privacy policy
Version 2.1 — November 2, 2026 (replaces version 2.0 of July 19, 2026; main changes: purchases go through Apple’s App Store (and later Google Play) — Stripe is no longer used; the AI help assistant has been removed; Resend, Vercel and Google Workspace added as providers, and the roles of Apple and Google explained; the optional public profile link; downloading your data in the app; how long we keep reports and moderation records, purchase records and the record of a deleted account; the website and its forms)
1. Who we are
Loro is a roommate-matching app for the Netherlands (initially Amsterdam and Den Haag) that helps people find compatible roommates based on personality, habits, and lifestyle.
The data controller responsible for your personal data is:
Loro — eenmanszaak (sole proprietorship) of Manuel Junguito del Hoyo, Van Heutszstraat 21, 2593 PC ’s-Gravenhage, the Netherlands, KVK 98700502
Privacy questions and requests: privacy@loro-app.com General support: support@loro-app.com Legal / authorities (single point of contact under the EU Digital Services Act): legal@loro-app.com
This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR / AVG).
2. Who can use Loro
Loro is for adults only. You must be at least 18 years old to create an account. This is enforced technically: our database rejects any profile with an age below 18 (or above 80). We do not knowingly process data of anyone under 18; if you believe a minor is using Loro, contact privacy@loro-app.com or report the profile in-app.
3. The data we collect
3.1 Account and sign-in data
- Phone number (international E.164 format) — your primary sign-in, verified via an SMS one-time code sent through Twilio Verify. One-time codes expire after 10 minutes. Your phone number is stored in a separate, restricted table that only you (and no other user) can ever access.
- Email address — collected during onboarding (not separately verified) and stored privately in our authentication system, never on your public profile; or received from Google or Apple if you sign in with those providers. If you link Sign in with Apple or Google, we also store the identifier that provider gives us for your account, so it can sign you in again.
- Marketing preference — whether you opted in to occasional product emails (off by default; see Section 4).
- Authentication tokens — session tokens (JWTs) managed by our backend provider, Supabase. Sessions expire after 1 hour and refresh automatically.
3.2 Profile information
Collected when you build your profile:
- Display name (2–50 characters), age (derived from your date of birth — the exact birthday itself is not stored), country of origin, gender (man / woman / non-binary), occupation category (a fixed choice such as student or working full-time), bio (max 300 characters), and your “three words”
- Personal photos; optionally a short profile video
- Lifestyle answers: sleep schedule, social energy, up to 6 hobbies, up to 4 dealbreakers, up to 3 prompt answers (max 150 characters each)
- Optionally, a profile “anthem”: a song you pick via Deezer search (track name, artist, album cover, 30-second preview link)
- Your role (seeker, co-living offeror, or renting-out offeror), whether your profile is discoverable, and verification flags
Gender is shown as part of matching/filtering (other users can filter by it); it is collected as a required field. We do not ask for, and you should not add, special-category data such as health, religion, or sexual orientation anywhere in your profile or messages.
3.3 Location
- Country, city, and neighbourhood
- Precise coordinates (latitude/longitude) of the location pin you place on a map during onboarding, stored in an owner-only restricted table and used for the location-overlap part of the match score. Your exact pin is never shown to other users — they see your city and neighbourhood.
3.4 Home details (offerors)
If you offer a room: neighbourhood, city, monthly rent, availability dates, room details, number of current tenants, a description, home photos, house rules, and who you are looking for. Renting-out offerors can have multiple places. Rooms are never public listings — in the app, home details are surfaced to seekers through invites and conversations.
3.5 Messages, voice notes, and group chats
- Text messages (max 2,000 characters), photo messages, files (PDF, images, and Office documents without macros), voice notes (short audio recordings you choose to send), emoji reactions, shared profiles, edit timestamps, deletion flags, and read receipts.
- Group (“flock”) data: group name and photo, membership, member proposals and votes, the shared chat theme, and your personal mute setting.
- Messages, files, and voice notes are visible only to the participants of a conversation and are kept until the conversation or your account is deleted.
