Privacy Policy

This Privacy Policy describes how Playgrounds Studios & Ventures LLC (“Looly,” “we,” “us,” and “our”) collects, uses, discloses and otherwise processes information about you. This Privacy Policy applies to information we collect when you access or use our website at getlooly.com (the “Site”), our mobile application, Looly (the “App”), and other online products and services that link to this Privacy Policy (collectively, the “Services”), or when you otherwise interact with us, such as through our customer support channels.

Disclosure Regarding the Supplemental Consumer Health Data Privacy Notice. For information on our processing of “consumer health data” that is subject to the Washington My Health My Data Act or Nevada Senate Bill 370, please see Annex A – Supplemental Consumer Health Data Privacy Notice.

This Privacy Policy is effective as of the “Last Updated” date above. We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the “Last Updated” date. If we make material changes, we will provide you with additional notice (such as by adding a statement to the Services). We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

LOOLY’S PRIVACY PRINCIPLES

At Looly, we process your personal information according to three core Privacy Principles:

YOUR HEALTH INFORMATION STAYS ON YOUR DEVICE. The entries, notes, dictation, and Apple Health data you record in the App are stored on your device. They are not transmitted to, collected by, or accessible to Looly. There is no account, and there is no server that holds your Health Information.

LOOLY DOES NOT SELL OR SHARE YOUR PERSONAL INFORMATION. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use or disclose Health Information to serve digital advertising.

LOOLY DOES NOT USE ANALYTICS OR ADVERTISING TECHNOLOGIES. The App and the Site do not contain analytics, advertising, or attribution software development kits, cookies, pixels, or similar tracking technologies.

1. SCOPE

This Privacy Policy applies to your personal information processed by Playgrounds Studios & Ventures LLC in the course of our business, including as collected on the Site, the App, and other online and offline offerings that link to this Privacy Policy.

2. COLLECTION OF INFORMATION

The categories of personal information we collect depend on how you interact with us, our Services, and the requirements of applicable law. Most of the information you record in the App is never collected by us at all, as described in Section 2.A below.

A. Information Stored on Your Device and Not Collected by Us

The following information is processed by the App on your device only. It is not transmitted to Looly, and Looly cannot access it.

Health Information: the entries you record in the App about your menstrual cycle, symptoms, mood, sleep, movement, hydration, nourishment, rituals, medications and supplements, sexual activity, and any notes you write or dictate (collectively, your “Health Information”).

Apple Health Data: if you choose to connect Apple Health, the App reads sleep data and, if you choose, past menstrual period data from Apple Health into your Health Information on your device. The App does not write to Apple Health. You may revoke this access at any time in the iOS Settings app.

Voice: if you use dictation, speech recognition is performed on your device by Apple’s on-device speech recognition. Audio and transcripts are not stored by the App and are not transmitted to Looly.

Device Authentication: if you enable the App’s lock, Face ID or your device passcode is evaluated by iOS on your device. Looly does not receive biometric information.

Encrypted Exports: if you create an encrypted export, the export file is encrypted on your device with a key derived from a password that only you hold. Looly does not receive the file or the password and cannot recover either.

B. Information You Provide to Us

Feedback Reports. If you choose to send feedback through the App, we collect the information you choose to include. Each of the following is controlled by a separate toggle in the App, and the App shows you exactly what will be sent before you confirm: (i) the note you write; (ii) a screenshot of the current page as displayed at that moment, which is not blurred or altered; (iii) the recent navigation steps in your session; and (iv) technical details, consisting of the App version, device model, and iOS version. Health Information and voice content are never attached to a Feedback report automatically. Nothing is transmitted until you confirm.

Waitlist Information. If you join a waitlist on the Site or from the App, we collect your email address and, where the form asks for one, the season you selected.

Your Communications with Us. We may collect personal information, such as your email address, when you request customer or technical support or otherwise communicate with us by email.

