Preliminary version 0.14 · 18 de outubro de 2026 · under legal review. The text may change before public launch. Courtesy translation; if there is any discrepancy, the Portuguese (Brazil) version prevails.

loozy Privacy Policy

This is a courtesy translation. If there is any discrepancy, the Portuguese (Brazil) version prevails.

In short

loozy helps you find a toilet. You can browse the map without an account. To contribute — add toilets, write reviews, upload photos, save favourites — you create an account with your name, a username and your email. We don't store your location, we don't track you across apps, and we don't sell data to anyone. You can tell us your sex and age range — it's optional, it helps us understand, in aggregate numbers, who uses the app, and it's never public. We only send you news by email if you ask for it, and you can change your mind at any time. You can delete everything inside the app, whenever you want.

This summary doesn't replace the text below, but it doesn't contradict it.

1. Who we are

Data controller: Loozy Technology & Revolution LTDA, a Brazilian company, CNPJ 69.256.189/0001-84, Rua Dr. Antonio Macedo Lima, 156, Sala 1, São Paulo – SP, 03145-040, Brazil.

Representative in the European Union (Article 27 GDPR): Pedro Paredes, Rua Conde de Almoster, 52, 1500-195 Lisboa, Portugal.

• Privacy matters: privacidade@loozygo.com
• General support: ola@loozygo.com
• Supervisory authorities: CNPD (Portugal) and ANPD (Brazil)

2. You can use loozy without an account

On the sign-in screen, "Explore without an account" lets you browse the map, open each toilet's page and get walking directions without creating an account. In that mode we create no record about you: no account, no identifier, no session. The requests the app makes to our server — searching around you, computing a route — are handled as sections 3 and 5 describe.

To add toilets, write reviews, upload photos, save favourites, report content or block someone you need an account. The account is free and only becomes active after you confirm your email with the code we send you.

3. Which data we process, and why

When you use the map, with or without an account

• Your location, to show what's nearest. The app asks our server for the toilets within a radius around your position (or, if you don't grant location access, around the centre of Lisbon). To sort them by the walking path rather than the straight line, it asks our own routing server (section 5), which does not store the request either. The server answers and does not store that request in the database: there is no history of where you've been. Like any request, it may appear, with the IP address, in the server's technical logs for up to 30 days. Legal basis: consent, given through the system's location permission, which you can withdraw at any time.

When you create an account — required

• Name — so we know who we're talking to and the account belongs to a real person. Never shown to other people. Legal basis: performance of the contract.
• Username — the public name that signs what you contribute. You choose it and it doesn't have to relate to your name. Legal basis: performance of the contract.
• Email — to sign in and recover access. When you create the account, and when you ask to reset your password, we send a 6-digit code to that email; we only store an encrypted version of the code, valid for 10 minutes. Emails are sent through Microsoft Azure's email service (Azure Communication Services), with data in the European Union, and have no open or click tracking. Legal basis: performance of the contract.
• Password — stored only as a cryptographic hash (scrypt). We never have access to the password itself.
• Your contributions — toilets, reviews, reports, photos and favourites.
• Your acceptance of these documents — we store the date and the version of the Terms and of this Policy you accepted when creating the account. Legal basis: legal obligation to demonstrate consent (GDPR art. 7(1)).

When you upload a photo

• We accept photos in JPEG, PNG or WebP; other formats (HEIC included) are refused. The file you send first lands in a private area that nobody can see from outside. Before the photo becomes public, our server removes its metadata — EXIF and XMP, where phones usually put the GPS location and the time the photo was taken — and publishes it at a new address. An upload that is never confirmed is deleted within 1 day. The published photo is visible to anyone who has its address, and is shown on the toilet's page with your username. Legal basis: consent — you choose to send it.

When you report or block

• Reports of reviews and photos — who reported, what, the reason (from a fixed list) and the optional note you write. Only you see yours; whoever posted the content doesn't know who reported it. They serve to take down what is offensive, illegal or shows people. Legal basis: legitimate interest in the safety and integrity of the content.
• Blocks — who you blocked. Only you see them, and the blocked person is not told. Legal basis: performance of the contract (it's a feature you ask for).
• When someone reports content, we send ourselves an email alert so we can review it. That alert is a summary with no personal data: it doesn't carry the name, email or username of whoever reported or whoever posted.