3.6 Matching and activity data
- Every swipe (pass or “vibe”), with who swiped on whom and when, and any comment attached to a vibe
- Your matches, flocks, invites sent/received (including their status), and your invitation-message template if you save one
- Pairwise compatibility scores and their breakdown, cached for a maximum of 24 hours
- How you use the app — first-party usage data we record ourselves: when the app is opened and for how long, which screens you visit, which onboarding step you are on, whether you pause or delete your account and the reason you give, and counts of actions such as opening a chat, sharing your link or starting a purchase. These records carry your account identifier, the app and OS version and a random identifier for the installation; they never contain the content of what you write, other people’s identifiers, your precise location, your IP address, or any special-category data. They are used only to understand how Loro is used and to improve it — never to advertise to you or to treat you differently
3.7 Arrangements (“make it home”)
If you and another user record that you have decided to live together: who is involved, the home concerned, the proposed move-in date, and each participant’s confirmation state. This drives in-app status (like the “living with” card and hiding a settled seeker from discovery) and is deleted with your account.
3.8 Purchases
- Your credit balance and how many credits you have bought (offerors), and when your boost ends (seekers). Nobody but you can see when your boost ends.
- A record of each purchase and refund: the product, the store (Apple or Google), the store’s transaction identifier, the amount and currency, the date, and the status. We receive these details from Apple (or Google) when our server checks a purchase, and when the store tells us a purchase has been refunded.
- We never receive or store card or payment details. You pay Apple (or Google) with the payment method in your Apple ID or Google account; they do not share it with us. To connect a purchase to the right Loro account, the app attaches your Loro account identifier to the purchase — Apple does not give us your name or Apple ID for it.
3.9 Push notifications
- A push subscription identifier from OneSignal, linked to your account so we can deliver notifications (new message, new match, new invite) to your device. Signing out detaches your device.
- Your notification preferences (the master switch and per-category choices) are stored on your device.
3.10 Crash and diagnostic data
- When the app crashes or hits an error, a crash report is sent to Sentry: the stack trace, the app and OS version, the device model and sampled performance traces. We do not attach your name, email, phone number or account identifier to these reports, and they do not contain what you write. We use no third-party analytics SDKs — no Firebase Analytics, no Mixpanel, no Amplitude. The usage data described in section 3.6 is recorded by the app itself into our own database and never leaves it.
3.11 Safety records
- Reports: if you report another user, we store your report (reason category and optional details, max 1,000 characters), who filed it and who it is about. Each new report is also sent by email to our moderation team, with the reason, the details and the display names of the two people involved. Reports are confidential — visible only to you and to our moderation team, never to the person you reported.
- Blocks: who you blocked and who blocked you, used solely to enforce mutual invisibility.
- Moderation records: actions we take on content or accounts (warnings, suspensions, bans, restorations), the reasons, and the one note a suspended or banned person can send us about a decision — kept to handle appeals, prevent abuse, and meet our legal obligations.
3.12 Your public profile link (optional, seekers)
You can switch on a public link to your profile (loro-app.com/p/your-handle) to share it with people outside the app. It is off until you switch it on. While it is on, anyone with the link can see your display name, age, photos, bio, city and neighbourhood, and — only if you choose to show it — your budget. The page asks search engines not to index it. You can switch the link off at any time in me → privacy & legal → public profile link; the page stops working at once.
3.13 Our website (loro-app.com)
- Forms. If you leave your email to hear from us, we store your email address, the city you picked (optional) and which page you signed up on. If you write to us through the contact form, we store your name (optional), email address, topic and message. If you rate a help article, we store only which article and whether it helped.
- Server logs. Like any website, our hosting provider (Vercel) processes your IP address, browser details and the pages you request in order to deliver the site and keep it secure.
- The website uses no advertising or tracking cookies (see the Cookie Policy).
