Author
Patrick Bass Submitted
Aug 18, 2026 10:00pm Summary
Loopa Coach: what a coach can see, and how a member turns it off
This is the plain-language version of the [https://loopa.mobieus.io/privacy Loopa Privacy Policy]. The policy is the document that binds us; this page is the same facts in fewer words. Where they disagree, the policy wins.
== The short version ==
+
* '''Your health data is encrypted with a key that is yours alone.''' Nobody browsing our database sees your weight, meals, medications or vitals.
+
* '''Deleting your account destroys that key''', which makes everything you ever stored permanently unreadable — by us too. See [[Deleting your account]].
−
* '''Your health data is encrypted with a key of your own.''' Nobody browsing our database sees your weight, meals, medications or vitals. We hold the key that unwraps yours, so a few of our staff can reach your record when there is a reason to. See below.
−
* '''Deleting your account destroys that key''', which makes everything you ever stored permanently unreadable, including by us. See [[Deleting your account]].
* '''We do not sell your information''', and we never will. No advertising network gets it. No data broker gets it.
* '''We do not use your data to train an AI model.'''
* '''You can take it all with you''' at any time. See [[Exporting your data]].
−
* '''Your coach sees a protocol as a pattern, not a prescription.''' If you switch a protocol category on, a coach sees a symptom pattern as counts, which days your doses fall on, 14-day wellbeing averages, dose days as calendar markers, and which of your days are your strongest and roughest as two words. Never a compound name, an amount, a lab value, a note, a question you wrote, a food-noise entry, the scores behind a label, or libido. A category you switched on before the calendar items existed stays as it was until you confirm the updated list. '''A peptide protocol is never shared with a coach and has no switch.''' See [[sharing-your-protocol-with-a-coach|Sharing your protocol with a coach]].
−
* '''An organization you joined sees nothing you logged.''' A gym, club or team you join inside Loopa gets a private room and its challenges, and no role in it (member, admin or owner) can read your food, weight, workouts, activity, measurements, photos, cycle or vitals. See [[joining-an-organization|Joining an organization]].
−
* '''An organization that runs Loopa under its own name sees counts, never you.''' If your gym, club or employer runs Loopa for its members rather than joining as a group inside it, it sees how many of its members were active or on Premium. Not which ones, and nothing any of them logged.
== What Loopa holds ==
+
Only what you record, and only for the features you switch on: food and drink, weight and body measurements, vitals (blood pressure, heart rate, blood glucose, blood oxygen, temperature), sleep, steps and workouts, water, fasting, habits, goals, progress photos, supplements and doses, and — if you enter them — medical conditions, medications, allergies and whether you are pregnant or nursing.
−
Only what you record, and only for the features you switch on: food and drink, weight and body measurements, vitals (blood pressure, heart rate, blood glucose, blood oxygen, temperature), sleep, steps and workouts, water, fasting, habits, goals, progress photos, supplements and doses, and, if you enter them, medical conditions, medications, allergies and whether you are pregnant or nursing.
−
−
If you switch on a '''medication protocol''', it also holds the kind you turned on, the schedule you set, the compound names, amounts and notes you typed, every dose you logged with the place on the body map, your symptoms and their severities, your daily wellbeing check-in (including food noise, where you record it), any question you wrote for your prescriber, the refill date and pharmacy lead time on a supply record, the lab results you entered (DEXA and bone density among them), your Off-Ramp answers, and the weekly lean-mass protection score computed from your own logs. The names, amounts, notes, symptoms, check-ins, questions, lab values and the score are encrypted with your own key. See [[medication-protocols|Medication protocols]].
Those last ones are there for your safety. The app cannot avoid suggesting a food you are allergic to, or a fast that is wrong while you are pregnant, unless it knows.
It also holds your account details, anything you post in the community, and ordinary technical information like your IP address, device type and app version.
'''It does not hold''' your location, your contacts, your calendar, your photo library beyond images you attach, or anything about what you do outside Loopa.
== How the encryption works ==
+
Every member has their own random 256-bit key. Health values are encrypted with it before they are written to the database, and the key itself is stored only in wrapped form. A stolen copy of the database, without the wrapping key, is unreadable.
−
Every member has their own random 256-bit key. Health values are encrypted with it before they are written to the database, and your key itself is stored only in wrapped form. A stolen copy of the database, without the wrapping key, is unreadable.
