Privacy Policy

Last updated: July 2026

LOXA ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, and your rights. It is written to comply with the EU General Data Protection Regulation (GDPR), UK GDPR, the UK Data Protection Act 2018, and the California Consumer Privacy Act (CCPA). Users in all countries are covered by this policy.

1. Who We Are (Data Controller)

LOXA is operated as a personal project based in the United Kingdom. As the data controller, we determine how and why your personal data is processed. For all privacy enquiries, contact us at hello@loxa-explore.com.

2. What Data We Collect

Account Information

When you create an account, we collect your email address and a securely hashed password. If you sign in with Google, we receive your name and email address from Google.

Location Data

With your explicit permission, LOXA collects GPS location data while you explore. This is the core purpose of the app. We collect your location continuously when the app is active and, if you enable background tracking, when the app is in the background. Your precise start and end points are offset by up to 300 metres to reduce the risk of your home address being identifiable.

Activity Data

When you post an activity, we store your route, distance, duration, speed, and any photos you choose to attach. Each activity also stores the audience you select for it (everyone, followers, or only you).

Social Data

We store your social interactions so the app's social features work: who you follow, follow requests you send or receive (including for private accounts, which require your approval), likes, and comments.

Privacy Settings

We store your chosen privacy preferences so we can apply them across the service. These include whether your account is public or private, whether your stats and activities are hidden from non-followers, whether you appear in global rankings, and the default audience for your posts.

Usage Data

We collect basic app usage information such as search queries and session data to improve the service.

Beta Agreement Record

We store a record that you accepted the Beta Testing Agreement, including your name, email, and the date of acceptance, to evidence informed consent.

3. Legal Basis for Processing (GDPR / UK GDPR)

We only process your personal data where we have a lawful basis to do so:

Contract (Art. 6(1)(b)): to provide the LOXA service you signed up for.
Consent (Art. 6(1)(a)): for location tracking and notifications. You can withdraw consent at any time via your device settings without affecting your account.
Legitimate interests (Art. 6(1)(f)): to improve the app, prevent abuse, and ensure security, where these interests are not overridden by your rights.

4. How We Use Your Data

To display your exploration map and activity history.
To generate personalised area recommendations via our AI search feature.
To share your profile, activities, and stats with other users according to your privacy settings. You control this: your account can be public or private, private accounts must approve follow requests, you can hide your stats and activities from non-followers, and you choose the audience for each activity (everyone, followers, or only you). Activities you set to "everyone" on a public account may appear in a global feed visible to all LOXA users.
To operate leaderboards and social features you opt into.
To send app notifications you have enabled.
To maintain the security and integrity of the service.

We do not sell your personal data. We do not use your data for advertising or profiling for commercial purposes.

5. Third-Party Services & International Transfers

LOXA uses the following third-party processors. Where data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards:

Supabase: database and authentication (EU/US hosted; SCCs apply)
Mapbox: map tiles and location display (US)
Cloudflare: map tile delivery (global CDN)
Google Places API: place information and photos (US)
Google Gemini AI: AI-powered area recommendations (US)
Google Sign-In: optional third-party authentication (US)
Apple Push Notification Service (APNs): push notifications (US)

Each of these services operates under its own privacy policy and data processing agreements. We do not grant them permission to use your data for their own purposes beyond providing the service to us.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, all of your personal data will be permanently deleted. This includes your location history, activities, photos, and account information. Beta agreement records may be retained for up to 3 years to evidence consent, after which they are deleted.

7. Your Rights (GDPR / UK GDPR)

You have the following rights over your personal data:

Access (Art. 15): request a copy of the personal data we hold about you.
Rectification (Art. 16): ask us to correct inaccurate data.
Erasure (Art. 17): delete your account and all data at any time via Settings → Delete Account.
Restriction (Art. 18): ask us to limit processing of your data.
Portability (Art. 20): receive your data in a portable, machine-readable format.
Object (Art. 21): object to processing based on legitimate interests.
Withdraw consent: revoke location or notification permission at any time in your device Settings.

To exercise any right, contact hello@loxa-explore.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority: in the UK, that is the Information Commissioner's Office (ico.org.uk); in the EU, contact your national data protection authority.

8. California Residents: CCPA Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Know: the right to know what personal information we collect, use, disclose, and sell (we do not sell).
Delete: the right to request deletion of your personal information.
Correct: the right to correct inaccurate personal information.
Opt-out of sale: we do not sell or share your personal information with third parties for their own commercial purposes.
Non-discrimination: we will not discriminate against you for exercising any CCPA right.

To submit a CCPA request, contact us at hello@loxa-explore.com. We will respond within 45 days.

9. Children's Privacy

LOXA is intended for users aged 16 and over. By creating an account, you confirm you meet this requirement. If we become aware that an account belongs to someone under 16, we will delete it. To report a concern, contact us at hello@loxa-explore.com.

10. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), secure password hashing, and access controls. No internet transmission is 100% secure, but we take reasonable steps to protect your information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app. Your continued use of LOXA after the effective date of changes constitutes acceptance of the updated policy.

12. Contact & Complaints

For any privacy-related questions, data subject requests, or complaints, contact us at hello@loxa-explore.com. We aim to respond within 30 days. If you are unsatisfied with our response, you have the right to escalate to your national supervisory authority.

← Back to LOXA