C. Information We Collect Automatically

Update Check. When you open the App, it may make a single request to learn whether a newer version is available. For beta builds distributed through TestFlight, the request goes to a server we operate; for App Store builds, the request goes to Apple’s App Store lookup service. The request does not include any device identifier, account, Health Information, usage information, or the version you are currently running. Our server does not log or retain the Internet protocol (IP) address associated with the request.

Rate Limiting. To prevent abuse of the Feedback feature, our server maintains a one-way hash of the date and the IP address from which a Feedback Report was sent. The hash cannot be reversed to identify you or your device, and it expires within forty-eight (48) hours.

Site Hosting. Our Site is hosted by Vercel. Like any web host, Vercel’s infrastructure may process your IP address and browser information in order to serve the page. We do not use analytics on the Site, and the Site is configured not to send a referrer.

D. Information We Collect from Other Sources

Apple Subscription Status. If you purchase a Subscription, Apple processes the transaction. The App receives from Apple only confirmation of whether your Subscription is active. We do not receive your name, payment card information, or billing address.

E. Cookies and Similar Technologies

We do not use cookies, pixel tags, web beacons, software development kits, or similar technologies in the App or on the Site.

3. USE OF INFORMATION

We use the categories of information we collect for the following business purposes:

Service Delivery: we use Update Check information to tell you when a newer version of the App is available, and Waitlist Information to notify you when the season you selected is available.

Communication: we use information in your communications with us to respond to your questions.

Research and Development: we use Feedback Reports to understand, reproduce, and repair defects and to improve the Services.

Protection and Compliance: we use Rate Limiting information to detect, investigate, and help prevent abuse of the Feedback feature, and we may use information to comply with our legal obligations.

4. ADVERTISING TECHNOLOGIES

We do not use advertising technologies. We do not use or disclose Health Information or any other personal information to serve digital advertising.

5. DISCLOSURE OF INFORMATION

We disclose the categories of information described above as follows:

Vendors. We disclose information to service providers that need this information to provide services to us: Apple, Inc. (App Store distribution, TestFlight, subscription processing, and the App Store lookup service); Cloudflare, Inc. (hosting of the server that receives Feedback Reports and Update Check requests, and temporary storage of screenshots); GitHub, Inc. (storage of Feedback Reports as private issues visible only to Looly); and Vercel, Inc. (hosting of the Site). We do not use any other service providers to process personal information.

Legal Authorities and Others Involved in Legal Proceedings. We may disclose information to legal authorities and others if we believe that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements. We will exhaust all legal remedies available to fight law enforcement requests regarding your personal information before responding to them. Because your Health Information is stored only on your device, we are not able to produce it in response to any request.

Corporate Transactions. We reserve the right to disclose information in connection with, or during negotiations of, certain corporate transactions, including the merger, sale of Looly assets, financing, or acquisition of all or a portion of our business by another company.

Consent. We may disclose information when we have your consent or you direct us to do so.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

6. DATA RETENTION AND DELETION

Your Health Information is stored on your device for as long as you keep it there. You may delete individual entries in the App, delete all of your data using the “Delete all data” control in the App’s Settings, or delete the App from your device.

We store the personal information we collect for as long as necessary to carry out the purposes for which we originally collected it. Screenshots included in Feedback Reports are deleted automatically thirty (30) days after submission. Feedback Reports are retained as private issues until the report has been resolved, or until you ask us to delete them. Rate Limiting hashes expire within forty-eight (48) hours. Waitlist Information is retained until we have notified you that your season is available, or until you ask us to delete it. Your communications with us are retained until your request has been resolved, or until you ask us to delete them.

7. YOUR PRIVACY CHOICES AND RIGHTS

Your Privacy Choices. Because your Health Information is stored only on your device, you control it directly, without any request to us. You may withdraw the App’s access to Apple Health at any time in the iOS Settings app. You may stop receiving waitlist emails by replying to any such email or by contacting us as set forth in the “Contact Us” section below.

