Privacy
Türkçe: KVKK aydınlatma metni
Loomico is made by a very small team and is deliberately built without a server. This page says what that means in practice, in plain language, for both this website and the app.
Who is responsible
Loomico’s data controller, the person responsible for how it handles your data, is Kutalmış Berke Yılmaz. Write to hello@loomico.studio with any question about this page.
This website
There are no analytics, no cookies and no tracking pixels, and we do not know that you visited. The one script on the page that is not ours is the check on the waitlist form, described below.
If you join the waitlist, we store exactly three things: the email address you typed, the platform you picked, and the date and time you joined. No browser information, no referrer, no profile. That data lives on a server we rent in Finland, and it is used for one thing: to email you once, when the app reaches your store. Once that email has gone, we delete the list.
One thing more, and we would rather spell it out than let you assume. To stop a script from filling the list, we keep a scrambled fingerprint of the address your request came from: a one-way hash, mixed with a secret only our server knows, so it cannot be turned back into an address. It counts your attempts for one minute, and the next time anyone uses the form after that, it is deleted. It is never stored beside your email, and we never connect the two. We never write down your actual IP address.
The waitlist form also carries Cloudflare Turnstile, a check that a person rather than a script is filling it in. Your browser loads it from Cloudflare when the page opens, and Cloudflare sees your IP address, your browser’s User-Agent and TLS fingerprint, and which site asked. When you join, our server sends Cloudflare your check’s token and your IP address to confirm it. Cloudflare says it uses these signals to detect bots and to improve that detection, not to identify, profile or target anyone; its Turnstile privacy addendum applies.
Ask us to remove your address and we will, the same week. Write to hello@loomico.studio; there is no form and no account to log into.
The app
Your designs never leave your device. Charts, palettes, garment settings and progress are stored locally, in the app’s own storage. We have no copy of them and no way to obtain one.
- Photos. When you import a picture, the system picker hands the app one image and the conversion happens on your device. The app does not read your library.
- Camera. Used only when you tap to take a photo, and the result is treated the same way.
- Unsplash search. Optional. If you use it, the words you type are sent to Unsplash so it can return photographs. When you make a chart from one of those photos, the app also tells Unsplash which photo was used, so it counts as a download for the photographer. Like any request, both carry the IP address they came from. Their privacy policy applies to both.
- Loomico Pro. Pro is bought through the App Store, and we never see your payment details. To know whether you have it, the app asks RevenueCat, the service that checks purchases for us. It knows you by a random identifier made on your device, never your name or email. Each request also carries ordinary technical details: your device’s model and system version, the app’s version, your country and language, and the IP address it came from. On an iPhone or iPad that includes the identifier Apple gives each app maker for your device, which is not the advertising one. Because the app asks at every start, RevenueCat keeps when your copy of the app first and last did so, and we can see that record under the random identifier, never with your name. RevenueCat also records when the Pro screen is shown and closed, and if you buy, the store’s record of that purchase goes to RevenueCat too. Their privacy policy applies to all of it.
- App updates. When the app starts, it asks Expo’s update server, u.expo.dev, whether a newer version of the app’s code is available, and downloads it if there is one. That request says which version of the app you have, whether it is the iOS or Android build and which update channel it follows, and it carries a random identifier made on your device for this installation. The identifier is not linked to your name or to your Apple or Google account. If the app hit an error as it started last time, the request also says so, with a short description of the error. Like any request, it carries the IP address it came from. Expo’s privacy policy applies to all of it.
- Exports. A PDF or an image is produced on your device and handed to the system share sheet. Where it goes from there is up to you.
There is no account, no login, no advertising identifier, no analytics SDK and no crash reporting service. The only error report the app sends is the one its update check carries after a failed start, described above. We do not sell anything about you to anybody, and we hold nothing about you to sell.
When you write to us
Email you send us passes through Cloudflare, which routes mail for loomico.studio, to the inbox we read it in, kept by our email provider. We see what you send: your address, your message, and anything you include, such as an App Store order ID. We use it to answer you and for nothing else.
Why we are allowed to
Data protection law asks for a reason behind each use. Ours, under the GDPR and Türkiye’s KVKK:
- Loomico Pro. Selling Pro and knowing whether you have it are part of our agreement with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Recording when the Pro screen is shown and closed, and when the app first and last asked, is our legitimate interest in knowing that the screen works and that the app is being used (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- App updates. Our legitimate interest in getting fixes to you and pulling back an update that breaks (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- Unsplash search. Part of a feature you chose to use (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- The waitlist. Your consent, given by joining (GDPR Art. 6(1)(a); KVKK Art. 5(1)). Withdraw it any time by asking us.
- Keeping scripts off the waitlist (the scrambled fingerprint and the Turnstile check). Our legitimate interest in a list of real people (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- Email you send us. Our legitimate interest in answering you (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)), and for a request about your rights, our legal obligation to answer it (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
The update check and RevenueCat run when the app starts: without them it cannot receive fixes or know whether you have Pro. Everything else here is optional. We make no automated decisions about you and build no profile of you.
Who receives it, and where
- RevenueCat, Inc., United States: checks purchases for us. For people in the EU, the UK and Switzerland, its data processing agreement carries the European Commission’s standard contractual clauses and the UK’s addendum.
- Expo (650 Industries, Inc.), United States: serves the app’s updates for us, under the EU-U.S. Data Privacy Framework.
- Cloudflare, Inc., United States: runs the waitlist form’s check and routes email sent to loomico.studio, under the EU-U.S. Data Privacy Framework, with standard contractual clauses as its fallback.
- Hetzner Online GmbH, Germany: rents us the server, in Finland, that this website and the waitlist run on.
- Our email provider keeps the inbox your email reaches.
- Unsplash and Apple act on their own account: Unsplash for the searches you send it, Apple for App Store purchases. Their own privacy policies apply.
Nobody else receives anything.
How long we keep it
- The waitlist: until its one email has gone, then it is deleted; sooner if you ask.
- The scrambled fingerprint: deleted the next time anyone uses the form, once it is a minute old.
- Email you send us: as long as we need it to answer you; a request about your rights, as long as we need to show how we answered it.
- RevenueCat’s records: as long as the app needs them to know whether you have Pro. Ask, and we will have them deleted.
- Expo’s update records: only as long as Expo reasonably needs them, in its own words. They carry no name, so we cannot look yours up.
- Cloudflare, Unsplash and Apple: under their own policies.
- Your designs: on your device only, until you delete them or the app.
Your rights
Wherever you live, you can ask us what we hold about you, to correct it, to delete it, to stop or limit a use of it, to object to a use that rests on our legitimate interest, for a copy to take elsewhere, and to withdraw a consent you gave. Write to hello@loomico.studio. The app has no accounts, so we cannot see who you are: for anything about Pro, include the order ID from your App Store receipt, which is how we find your purchase record. We answer within a month, and within 30 days for a request under Türkiye’s KVKK, free of charge.
If our answer does not satisfy you, you can complain to the data protection authority where you live: in the EU, your country’s supervisory authority; in the UK, the Information Commissioner’s Office; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
Children
Loomico is not directed at children under 13. The app never asks anyone who they are, and the only records it leaves anywhere are the ones described above.
When this changes
If the app ever gains accounts or crash reporting, this page and its Turkish version will be updated in the same release that introduces them, not afterwards, and the date at the top will move. We would rather tell you than be asked.