Last updated: April 24, 2026
Effective date: April 24, 2026 · Version 2.0
Withloam Inc. (“Loam,” “we,” “us,” or “our”) operates the Loam mobile application (“App”) and the website at withloam.app (“Site,” together with the App, the “Service”). This Privacy Policy explains what personal data we collect, the legal bases on which we process it, who we share it with, how long we keep it, and what rights you have. It forms part of, and should be read together with, our Terms of Service. By creating an account or using the Service you confirm that you have read and understood this Policy. If you do not agree, please do not use the Service.
The full policy below is written for legal precision. This summary is provided for convenience only and does not replace the binding text that follows.
The data we collect depends on how you use the Service. We process the categories of personal data below.
When you create an account, we receive identifying information from your chosen authentication provider (Apple, Google, or Facebook): your email address, display name, an opaque unique user identifier, and (where you choose to share it) an avatar URL. We do not receive or store your password — authentication is performed entirely through the provider's OAuth flow. We additionally store your recorded affirmation that you are at least 13 years of age (an age-confirmation timestamp), your subscription status, and your chosen profile preferences.
As you use the Service, we collect data you provide and data generated automatically by your activity. This includes:
Where you choose to journal in the Service we store the text of your entries, the mood tag you associate with the entry, any AI-generated insight produced for that entry, and an optional link to the meditation session that prompted the entry. We also store AI-generated journal prompts shown to you. Journal entries are private to your account, are not visible to other users, and are not used to train any AI model.
When you use The Moment, you provide a free-text prompt describing how you feel, an optional mood selection, your preferred voice, and your preferred duration. This input, together with a small set of personalization signals (your experience level, recent practice history, and learned preferences), is sent to our AI providers for script generation and audio synthesis. The resulting script and audio file are stored against your account so you can replay the session without consuming additional credits. Each generation is also logged for quota enforcement and abuse prevention.
Sage is a text-based AI wellness companion. Sage Voice is the optional voice-based version. When you use these features we process:
We never record or store the raw audio of Sage Voice calls. The voice channel is processed in real time and is not written to disk. Transcripts are stored in encrypted form and are automatically deleted 30 days after the call. Aggregated usage counters and conversation-level metadata may be retained longer in accordance with Section 7 (Data Retention).
Premium subscriptions, Moment Credits, and Voice Credits are processed exclusively through the Apple App Store or Google Play Store. We receive a transaction reference, a product identifier, an entitlement status, and a renewal/expiration timestamp. We never receive or store your payment-card number, billing address, or other Store payment details. We maintain an internal append-only ledger of credit balances, credit purchases (with a reference to the Store receipt), and credit transactions to prevent double-spending and to make your balance accurate to you.
Where you opt in to push notifications, we store a device push token, the associated device type, and your per-type notification preferences (daily reminders, streak-protection nudges, program continuation, AI-session-ready alerts, time-aware nudges, Sage nudges) together with any quiet hours you have set. Push tokens are marked inactive when you sign out and rotated when your device or operating system re-issues them. We do not currently send marketing emails; if we add this in the future we will obtain your opt-in consent.
The App reports device information needed to operate and protect the Service: device model, operating system and version, App version, and the language and time-zone of the device. We do not collect your device serial number, IMEI, MAC address, or any advertising identifier (IDFA / AAID), and we are not integrated with any advertising network.
On iOS, where you grant permission, the App writes “mindful minutes” to the Apple Health app for each meditation, breathing exercise, or AI session you complete. This is a one-directional write: we do not read heart rate, heart-rate variability, sleep, respiratory, blood pressure, or any other data from HealthKit. You may revoke this permission at any time in iOS Settings › Health › Data Access & Devices. Data received from HealthKit is not used to advertise to you, sold, shared with third parties, or used for purposes other than the purpose for which you granted permission, in accordance with Apple's HealthKit terms.
If you enable weather-aware features, the App requests an approximate location (city-level or device time-zone, never precise GPS coordinates) which is used to retrieve current weather conditions for your area. The location is used at request time and is not stored long-term against your account. If you disable weather features the request is not made.
We log application events (screen views, feature usage, completion outcomes, error categories, App-session identifiers, and the hour and day-of-week of the event) to understand product usage in aggregate and to diagnose problems. These events are linked to your account so you can request access or deletion, but are aggregated and de-identified before they inform any product decision. We do not use third-party analytics providers (such as Google Analytics, Mixpanel, Amplitude, PostHog, or Segment) and we do not share these logs with any third party.
To keep the Service safe and compliant we maintain: classification outcomes for Sage and Sage Voice conversations (for example, whether the conversation was flagged for crisis or abuse review), the action our system took in response (for example: gentle redirect, displayed crisis resources, ended the call), and records of consents you have given (such as your acceptance of the Sage Voice disclosure). We also maintain records sufficient to demonstrate compliance with your data-rights requests.
We use the categories of data described above to:
If you are located in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing your personal data under Article 6 of the General Data Protection Regulation (GDPR) and equivalent UK and Swiss laws are:
We do not sell your personal data and we do not share your data for cross-context behavioral advertising. To operate the Service we engage carefully selected third-party service providers to perform specific functions on our behalf, in each case under a written data-processing agreement and on a strict need-to-know basis. The categories of providers are:
The specific named providers we currently use (which form part of our App Store privacy disclosures) are available on request by emailing [email protected].
Some of the data you provide — including mood entries, daily check-ins, journal text, AI-session prompts, and Sage Voice transcripts — may reveal information about your mental, emotional, or physical wellbeing. In some jurisdictions this is treated as sensitive personal information or as a special category of personal data (for example under GDPR Article 9, KVKK Article 6, the CCPA/CPRA “sensitive personal information” category, and similar provisions in other US state laws). Where such categorization applies, we process this data only with your explicit consent obtained when you enable the relevant feature, we apply additional security safeguards, and we do not use it for any purpose other than the purposes described in this Policy.