What We Hold. We do not hold your Health Information. It is stored only on your device, and we never receive it. The only personal information we hold is the information you choose to send us (Feedback Reports and Waitlist Information) and the limited technical information described in Section 2 (the Update Check and Rate Limiting).

Your Privacy Rights. Wherever you live, you have the right to:

Access Personal Information about you, including: (i) confirming whether we are processing your personal information; (ii) obtaining access to or a copy of your personal information; and (iii) receiving an electronic copy of personal information that you have provided to us, or asking us to send that information to another company (the “right of data portability”);

Request Correction of your personal information where it is inaccurate or incomplete;

Request Deletion of your personal information;

Request Restriction of or Object to our processing of your personal information; and

Withdraw your Consent to our processing of your personal information. Please note that your withdrawal will only take effect for future processing and will not affect the lawfulness of processing before the withdrawal.

If you would like to exercise any of these rights, please contact us as set forth in the “Contact Us” section below. We will process such requests in accordance with applicable laws, and in any event within forty-five (45) days.

Only you, or someone legally authorized to act on your behalf in certain jurisdictions, may make a request to exercise the rights listed above regarding your personal information. If your personal information is subject to a law that allows an authorized agent to act on your behalf in exercising your privacy rights and you wish to designate an authorized agent, please provide written authorization signed by you and your designated agent using the information found in the “Contact Us” section below.

To protect your privacy, we will take steps to verify your identity before fulfilling requests submitted under applicable privacy laws. Because we do not maintain accounts, verification will ordinarily consist of confirming that you control the email address from which a Feedback Report, waitlist sign-up, or communication was sent.

Appeals. If we decline to take action on your request, you may appeal our decision by replying to our response or by contacting us as set forth in the “Contact Us” section below. We will respond to your appeal within forty-five (45) days.

8. INTERNATIONAL DATA TRANSFERS

All personal information processed by us may be transferred, processed, and stored in the United States, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.

9. INDIVIDUALS IN EUROPE

This section supplements this Privacy Policy if you are in the European Economic Area (“EEA”), the United Kingdom, or Switzerland.

Controller. Playgrounds Studios & Ventures LLC, a Delaware company in the United States, is the controller of the personal information described in this Privacy Policy. We have not appointed a Data Protection Officer.

Legal Basis for Processing. When we process your personal information as described above, we do so in reliance on the following lawful bases: when we have your consent to do so (Feedback Reports and Waitlist Information); when we have a legitimate interest in processing your personal information to operate our business or protect our interests (Update Check and Rate Limiting); and to comply with our legal obligations. When consent is the legal basis for our processing your personal information, you may withdraw such consent at any time.

Data Subject Requests. You have the right to request access to or deletion or correction of your personal information. In addition, you have the right to object to certain processing or request we restrict certain processing. To exercise any of these rights, please contact us. If you have a concern about our processing of personal information that we are not able to resolve, you have the right to lodge a complaint with the Data Protection Authority where you reside. For individuals in the EEA: https://edpb.europa.eu/about-edpb/board/members_en. For individuals in the UK: https://ico.org.uk/global/contact-us/. For individuals in Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html.

Data Transfers. We process personal information in the United States. Where required, we rely on appropriate safeguards such as the standard contractual clauses (“SCCs”) to transfer personal information from the EEA, the United Kingdom, or Switzerland to the United States, and you may obtain a copy of the SCCs by contacting us.

10. CHILDREN’S PERSONAL INFORMATION

The Services are intended for individuals 18 years of age or older. The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 years old. If you learn that anyone under 13 has provided personal information to us, you may contact us as set forth in the “Contact Us” section below and we will promptly take steps to delete such information.

11. OTHER PROVISIONS

Third-Party Websites/Applications. The Services may contain links to other websites, including health information published by third parties. These third-party services are not controlled by us. We encourage our users to read the privacy policies of each website and application with which they interact. We do not endorse, screen or approve, and are not responsible for, the privacy practices or content of such other websites or applications.