When you create an account — optional, and only if you want

• Sex (female, male, other) and age range (for example 25–34). They serve one purpose: understanding, in aggregate numbers, who uses the app — how many people per age range, what proportion of each sex — to decide where to improve. They are never shown to anyone, never used to treat you differently, and never sold or shared. You can skip them ("prefer not to say"), and you can delete the answers in your profile at any time. Legal basis: consent (GDPR art. 6(1)(a) / LGPD art. 7-I), which is not a condition for using the app.
• Receiving news by email — only if you tick the option, which comes unticked. It's for sending you loozy news: new features, new areas on the map, partners. We never hand your email to third parties for advertising. You can untick it in your profile whenever you want and every email tells you how. Legal basis: consent (and Law no. 41/2004 in Portugal for commercial communications).

Always

• Minimal technical data for the app to work: the IP address at the time of the request, used only to stop brute-force attempts and bulk requests (an in-memory count on the server, for minutes, never written to the database), and the server's error logs.

4. What we DON'T do

• We don't keep a history of your location.
• We don't use analytics SDKs, advertising or advertising identifiers in the app. The app's statistics are aggregate counts from the data you gave us in your account (section 3), with no individual profiles. On the loozygo.com website there are exceptions, described in section 4-B.
• We don't track you across apps, and we don't use website data for advertising or to build profiles.
• We don't sell or rent personal data, nor hand your email or account data to partners. If one day we want to share something with a partner, we ask you first, separately, and you can say no.
• We make no automated decisions with legal effects on you.

4-A. Crash reports

(This section only applies when crash reporting is enabled. Today it is off — the integration exists in the code but sends nothing without configuration. Delete this section if the decision is not to enable it.)

When something breaks in the app or on the server, a technical report is sent to Sentry so we can understand what happened: the error itself, the device model, the OS version and the app version.

The report does not include your email, your passwords, your session keys, nor the addresses the app requested — which is why it doesn't include your location either, which travelled in those addresses. Legal basis: legitimate interest in keeping the service running.

4-B. Website statistics and measurement (loozygo.com)

Website only, never the app. If you accept in the notice shown on your first visit, we use audience measurement tools — today, Google Analytics 4 — to understand how the site is used and to improve it. This includes the pages you visit and the path between them; your country, language, type of device and browser; how you found us (search, link, campaign); and actions on the site, such as clicking an email contact, switching language, opening a legal document or submitting the partner form (in that case, only the type of venue chosen, never what you write).

To do this, the tool uses cookies and similar identifiers ("statistics cookies", such as _ga), lasting up to 2 years, and receives your IP address, which Google Analytics 4 does not store. We turn off advertising signals and ad personalisation, and we do not link this data to your loozy account. If we ever start using another tool or measuring something else, we will update this policy and ask for your consent again before turning it on.

We also measure, in aggregate and without cookies, how many people visit the site, which pages and from which country, with Cloudflare Web Analytics. It stores nothing on your device, does not identify you and does not follow you across sites; so it works even if you decline statistics cookies, and it does not run if your browser sends the "Do Not Track" signal or Global Privacy Control. Cloudflare, Inc. processes this data as a processor, which may involve leaving the European Union (an exception to what section 6 says); see its policy at https://www.cloudflare.com/privacypolicy/. Legal basis: legitimate interest in knowing, in aggregate numbers only, whether the site works.

If you decline statistics cookies, or don't answer, Google Analytics is not loaded and no request leaves the site for Google; the site works the same. You can change your mind at any time under "Cookie preferences" in the site footer; when you decline, we delete any cookies already set. Legal basis for statistics cookies: consent.

Google LLC processes this data as a processor, under the EU–US Data Privacy Framework, which means that in this case the data may leave the European Union (an exception to what section 6 says). See Google's policy at https://policies.google.com/privacy.