4. Why we process your data, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account & sign-in data | Create and secure your account; sign you in | Contract (6(1)(b)); account security: legitimate interest (6(1)(f)) |
| Phone number & verification | Verify you are a real person; reduce fake profiles | Contract; platform safety: legitimate interest |
| Profile information (incl. gender, occupation category) | Build your profile, compute compatibility, power the discover filters, show you to potential roommates | Contract; optional extras (video, anthem, occupation detail): consent — you choose to add them and can remove them anytime |
| Location (incl. precise pin) | Compute location overlap in your match score; show your city/neighbourhood to others | Contract |
| Home details (offerors) | Give invited seekers context about the room | Contract |
| Messages, voice notes & group chats | Deliver chat between matched users and flocks | Contract |
| Swipes, matches, invites, scores | Run the matching mechanic that is the core of the service | Contract |
| Arrangements | Record and reflect a decision to live together in the app | Contract |
| Purchase records | Deliver what you bought (credits, boost), handle refunds, prevent fraud, keep financial records | Contract; bookkeeping: legal obligation (6(1)(c)) |
| Push identifier | Deliver notifications you have allowed | Consent (your operating-system permission, revocable anytime) |
| Marketing emails | Occasional product updates | Consent (opt-in at onboarding or in notification settings; withdraw anytime) |
| Crash & diagnostics | Fix crashes and keep the app stable | Legitimate interest |
| Usage data (section 3.6) | Understand how the app is used, find where people get stuck, and improve the product | Legitimate interest (6(1)(f)); first-party, minimal-impact analytics under article 11.7a(3) of the Dutch Telecommunications Act. You can object at any time by writing to us and we will stop recording and anonymise what we hold |
| Reports, blocks & moderation records (incl. the alert email to our moderation team) | Keep the community safe; moderate misuse; handle appeals | Legitimate interest; legal obligation where applicable (EU Digital Services Act) |
| Public profile link | Show your profile to people you share the link with | Consent — you switch it on, and can switch it off anytime |
| Sign in with Apple / Google | Let you sign in with an account you already have | Contract |
| Website forms | Send you the app link or news you asked for; answer your message; improve help articles | Consent (email list — withdraw anytime by writing to privacy@loro-app.com); contact messages and help ratings: legitimate interest |
| Website server logs | Deliver the website and keep it secure | Legitimate interest |
We do not use your data for automated decisions with legal or similarly significant effects. Compatibility scores and discover ordering only inform and order your matching experience; every decision about matching, inviting, or living together is made by people.
5. What other users can and cannot see
Visible to other signed-in users (while your profile is discoverable):
- Display name, age, occupation (category and optional detail), country of origin, bio, three words
- Your photos and (if added) profile video
- Hobbies, dealbreakers, prompt answers, and your anthem
- Your city and neighbourhood (your exact location pin is never shown)
- Your compatibility score with them
- Gender is used by the discover filters (users can filter by it)
Never visible to other users:
- Your email address — stored only in our authentication system, never on your profile
- Your phone number — stored in a restricted table only you can access
- Your exact location pin and your date of birth
- Your private messages and voice notes (visible only to conversation participants)
- Your swipe activity, payment information, notification settings, and any reports you file
Your controls: the “actively looking” toggle (and the equivalent “pause my account” switch in account settings) removes you from discovery at any time — existing chat partners can still see your profile so conversations keep working. Recording an arrangement also hides a settled seeker from discovery. You can block any user — blocking is mutual invisibility, and the blocked person is never notified.
Your public profile link (if you switch it on): anyone with the link — including people who are not on Loro — can see your display name, age, photos, bio, city and neighbourhood, and your budget only if you chose to show it (see section 3.12). Your messages, phone number, email, exact location and everything in “never visible” above stay private.
A note on media files: what you send inside a conversation — photos, documents, and voice notes — is stored privately. Only the people in that conversation can obtain a link to it, and the links the app uses expire after an hour. Your profile photos and profile video work differently: they are served from long, unguessable web addresses so that your shareable profile link works outside the app, which means anyone who obtains one of those direct addresses can view that file. Avoid putting sensitive information in your profile media.