+
Your password is never sent to us at all. Loopa uses OPAQUE, in which your password is used to compute a proof on your own device and never leaves it — there is no password in our database to steal. The trade is real and worth knowing: '''we cannot recover a lost password''', only send you a reset link. See [[Installing and signing in]].
−
'''Who holds the wrapping key: we do.''' It sits on the server and is not derived from anything you know or carry. So this protects you against a stolen database, backup or disk. It does not put your record beyond our reach. A small number of our staff, working on the server, can decrypt it. Anyone who tells you a health app has encryption that even its own engineers cannot break should be asked how.
−
−
'''What is not encrypted:''' your fasting times, the meal plans and weekly insights we generate for you, your habit check-ins, anything you post in the community, the subscription id your app store gives us, and three parts of a medication protocol (the cadence of its schedule, the route, and the site on the body map you chose), because a reminder has to fire on the right day and the rotation map has to be drawn. None of those three names a substance or an amount. So is the version of the coach-sharing disclosure you confirmed for a protocol category, which is a number and nothing about your health. Everything listed here is stored as ordinary text.
−
−
Your password is never stored, not even as a hash. Loopa uses OPAQUE, in which your password computes a proof of who you are instead of being handed over to be checked. On the web it never leaves your device; in the apps it is sent once over TLS, used to compute that proof, and discarded immediately. There is no password in our database to steal. The trade is real and worth knowing: '''we cannot recover a lost password''', only send you a reset link. See [[Installing and signing in]].
== Who else sees it ==
Only companies we need to run the app, each under a contract that forbids them using it for anything else:
+
* '''Anthropic''' — the AI features, and the community content filter. See [[What your coach knows about you]] and [[Community rules and reporting]].
+
* '''Apple and Google''' — purchases and push notifications.
+
* '''Stripe''' — payments made on the website. We never see your card number.
+
* '''Withings, Oura, iHealth''' — only the ones you connect, and only what you asked them to sync.
+
* '''Food databases''' — they get the food name or barcode you searched, never your identity or your log.
−
* '''Anthropic'''. The AI features, and the community content filter. See [[What your coach knows about you]] and [[Community rules and reporting]].
−
* '''Apple and Google'''. Purchases and push notifications.
−
* '''Stripe'''. Payments made on the website. We never see your card number.
−
* '''Withings, Oura, iHealth'''. Only the ones you connect, and only what you asked them to sync.
−
* '''Food databases'''. They get the food name or barcode you searched, never your identity or your log.
That is the whole list. It is also in the privacy policy, named company by named company.
== What goes to the AI, and when ==
Only when you use an AI feature. The coach screen shows you the list built from '''your own''' data before you use it, so if you have entered no medications it does not tell you medications are sent. Your name, email and account id are never included.
+
Separately, if you are new to Loopa, the text of a forum post is checked by a classifier before it publishes. Nothing else is — not your messages, not your health log. See [[Community rules and reporting]].
−
Separately, if you are new to Loopa, the text of a forum post is checked by a classifier before it publishes. Nothing else is screened. Not your messages, not your health log.
−
−
There is one thing that is not screening but is worth knowing: if a message or post is '''reported''', that reported item's text is sent once to help a moderator triage it. A human still decides. It never happens unless somebody reported that particular item. See [[Community rules and reporting]].
== Apple Health and Health Connect ==
If you connect either, Loopa reads only the categories you tick and writes back only what you ask it to.
Health data from them is '''never used for advertising, never sold, and never stored in iCloud'''. Revoke access any time in your phone's Health or Health Connect settings; data already synced stays until you delete it. See [[Apple Health sync]].
== Who can see your health data ==
Nobody, unless you share it. Not other members, not your Family Group, not the organizer who pays for it. See [[Family group what is shared|What a family group shares, and what it never shares]].
+
If you share with a buddy or in a challenge, Loopa records each time they look at a category of it, and keeps that record for a year — that log exists for you. Ask privacy@mobieus.io and we will tell you what it says.
−
If you share with a buddy or in a challenge, Loopa records each time they look at a category of it, and keeps that record for a year. That log exists for you. There is no screen for it yet, so ask privacy@mobieus.io and we will tell you what it says.
== Your rights ==
+
Wherever you live, you can know what we hold, get a copy, correct it, delete it, export it, withdraw consent, and object to or restrict processing — and we will not treat you differently for asking. Most of it you can do yourself in the app. For anything else, email '''privacy@mobieus.io''' from your account address and a person answers within 30 days.