5. When data leaves your phone to third parties

The base map. To draw the map, the app uses Google Maps on Android and Apple Maps on iOS. As in any app with a map, those services receive from your device the map area you're looking at and your IP address, under Google's and Apple's privacy policies. We receive and store none of it.

Walking directions. Only when you ask for them: then the coordinates of where you are and where you want to go go to our servers, which compute the walking route with OpenStreetMap data. They are not sent to any third party: the route is computed by our own routing server (see §6), and the request is not stored.

You learn about this here and, if you create an account, in the box you accept at sign-up. The app doesn't ask again each time: asking for directions is asking for this computation. If you don't want your position to leave your phone, don't use directions — the map and everything else work without them. For now we have walking routes in Portugal and in Greater São Paulo; elsewhere the toilet shows on the map but the route is not computed. If the computation fails, the app tells you so; it never draws a made-up route.

Everything else in the app works without directions.

6. Where the data lives

On Amazon Web Services (AWS) servers, in the eu-west-1 (Ireland) region — inside the European Union. That is where the database, the photos you upload and the server that computes walking routes live.

For people in the European Union, the data never leaves the EU. For people in Brazil, it is processed in the European Union under the mutual adequacy decision between the European Union and Brazil of 27 January 2026.

Verification and password-recovery emails are the exception: they go out through Microsoft Azure's email service, also with data in the European Union (see section 3).

7. How long we keep it

• Your account and what you contributed: as long as you have an account. When you delete it, we delete it (see section 9).
• Never-confirmed accounts: if you create an account and don't confirm the email within 7 days, we delete it completely — it never had a session, so it never contributed anything.
• Sessions: access keys last 15 minutes and refresh keys 30 days; the record of each refresh key is deleted 30 days after it expires.
• Codes sent by email: valid for 10 minutes; the record is deleted 24 hours after expiry.
• Photos uploaded but never confirmed: deleted within 1 day.
• Server technical logs: 30 days.
• Website statistics (Google Analytics), only with consent: 2 months; the cookies, up to 2 years or until you decline.
• Database backups: 7 days.

8. Your rights

You have the right to access, correct, delete, object to processing, request restriction, withdraw consent and receive your data in a portable format.

The most important part is already inside the app:

• See — Profile and Edit profile show your account data and what you contributed.
• Correct — Profile → Edit profile.
• Delete — Profile → Account settings → Delete account.

For the rest — a full copy of your data (including the consents we recorded and the reports you made), your data in a portable format, objection or restriction — write to privacidade@loozygo.com. We reply within 1 month (GDPR) and within 15 days for confirmation and access requests under the LGPD.

If you believe we mishandled your data, you can complain to the CNPD (Portugal) or the ANPD (Brazil).

9. What happens when you delete your account

Deleted: the account, the email, the name, the reviews and comments, the reports you sent, the photos, the favourites and every open session.

Kept: the toilets you added stay on the map, but with no link to you — the author field is cleared and the record stops being personal data.

We do it this way for a simple reason: deleting a public toilet from the map doesn't protect your privacy and harms everyone who relies on it.

There is no way to recover anything after you confirm.

10. Security

All communication is encrypted in transit (TLS 1.2 or higher) and data is encrypted at rest. Passwords are stored with scrypt. Session keys live in the operating system's vault (Keychain on iOS, Keystore on Android). Access to data is controlled at the database level itself, with per-operation rules.

If you discover a vulnerability, write to security@loozygo.com.

In the event of a personal data breach, we notify the CNPD within 72 hours of becoming aware of it and the ANPD within 3 working days (ANPD Resolution CD/ANPD no. 15/2024), and we inform you, without delay, when the risk to you is high.

11. Minimum age

loozy is intended for people aged 13 or over. We don't collect the date of birth — asking for your age would mean collecting more data to protect data. If you know of an account belonging to someone younger, tell us and we delete it.

12. Third-party data on the map

Most toilets come from OpenStreetMap, under the ODbL licence. They are not personal data and don't come from you.

13. Changes to this policy

If we change something important, we let you know inside the app before the change takes effect. The date at the top always says which version is in force.

The version in force is always at https://api.loozygo.com/legal/privacidade. Other copies, such as the one on loozygo.com, reproduce it.