We are based in the United States and our infrastructure providers operate global edge networks. Your personal data may be transferred to, processed in, and stored in countries outside your country of residence, including the United States, that may have different data-protection laws. Where required by law (including for transfers from the EEA, UK, or Switzerland) we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss Federal Data Protection and Information Commissioner's recognition of the SCCs, or other lawful transfer mechanisms, together with supplementary technical and organizational safeguards, to ensure an adequate level of protection.
We retain personal data only for as long as necessary to fulfill the purposes described in this Policy. Specifically:
Subject to applicable law, you have the rights described below. To exercise any right, email us at [email protected] from the address associated with your account or use the in-app deletion flow. We will verify your identity (typically by confirming control of the email used to sign in), respond within 30 days (or sooner where required by law), and may extend by a further 60 days for complex requests.
In addition to the universal rights above, you have the right to: (a) object to processing on grounds of legitimate interest; (b) obtain restriction of processing; (c) not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 8.8 on AI rights); and (d) lodge a complaint with your local supervisory authority.
California residents have the right to know what categories and specific pieces of personal information we have collected, the purposes for which we use them, the categories of sources, and the categories of third parties with whom we share them; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising); the right to limit the use of sensitive personal information (we use it only as described in this Policy and do not infer characteristics from it); and the right to non-discrimination.
Residents of Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Texas (TDPSA), Utah (UCPA), Oregon (OCPA), Montana (MCDPA), and other states with comprehensive privacy laws have substantially similar rights, including access, deletion, correction (where provided by law), portability, and the right to opt out of targeted advertising and the sale of personal data. We do not sell personal data and do not engage in targeted advertising. Where your state provides a right to appeal a denied request, you may appeal by replying to our written response.
If you are located in Turkey, the Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu, “KVKK”) applies. Mood entries, journal text, and Sage Voice transcripts may qualify as “special categories of personal data” under KVKK Article 6 and we process them only with your explicit consent. You may exercise your KVKK rights — including information, access, correction, deletion, restriction of processing, objection to processing, and the right to compensation for unlawful processing — by contacting [email protected], and you may lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu).
If you are a data subject in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. You have the rights to confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, withdrawal of consent, and to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
Canadian residents have rights of access, correction, and withdrawal of consent under PIPEDA and applicable provincial laws. Quebec residents additionally have rights under An Act Respecting the Protection of Personal Information in the Private Sector (Law 25), including the right to be informed of automated decision-making, to obtain de-indexation of online information, and to data portability.
The Moment, Sage, and Sage Voice produce AI-generated content automatically without meaningful human review before delivery to you. None of these features make a legally binding decision about you, take any action that has a legal effect on you, or determine access to a contractual benefit. Nevertheless, you have the right at any time to request a qualified human review of any specific AI-generated response that you feel significantly affects you, and to request that we explain, in plain language, the categories of input that informed it. Email [email protected] to make such a request.
We apply reasonable and appropriate technical and organizational measures designed to protect your personal data, including encryption of data in transit, encryption-at-rest of sensitive stored data, least-privilege access controls for our personnel, rate limits on sensitive endpoints, logging and monitoring of access, segregation of production and non-production environments, and an incident response plan reviewed periodically. No method of electronic storage or transmission is, however, completely secure, and we cannot guarantee absolute security.
In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant supervisory authorities without undue delay, in accordance with the timelines required by applicable law (including the 72-hour notification requirement under GDPR Article 33 where applicable). Notification will describe the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address it.
The Service is not directed to children under 13 and we do not knowingly collect personal data from children under 13. We enforce a server-side age gate that requires every account holder to affirm that they are at least 13 years of age (in compliance with the Children's Online Privacy Protection Act, “COPPA”). Where local law requires a higher digital age of consent (for example, age 14, 15, or 16 in certain EU Member States), users below that local age must additionally have the consent of a parent or legal guardian to use the Service. If you believe a child has provided us with personal data without the necessary consent, please contact [email protected] and we will delete the data promptly.
The Site (withloam.app) uses only essential cookies needed for the Site to function (for example, to remember your language preference and to maintain a session). The Site does not use third-party advertising cookies, tracking pixels, behavioral retargeting, fingerprinting, or session replay. The App does not use cookies. If we introduce optional analytics cookies in the future we will provide a banner or in-app control allowing you to consent or decline.
Push notifications are off by default and require your explicit opt-in. You can change per-type preferences and quiet hours in Settings inside the App, or revoke push permission entirely from your device's system settings. Operational and transactional messages (such as account-deletion confirmations or material changes to this Policy) may be delivered to the email address associated with your account regardless of your push preferences.
You may delete your account at any time using the in-app deletion flow (Settings › Account › Delete account) or by emailing [email protected]. Account deletion is irreversible and will remove your profile, wellness data, journal entries, generated AI sessions, presets, achievements, and Sage / Sage Voice conversations from active systems within 30 days of the request, subject to the retention exceptions in Section 7. Encrypted backups containing your data are securely overwritten on their regular rotation cycle (typically within 90 days).
We may update this Privacy Policy from time to time. Where we make material changes, we will notify you by posting a notice in the App and on the Site at least 14 days before the changes take effect, and where required by law, by email to the address associated with your account. The version number and effective date at the top of this page reflect the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.
For privacy questions, requests to exercise your rights, or to report a privacy concern, contact:
Withloam Inc.
Privacy Office
Email: [email protected]
For users in the European Economic Area, the United Kingdom, or Switzerland: where required by Article 27 GDPR, our representative and routing address for data-subject requests can be obtained by emailing the address above.
← Back to home