Privacy Policy

Effective Date: August 1, 2026 | Last Updated: August 2, 2026

1. Overview & Commitment

Loomics ("we," "our," or "us") provides social media analytics, creator reach diagnostics, and content strategy intelligence via https://loomics.online. We prioritize user data privacy, end-to-end encryption, and complete transparency regarding how creator and brand data is collected, processed, and safeguarded.

2. Information We Collect

Account Credentials: Email address, encrypted password hash, and basic profile information provided during sign-up or Google Sign-In.
Social Platform Data (Authorized Connections): When you connect YouTube, Instagram, Facebook, X (Twitter), or LinkedIn accounts via official OAuth 2.0 flows, we access basic channel metrics, follower counts, and engagement analytics solely to display your creator dashboard.
System & Device Metrics: Anonymized usage telemetry, device platform type, and session tokens to maintain security and persistent login.

3. YouTube API & Google Data Usage Policy

Loomics uses YouTube API Services and Google OAuth 2.0 authentication. By connecting your YouTube channel or signing in with Google, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy.

Google API Limited Use Disclosure: Loomics's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data obtained via YouTube API Services is strictly limited to displaying subscriber growth, video performance, and audience retention metrics within your private dashboard. We do not sell, transfer, or share Google user data with third-party advertisers.

4. Meta (Facebook & Instagram) API Data Usage

When you connect your Facebook or Instagram account via Meta OAuth 2.0, Loomics accesses and processes data strictly in compliance with the Meta Platform Terms and Developer Policies for the following approved features:

public_profile, email: Used solely to authenticate your identity, identify the connected Meta account, and display your creator profile name inside your private Loomics dashboard.
instagram_basic: Used to read the account username, profile picture, follower counts, and media collection of your authorized Instagram professional account to populate reach diagnostics and growth analytics.
pages_show_list: Used to display the list of Facebook Pages you manage so you can choose which Page to connect to Loomics.
pages_read_engagement: Used to read engagement metrics (impressions, reach, likes, reactions, and comments count) on posts of your selected Facebook Page to provide performance analytics.
pages_manage_posts: Used exclusively when you explicitly schedule or publish content or videos from Loomics to your authorized Facebook Page. Loomics never posts without explicit user initiation.
instagram_content_publish: Used exclusively when you explicitly publish a Reel or video from Loomics to your authorized Instagram professional account.
ads_read: Used to retrieve ad accounts, campaign performance data, spend figures, CPC, CTR, and impressions in read-only mode to provide unified marketing intelligence.
Instagram Public Content Access: Used exclusively to query public Instagram hashtags and discover top-performing public media to power viral trend discovery and content ideation. We do not scrape, harvest, or store private personal data.

Data Protection Guarantee: Loomics never sells, rents, or shares Meta user data with third-party data brokers or advertisers. All access tokens are AES-256 encrypted at rest.

5. Threads API Data Usage

When you connect your Threads account via Threads OAuth, Loomics accesses threads_basic, threads_content_publish, and threads_manage_insights strictly to display your own post performance analytics and publish content upon your explicit command.

6. Data Security & Storage

All user data is stored within isolated, high-security PostgreSQL and TimescaleDB containers hosted on Oracle Cloud Infrastructure with full TLS 1.3 transport encryption. OAuth access tokens are encrypted at rest and are used strictly for authorized analytical queries.

7. Data Deletion Instructions & Compliance Inquiries

Loomics provides multiple transparent mechanisms for user data deletion in accordance with Meta Platform Terms:

In-App Disconnect & Revocation: You can instantly disconnect your Facebook or Instagram account at any time by navigating to Account Settings > Connected Accounts and clicking Disconnect. This immediately purges all stored OAuth access tokens and cached metadata from our databases.
Facebook Settings Removal: You may also revoke Loomics permissions directly from your Facebook settings: go to Settings & Privacy > Settings > Business Integrations / Apps and Websites, select Loomics, and click Remove.
Complete Account Deletion Request: To request permanent deletion of your account and all associated telemetry, send an email to [email protected] or [email protected] with the subject "Data Deletion Request". We process and confirm all deletion requests within 48 business hours.

8. Requests from Public Authorities & Government Entities

Loomics maintains strict policies and procedures regarding requests from public authorities, law enforcement, or government agencies for user personal data:

Legal Review: All public authority requests undergo mandatory legal review to verify legal validity, jurisdiction, and statutory compliance before any response is provided.
Challenging Unlawful Requests: Loomics maintains provisions to formally challenge overbroad, vague, or unlawful government data requests.
Data Minimization: If legally compelled to respond, Loomics enforces strict data minimization, disclosing only the absolute minimum information required by law.
Comprehensive Documentation: We maintain complete internal documentation of all public authority requests, including legal reasoning, actors involved, and formal responses.