LoopySign in

Privacy Policy

Last updated: November 12, 2026

Iverson Inc. (“Loopy,” “we,” or “us”) provides a visual feedback service that a customer can install on its website. This policy explains how Loopy handles information from account holders and from people who submit feedback through that widget.

Information Loopy processes

  • Account and access data: name, email address, Google account identifiers, workspace and project membership, roles, and invitations.
  • Billing data: when a workspace owner starts a paid plan, Stripe, Loopy’s payment processor, receives the owner’s email address, the workspace name, Loopy’s identifiers for the workspace and for the person who started its trial, and the number of billed seats. Loopy keeps the Stripe customer and subscription identifiers, the plan’s status, seat count, trial and renewal dates, whether a payment failed, and a record of who has had the free trial. Card and other payment details are entered on Stripe’s own pages and never reach Loopy; Stripe handles them under its own privacy policy.
  • Feedback content: comments, annotations, the visible-page screenshot, status, priority, assignment, and discussion history.
  • Page context: page URL, route and title; selected-element tag, id, classes, selector, text excerpt, position, dimensions, ancestor tags, nearby heading or section, selected computed styles, and available component markers.
  • Diagnostics: browser and operating-system details, device and viewport dimensions, console errors and warnings, recent console messages, and failed Fetch or XMLHttpRequest method, URL, status, and duration.
  • Optional enhanced debugging: when a project owner enables it, a bounded history of successful, failed, pending, or aborted requests; errors; navigation and interaction events; and masked page replay. Explicitly allowed endpoints may include redacted, size-limited request and response bodies and approved headers. Customers may supply release identifiers, environment names, custom metadata, monitoring links, and private source maps.
  • Reporter data: a reporter identifier, name, or email when the customer website supplies it.
  • Confirmed sender email: when a project asks who is sending feedback, the email address the person enters. Loopy emails a one-time code to that address to confirm it, and stores the confirmed address with each report the person sends on that website. A person can usually skip this step; a project can also require it.
  • Security data: request origin and network address. Limits on public requests, such as feedback submissions and sign-in error reports, store a keyed, non-readable fingerprint of the network address rather than the address itself.

The widget does not record keystrokes or the website’s cookie or local-storage contents. Replay masks input values and page text and excludes sensitive regions before upload. Request and response body capture is off by default and requires an endpoint allowlist; authentication and cookie headers are excluded. Unsubmitted enhanced recordings remain in bounded browser memory and are not uploaded. Redaction is best effort: screenshots, URLs, console output, selected text, and explicitly enabled debugging data may still contain personal or customer data.

What the widget stores in a visitor’s browser

On a website that carries the widget, Loopy keeps up to three items in that website’s local storage in the visitor’s browser. The widget sets no cookies.

  • loopy:config:<project>: the project’s widget settings as the browser last received them, including who sees the widget and how debugging capture is set up. The widget reads them only when it cannot reach Loopy, so a project set to hide the widget stays hidden. Each new set of settings replaces them.
  • loopy:team: a project identifier, written when someone opens that project’s team link. It is how the widget recognizes a teammate’s browser when a project shows the widget only to its team.
  • loopy:reviewer:<project>: written only after a person confirms their email on that website. It holds the confirmed address and a signed token, and the widget sends the token with each report the person sends there so they are not asked again. The token stops working after 30 days.

The first two items contain no personal information and are not sent to Loopy. The third contains the person’s email address and is sent to Loopy with their reports. All three stay until the visitor clears that website’s storage.

How information is used

Loopy uses this information to receive, display, organize, secure, troubleshoot, export, and delete feedback; authenticate users; deliver invitations; confirm who sent feedback so the customer’s team can follow up; bill for paid plans and give each person one free trial; prevent abuse; and maintain the service. Loopy does not sell personal information or use it for targeted advertising. Loopy emails a confirmed sender only the one-time code they asked for.

Customers and their website visitors

The Loopy customer decides where to install the widget, why to collect feedback, and whether its widget asks who is sending. The customer’s team sees a confirmed sender’s email address with that person’s reports and may use it to follow up. That customer is responsible for giving its visitors any required notice and for having a lawful basis to send their information to Loopy. If you submitted feedback on a customer website, contact that website first for requests about the submission.

Sharing and subprocessors

Loopy shares information with service providers only as needed to run the service, comply with law, protect rights and safety, or complete a business transfer. The current providers and purposes are listed on the Subprocessor List.

Retention and deletion

See the Data Retention and Deletion Policy for the current operational periods and deletion process.

Security and international processing

Loopy uses access controls, encrypted transport, managed infrastructure, and other reasonable safeguards. No service can guarantee absolute security. Loopy and its providers may process information in the United States and other countries where they operate.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, object to, restrict, or delete personal information. Workspace owners can export or delete workspace data in Settings. You may also contact hello@tryloopy.co. Loopy may need to verify your identity and may direct a website visitor to the relevant Loopy customer.

Children

Loopy is a business service and is not intended for anyone under 18.

Changes

Loopy may update this policy as the service changes. The date above identifies the current version.