−
Wherever you live, you can know what we hold, get a copy, correct it, delete it, export it, withdraw consent, and object to or restrict processing. We will not treat you differently for asking. Most of it you can do yourself in the app. For anything else, email '''privacy@mobieus.io''' from your account address and a person answers within 30 days.
== See also ==
−
* [[Your data screen|The Your Data screen: what is encrypted, who has looked, who you share with]]
−
* [[medication-protocols|Medication protocols]]
−
* [[sharing-your-protocol-with-a-coach|Sharing your protocol with a coach]]
−
* [[AI and your information]]
* [[Deleting your account]]
* [[Exporting your data]]
* [[Community rules and reporting]]
* [[What your coach knows about you]]
* [[Who can use Loopa]]
* [https://loopa.mobieus.io/privacy The full Privacy Policy]
This is the plain-language version of the [https://loopa.mobieus.io/privacy Loopa Privacy Policy]. The policy is the document that binds us; this page is the same facts in fewer words. Where they disagree, the policy wins.
== The short version ==
- '''Your health data is encrypted with a key that is yours alone.''' Nobody browsing our database sees your weight, meals, medications or vitals.
- '''Deleting your account destroys that key''', which makes everything you ever stored permanently unreadable — by us too. See [[Deleting your account]].
- '''We do not sell your information''', and we never will. No advertising network gets it. No data broker gets it.
- '''We do not use your data to train an AI model.'''
- '''You can take it all with you''' at any time. See [[Exporting your data]].
== What Loopa holds ==
Only what you record, and only for the features you switch on: food and drink, weight and body measurements, vitals (blood pressure, heart rate, blood glucose, blood oxygen, temperature), sleep, steps and workouts, water, fasting, habits, goals, progress photos, supplements and doses, and — if you enter them — medical conditions, medications, allergies and whether you are pregnant or nursing.
Those last ones are there for your safety. The app cannot avoid suggesting a food you are allergic to, or a fast that is wrong while you are pregnant, unless it knows.
It also holds your account details, anything you post in the community, and ordinary technical information like your IP address, device type and app version.
'''It does not hold''' your location, your contacts, your calendar, your photo library beyond images you attach, or anything about what you do outside Loopa.
== How the encryption works ==
Every member has their own random 256-bit key. Health values are encrypted with it before they are written to the database, and the key itself is stored only in wrapped form. A stolen copy of the database, without the wrapping key, is unreadable.
Your password is never sent to us at all. Loopa uses OPAQUE, in which your password is used to compute a proof on your own device and never leaves it — there is no password in our database to steal. The trade is real and worth knowing: '''we cannot recover a lost password''', only send you a reset link. See [[Installing and signing in]].
== Who else sees it ==
Only companies we need to run the app, each under a contract that forbids them using it for anything else:
- '''Anthropic''' — the AI features, and the community content filter. See [[What your coach knows about you]] and [[Community rules and reporting]].
- '''Apple and Google''' — purchases and push notifications.
- '''Stripe''' — payments made on the website. We never see your card number.
- '''Withings, Oura, iHealth''' — only the ones you connect, and only what you asked them to sync.
- '''Food databases''' — they get the food name or barcode you searched, never your identity or your log.
That is the whole list. It is also in the privacy policy, named company by named company.
== What goes to the AI, and when ==
Only when you use an AI feature. The coach screen shows you the list built from '''your own''' data before you use it, so if you have entered no medications it does not tell you medications are sent. Your name, email and account id are never included.
Separately, if you are new to Loopa, the text of a forum post is checked by a classifier before it publishes. Nothing else is — not your messages, not your health log. See [[Community rules and reporting]].
== Apple Health and Health Connect ==
If you connect either, Loopa reads only the categories you tick and writes back only what you ask it to.
Health data from them is '''never used for advertising, never sold, and never stored in iCloud'''. Revoke access any time in your phone's Health or Health Connect settings; data already synced stays until you delete it. See [[Apple Health sync]].
== Who can see your health data ==
Nobody, unless you share it. Not other members, not your Family Group, not the organizer who pays for it. See [[Family group what is shared|What a family group shares, and what it never shares]].
If you share with a buddy or in a challenge, Loopa records each time they look at a category of it, and keeps that record for a year — that log exists for you. Ask privacy@mobieus.io and we will tell you what it says.