Changes to Our Privacy Policy. We may revise this Privacy Policy from time to time at our sole discretion. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law, including by posting a statement on the Site or in the App. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use our Services after the new Privacy Policy takes effect.

12. CONTACT US

If you have any questions about our privacy practices or this Privacy Policy, or to exercise your rights as detailed in this Privacy Policy, please contact us at:

ANNEX A – SUPPLEMENTAL CONSUMER HEALTH DATA PRIVACY NOTICE

This Supplemental Consumer Health Data Privacy Notice (“Consumer Health Data Privacy Notice”) supplements the Looly Privacy Policy.

This Consumer Health Data Privacy Notice only applies to personal information that we process that is “consumer health data” subject to the Washington My Health My Data Act (“MHMDA”) or Nevada Senate Bill 370 (“NV SB 370”) (as applicable). Terms used in this Consumer Health Data Privacy Notice that are defined in MHMDA or NV SB 370 will have the meaning set forth in those laws to the extent such laws are applicable.

I. CONSUMER HEALTH DATA WE COLLECT

Under the MHMDA, “consumer health data” is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.” Under NV SB 370, “consumer health data” is defined as “personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer.”

The Health Information you record in the App is stored on your device and is not collected by Looly. The only consumer health data we collect is consumer health data that you choose to include in the text of a Feedback Report or in a communication with us, such as a description of a symptom you were logging when a defect occurred.

II. SOURCES OF CONSUMER HEALTH DATA

We collect consumer health data only directly from you, when you include it in a Feedback Report or a communication with us.

III. WHY WE COLLECT AND USE CONSUMER HEALTH DATA

We collect and use consumer health data as reasonably necessary to act on the Feedback Report or communication in which you provided it, including to reproduce and repair the defect you described. We do not use consumer health data for any other purpose.

IV. SHARING OF CONSUMER HEALTH DATA

We share consumer health data only with the processors that carry the Feedback Report or communication on our behalf: Cloudflare, Inc. and GitHub, Inc., as described in Section 5 of the Privacy Policy. We do not sell consumer health data, and we do not share consumer health data with any other third party.

V. HOW TO EXERCISE YOUR RIGHTS

Under MHMDA, consumers have the right to: (i) confirm whether Looly is collecting, sharing, or selling consumer health data and to access such data; (ii) withdraw consent from Looly’s collection and sharing of consumer health data; and (iii) request that Looly delete consumer health data.

Under NV SB 370, consumers have the right to: (i) confirm whether Looly is collecting, sharing or selling consumer health data; (ii) have Looly provide the consumer with a list of all third parties with whom Looly has shared consumer health data relating to the consumer or to whom Looly has sold such consumer health data; (iii) request that Looly cease collecting, sharing, or selling consumer health data relating to the consumer; and (iv) request that Looly delete consumer health data.

The rights afforded to consumers under MHMDA and NV SB 370 are subject to certain exceptions. You can request to exercise such rights by contacting us as set forth in the “Contact Us” section of the Privacy Policy.

If your request to exercise a right under MHMDA or NV SB 370 is denied, you may appeal that decision by contacting us at hello@getlooly.com. If your appeal is unsuccessful and your consumer health data is subject to MHMDA, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

VI. DISCLOSURE REGARDING THIRD PARTY COLLECTION OF CONSUMER HEALTH DATA UNDER NV SB 370

We do not allow third parties to collect consumer health data over time and across different internet websites or online services when the consumer uses any Internet website or online service of Looly.

VII. UPDATES TO THIS CONSUMER HEALTH DATA PRIVACY NOTICE

We may update this Consumer Health Data Privacy Notice from time to time in our sole discretion. If we do, we’ll let you know by posting the updated Consumer Health Data Privacy Notice on our website.