likes, comments, friend requests) to your device. |
| Diagnostics | An optional on-device diagnostics log (off by default, toggled under Me) used for troubleshooting. It stays on your device unless you send it to us yourself. |
| Feedback | Bug reports and ideas you file through "Send feedback" (in the app or on lociar.com). They go to the Loci team only: no other user can see them, and we do not reply to them individually. A report filed from the app also attaches the app version, your device model and one line of AR status (GPS accuracy, compass state, marker count); the app shows you this line before you send. You can attach up to nine screenshots to a report; they are kept in a private store that only our moderators can read, so still crop out anything you would not want us to see. Your location is never attached. |
| Usage events | Which screens you view and which features you use in the app (for example "opened the games tab" or "shared a game"), in the order you used them, with timestamps and your phone's time zone at that moment (so we can tell what time of day people play). Events about a game name that game. When the app starts it also records your phone's model, Android version, memory size and language, so we can find problems that affect particular phones. Each batch of events also carries the two-letter code of the country your phone's mobile network reports (or, without a network or SIM, the country your phone is set to), so we can see where Loci is played; it is never a position, and it is read without any location permission. These events never include the content of what you write or search for, and never include your location. We use them only to understand and improve Loci's own features, never for advertising, and they are deleted automatically after 13 months. Before they are deleted we keep daily totals (for example "how many people opened the games tab on a given day"), which contain no account and cannot be traced back to you. You can turn usage events off at any time with Me → "Share usage stats"; turning it off also deletes the events not yet sent. Nothing is sent before you accept the notice on first launch. When you install Loci from Google Play after following a link, Play hands the app the parameters that were on that link (a game code, campaign labels such as "poster" or "reddit", and, for a link shared from the app, the name of the app it travelled through, such as "whatsapp"); the app records those labels once, as the source of the install, and nothing else: no advertising identifier is read or stored. When you share a game from the app, it records which app you picked to send it with (for example WhatsApp), and the link it sends carries that app's name so the join or install it leads to can be counted by app. The link never names you or the person you send it to. |
3. AR anchors and Google
To pin content precisely, Loci uses Google's ARCore Cloud Anchors service. When you place or find anchored content, visual feature data derived from your camera images is sent to Google to create or resolve the anchor. Google processes this data according to the ARCore data privacy terms; per Google, the feature maps are used to host and resolve anchors and are not usable to identify you.
4. Photos are public
Photos attached to memories are stored in a publicly readable storage bucket: anyone who has a photo's link can view it, regardless of other privacy settings. Don't post photos you wouldn't want public.
5. Automated content moderation
To keep Loci safe, text and images you upload, including pictures you attach to quiz questions, are automatically scanned by a moderation service (currently OpenAI's moderation API) at upload time. Content flagged as violating our rules is removed. The moderation vendor processes the content to perform the scan; it is not used to train their models per their API terms. Pictures attached to quiz questions are stored in a publicly readable storage bucket like memory photos: anyone who has a picture's link can view it.
6. Machine learning
We may use the content and usage data described in section 2 to develop and improve Loci's own features: for example tuning content moderation, improving how AR markers are placed and found, or ranking and recommendations. When we do:
- we de-identify or aggregate the data wherever the purpose allows it;
- we never let third parties use your data to train their models (our moderation vendor's no-training terms are in section 5);
- we design training so that models do not memorize or reproduce your personal data;
- we will not use your content to train models that generate public-facing content without asking you first;
- if you delete content or your account, it is removed from our training datasets right away and drops out of models at the next retraining cycle;
- you can object to this use of your data at any time by emailing us (section 14), and we'll exclude your account from future training.