== Your rights ==
Wherever you live, you can know what we hold, get a copy, correct it, delete it, export it, withdraw consent, and object to or restrict processing — and we will not treat you differently for asking. Most of it you can do yourself in the app. For anything else, email '''privacy@mobieus.io''' from your account address and a person answers within 30 days.
== See also ==
- [[Deleting your account]]
- [[Exporting your data]]
- [[Community rules and reporting]]
- [[What your coach knows about you]]
- [[Who can use Loopa]]
- [https://loopa.mobieus.io/privacy The full Privacy Policy]
This is the plain-language version of the [https://loopa.mobieus.io/privacy Loopa Privacy Policy]. The policy is the document that binds us; this page is the same facts in fewer words. Where they disagree, the policy wins. == The short version == * '''Your health data is encrypted with a key that is yours alone.''' Nobody browsing our database sees your weight, meals, medications or vitals. * '''Deleting your account destroys that key''', which makes everything you ever stored permanently unreadable — by us too. See [[Deleting your account]]. * '''We do not sell your information''', and we never will. No advertising network gets it. No data broker gets it. * '''We do not use your data to train an AI model.''' * '''You can take it all with you''' at any time. See [[Exporting your data]]. == What Loopa holds == Only what you record, and only for the features you switch on: food and drink, weight and body measurements, vitals (blood pressure, heart rate, blood glucose, blood oxygen, temperature), sleep, steps and workouts, water, fasting, habits, goals, progress photos, supplements and doses, and — if you enter them — medical conditions, medications, allergies and whether you are pregnant or nursing. Those last ones are there for your safety. The app cannot avoid suggesting a food you are allergic to, or a fast that is wrong while you are pregnant, unless it knows. It also holds your account details, anything you post in the community, and ordinary technical information like your IP address, device type and app version. '''It does not hold''' your location, your contacts, your calendar, your photo library beyond images you attach, or anything about what you do outside Loopa. == How the encryption works == Every member has their own random 256-bit key. Health values are encrypted with it before they are written to the database, and the key itself is stored only in wrapped form. A stolen copy of the database, without the wrapping key, is unreadable. Your password is never sent to us at all. Loopa uses OPAQUE, in which your password is used to compute a proof on your own device and never leaves it — there is no password in our database to steal. The trade is real and worth knowing: '''we cannot recover a lost password''', only send you a reset link. See [[Installing and signing in]]. == Who else sees it == Only companies we need to run the app, each under a contract that forbids them using it for anything else: * '''Anthropic''' — the AI features, and the community content filter. See [[What your coach knows about you]] and [[Community rules and reporting]]. * '''Apple and Google''' — purchases and push notifications. * '''Stripe''' — payments made on the website. We never see your card number. * '''Withings, Oura, iHealth''' — only the ones you connect, and only what you asked them to sync. * '''Food databases''' — they get the food name or barcode you searched, never your identity or your log. That is the whole list. It is also in the privacy policy, named company by named company. == What goes to the AI, and when == Only when you use an AI feature. The coach screen shows you the list built from '''your own''' data before you use it, so if you have entered no medications it does not tell you medications are sent. Your name, email and account id are never included. Separately, if you are new to Loopa, the text of a forum post is checked by a classifier before it publishes. Nothing else is — not your messages, not your health log. See [[Community rules and reporting]]. == Apple Health and Health Connect == If you connect either, Loopa reads only the categories you tick and writes back only what you ask it to. Health data from them is '''never used for advertising, never sold, and never stored in iCloud'''. Revoke access any time in your phone's Health or Health Connect settings; data already synced stays until you delete it. See [[Apple Health sync]]. == Who can see your health data == Nobody, unless you share it. Not other members, not your Family Group, not the organizer who pays for it. See [[Family group what is shared|What a family group shares, and what it never shares]]. If you share with a buddy or in a challenge, Loopa records each time they look at a category of it, and keeps that record for a year — that log exists for you. Ask privacy@mobieus.io and we will tell you what it says. == Your rights == Wherever you live, you can know what we hold, get a copy, correct it, delete it, export it, withdraw consent, and object to or restrict processing — and we will not treat you differently for asking. Most of it you can do yourself in the app. For anything else, email '''privacy@mobieus.io''' from your account address and a person answers within 30 days. == See also == * [[Deleting your account]] * [[Exporting your data]] * [[Community rules and reporting]] * [[What your coach knows about you]] * [[Who can use Loopa]] * [https://loopa.mobieus.io/privacy The full Privacy Policy]
