Last updated: April 18, 2026
Withloam Inc. (“Loam,” “we,” “us,” or “our”) operates the Loam mobile application and the website at withloam.app. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.
When you create an account using Apple, Google, or Facebook sign-in, we receive your name, email address, and a unique identifier from the sign-in provider. We do not receive or store your password — all authentication is handled through the provider's OAuth flow.
As you use the App, we collect data you provide or that is generated by your activity, including: daily check-in responses (mood, energy level, intention), journal entries, meditation session history (which sessions you played, duration, completion status), breathing exercise usage, favorites, program progress, streak data, and soundscape mixer presets you save.
When you use The Moment, you provide a text prompt describing how you feel. This prompt, along with your selected voice and duration preference, is sent to our server to generate a personalized meditation session. The generated audio is stored so you can replay it later. We do not use your prompts to train AI models.
We automatically collect certain technical information including: device type and operating system, app version, general location (city-level, derived from IP address for weather features), time zone, and anonymous usage analytics (screens visited, features used, session durations).
Subscription, Moment Credit, and Voice Credit purchases are processed entirely by the Apple App Store or Google Play Store (and, for certain flows, by RevenueCat as a reporting intermediary). We receive a purchase confirmation and entitlement status from the Store but never see or store your payment card details or billing address.
When you use Sage Voice — our conversational AI voice companion — we process the following: (a) a transcript of the conversation, generated from your speech in real time by our third-party speech processor; (b) your acknowledgment timestamp for the Sage Voice disclosure shown before your first call; (c) minute-level call duration for quota enforcement and billing; (d) hashed safety signals (SHA-256 hashes of detected keywords — never the raw text) logged only when our safety classifiers flag a conversation for crisis or abuse review; (e) tool-call records (e.g., “agent suggested a breathing exercise”) for improving the experience. We never record or store the raw audio of Sage Voice calls. Transcripts are encrypted at rest and automatically deleted 30 days after the call. You can also delete all Sage Voice data at any time by contacting us.
To protect the Service against fraud and abuse, the App attests the integrity of your device using Apple App Attest (iOS) or Google Play Integrity (Android) the first time you launch. We store an opaque device identifier and a per-device signing secret that is used to verify that requests to our server come from the legitimate App instance. We do not receive or store your hardware serial number, IMEI, MAC address, or advertising identifier.
We use your data to:
We do not sell your personal data. We share data with the following third-party service providers only as necessary to operate the Service:
We use Cloudflare Workers, D1 (database), and R2 (file storage) to host our backend infrastructure. Your account data, wellness data, and generated audio files are stored on Cloudflare's infrastructure. Cloudflare processes data in accordance with their privacy policy and acts as a data processor on our behalf.
When you use The Moment, your text prompt is sent to the Google Gemini API to generate a meditation script. Google processes this data in accordance with their Cloud Data Processing terms. We send only the prompt text, selected voice preference, and duration — no account identifiers or personal information are included in the API request.
We use ElevenLabs for two distinct purposes: (a) text-to-speech audio synthesis for meditation sessions generated by The Moment, where ElevenLabs receives only the script text and voice selection with no personal identifiers; and (b) Conversational AI services for Sage Voice, where ElevenLabs processes your speech in real time to produce transcripts and synthesized voice responses. During a Sage Voice call, ElevenLabs acts as a data processor on our behalf under their Data Processing Agreement. Speech is not recorded to disk by ElevenLabs or by us. More information about ElevenLabs' data handling is available at elevenlabs.io.
We use the Open-Meteo API to display weather-aware greetings. We send approximate location coordinates (derived from your device) to retrieve current weather data. Open-Meteo is a free, open-source weather API that does not require authentication or track users.
When you sign in with Apple, Google, or Facebook, the respective provider handles authentication. We receive only the data described in Section 1.1 and do not share your Loam usage data back with these providers.
Apple and Google process subscription and purchase transactions. Their respective privacy policies govern how they handle your payment and purchase data.
Your data is stored on Cloudflare's global infrastructure. We implement reasonable technical and organizational safeguards to protect your data, including encrypted data transmission (TLS), secure authentication tokens (JWT), and access controls on our backend systems. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
We retain your account and wellness data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain certain data for legal or regulatory purposes (such as transaction records). Anonymized, aggregate analytics data that cannot be linked back to you may be retained indefinitely.
Depending on your location, you may have certain rights regarding your personal data:
If you are located in the EEA, UK, or Switzerland, our legal bases for processing your data are: (a) performance of a contract (to provide the Service you signed up for), (b) legitimate interests (to improve the Service and prevent fraud), and (c) your consent (for optional features like push notifications). You also have the right to lodge a complaint with your local supervisory authority.
If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion of your personal information, to opt out of the sale of personal information (we do not sell personal information), and to not be discriminated against for exercising your rights. To exercise these rights, contact us at hello@withloam.app.
If you are located in Turkey, the Personal Data Protection Law (KVKK — Kişisel Verilerin Korunması Kanunu) applies to our processing of your personal data. Your mood check-ins, journal entries, and Sage Voice transcripts may qualify as “special categories of personal data” (sensitive data relating to health) under KVKK Article 6; we process this data only with your explicit consent, obtained when you enable the relevant features. You have the right to request information about, correction of, deletion of, or restriction of processing of your personal data, and to object to processing on legitimate grounds, by contacting us at hello@withloam.app. You may also lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu).
Certain AI-generated content (The Moment sessions and Sage / Sage Voice responses) is produced automatically without meaningful human review before delivery. You have the right to request human review of any specific AI decision that significantly affects you, and we will provide a qualified human response within a reasonable time of your request.
To exercise any of these rights, please email us at hello@withloam.app. We will respond within 30 days (or sooner where required by law).
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at hello@withloam.app and we will delete the information promptly.
Our website may use essential cookies required for the site to function (such as session management). We do not use third-party advertising cookies. If we introduce analytics cookies in the future, we will update this policy and provide you with a choice to opt out.
Your data may be transferred to and processed in countries outside your country of residence, including the United States, wherever Cloudflare maintains infrastructure. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms to ensure an adequate level of data protection.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting a notice in the App or by email at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:
Withloam Inc.
Email: hello@withloam.app