7. Service providers
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage: all account data and content lives here. |
| ARCore Cloud Anchors (section 3), Firebase Cloud Messaging (push), optional Google sign-in. | |
| OpenAI | Automated moderation scanning of uploaded text and images (section 5). |
| Map providers: OpenStreetMap, Stadia Maps, MapTiler | The maps in the app and on lociar.com load their tile images straight from one map provider's servers: OpenStreetMap by default, Stadia Maps or MapTiler when OpenStreetMap can't serve us. Those requests expose your IP address and the map area you're viewing to the provider in use, under its own privacy policy (OpenStreetMap, Stadia Maps, MapTiler). The credit line on each map names the provider. |
| Cloudflare | Hosts lociar.com. To name a park near you on the page at lociar.com/get,
the site uses the approximate, city-level position Cloudflare derives from your IP address. Your browser is
never asked for its location, and the position is used for that one lookup and not stored. The country of that
position also picks the page's language when your browser's language is not one the page has, and it offers that
language in one line when it differs from the one shown. |
| YouTube (Google) | The video on lociar.com/get plays from YouTube in its privacy-enhanced
mode (youtube-nocookie.com). Nothing is requested from YouTube or Google until you press play: the poster you see
first is served by lociar.com. Once playing, YouTube's own privacy
policy applies to that player. |
We share data with these providers only to run the service. We do not sell personal data for money. We may introduce advertising in the future, including personalized advertising; some laws (such as California's) treat ad-related data sharing as a "sale" or "sharing" of personal information. Before any of that happens, we will update this policy and provide the opt-outs those laws require.
8. Who sees what
Your handle, display name, and the content you post are visible to other users under the visibility rules in the app (public content, followers, friends, or game participants). Blocking a user hides your content from them. Location is shared only as part of where you chose to place content: other users never see a live feed of your position, except that in live team games your marker position is shared with your game's participants while you play. Feedback you send us is never shown to other users.
9. Retention, export, and deletion
- Export: Me → "Export my data" writes everything we hold about you to a file on your device.
- Delete: Me → "Delete account" permanently deletes your account and all your content, immediately and irreversibly. You can also delete individual memories, comments, and games at any time without deleting the account.
- Legal-hold exception: where we are legally required to preserve evidence (for example under child-safety laws such as 18 U.S.C. §2258A), we retain the specific reported material and the associated account records, and nothing else, in a restricted store inaccessible from the app, for up to 90 days (longer only where law or an active investigation requires it), after which it is deleted automatically. See our child-safety standards.
- Private memories: a memory you keep private ("Only me") is deleted automatically 30 days after you leave it. The app shows the days left on the memory and reminds you 7 days before. Share it with friends or everyone to keep it.
- If you can't access the app, see account deletion for a request-by-email path.
- Content removed by moderation is deleted from user view immediately; flagged image files are deleted from storage outright.
- Feedback you send us, screenshots included, is kept while we work on it and is deleted with your account; when we delete a report ourselves, its screenshots are deleted from storage with it.
- Usage events (section 2) are deleted automatically after 13 months, and immediately if you delete your account; the anonymous daily totals made from them are kept. "Export my data" includes your usage events.
10. Your rights
Depending on where you live (e.g. GDPR in Europe, CCPA/CPRA in California), you may have rights to access, correct, delete, or port your data, and to object to processing. The in-app export and delete tools cover most of these directly; for anything else, email us and we'll respond within 30 days. The right to erasure does not extend to data we must keep to comply with a legal obligation (GDPR Art. 17(3)(b)); see the legal-hold exception above. You may also lodge a complaint with your local data-protection authority.
11. Children
Loci is not directed at children under 13, and the app asks your birth year on first launch to keep under-13 users out. The year you enter is checked once, on your device, and is never stored or sent to our servers: we keep only a yes/no result. We do not knowingly collect personal information from children under 13; if you believe a child is using Loci, contact us and we will delete the account. Families looking for the kids' experience should use Loci Go, which is designed for children and covered by the Loci Go privacy policy.
12. Security
All traffic between the app and our servers is encrypted in transit (HTTPS). Access to content is enforced server-side with row-level security. No system is perfectly secure: report vulnerabilities to the contact address above.
13. Changes
We'll update this policy as the service evolves and change the effective date above. Material changes will be announced in the app.