6. Who we share data with (processors and recipients)
We never sell your personal data. We share data only with the service providers below, only as needed to run Loro:
| Provider | What they do for us | What they receive |
|---|---|---|
| Supabase | Core backend: authentication, database, file storage, real-time chat, server functions; it also stores what you send through the website’s forms | The account, profile, location, message and voice-note, match, invite, arrangement, purchase-record, and safety data described above, and website form entries |
| OneSignal | Push notification delivery | Your device push token and account ID; notification content, which includes sender display names and a preview of message text |
| Twilio (Twilio Verify) | SMS phone verification | Your phone number and, on verification, the one-time code you entered |
| Sentry | Crash reporting and performance monitoring | Crash stack traces, app/OS version, device model, sampled performance traces — no name, email, phone number or account identifier |
| Resend | Sends the email that alerts our moderation team to a new report | The report’s reason and details and the display names of the people involved |
| Google (Google Workspace) | Hosts our email (support@, privacy@, safety@, legal@, hello@ and the moderation inbox) | The emails you send us and the report alerts |
| Vercel | Hosts our website and the public profile pages (loro-app.com/p/…) | Visitors’ IP addresses and browser details; for a public profile page, the profile details shown on it |
| Deezer | Song search for your optional profile anthem (called directly from your device) | Only the song search text you type and your IP address — no account data |
| Mapbox | Map tiles and address search for the onboarding location picker (called directly from your device) | Standard tile/geocoding requests: the map area or address text, your IP address, and the app identifier |
Apple and Google as independent controllers. Some of what you do involves Apple or Google directly, under their own privacy policies rather than on our behalf:
- Sign in with Apple / Google (optional): Apple or Google confirms who you are to us; they learn that you use Loro, and we receive your email address (or Apple’s private relay address) and an account identifier.
- In-app purchases: Apple’s App Store (and, later, Google Play) takes your payment, and Apple or Google is the seller of the transaction. They handle your payment details and receipt; we receive only the purchase record described in section 3.8.
- App distribution and push delivery: Apple’s and Google’s systems deliver the app and the push notifications sent through OneSignal.
In-app voice calls are not offered, and no real-time call provider processes your data. If we ever introduce calls, this policy will be updated first.
We may also disclose data where the law requires it — for example to competent authorities under a valid order — and we will assess every such request critically.
7. International data transfers
Some of our providers are based in the United States: Twilio, OneSignal, Sentry, Resend, Vercel, Mapbox, and Google; Apple and Google also process data in the United States in their role as independent controllers. Where personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where the provider is certified, the EU–U.S. Data Privacy Framework, together with the providers’ technical and organisational safeguards.
Our core backend (Supabase) is hosted in AWS eu-west-1 (Ireland). Deezer is based in the EU (France).
8. How long we keep your data
| Data | Retention |
|---|---|
| Account, profile, photos/video, location, home details, messages and voice notes, swipes, matches, invites, flocks, arrangements, blocks, credit balance and boost | Kept while your account exists; removed from the app the moment you delete your account, with one copy of your profile held for 30 days and then erased (see below) |
| Compatibility score cache | Maximum 24 hours |
| Usage data (section 3.6) | Individual records for 13 months, then only aggregate statistics that identify nobody. When you delete your account, your usage records are anonymised at once (the account and installation identifiers are removed) |
| Purchase records | 7 years from the purchase, as Dutch tax law requires for bookkeeping. When you delete your account, they are unlinked from your profile and keep only the store transaction identifier, product, amount, currency, date and status |
| Reports and moderation records | Up to 24 months after the case is closed, to handle appeals, repeat abuse and legal claims — also when an account involved is deleted. The report alert emails in our moderation inbox are kept for the same period |
| Record of a deleted account (see below) | 3 years after the deletion |
| Website email list | Until you ask us to remove you, and at most 2 years after our last email to you |
| Website contact messages | Up to 2 years after we answered, unless the conversation is still ongoing |
| Session tokens | Expire after 1 hour (auto-refreshed while signed in; invalidated on sign-out) |
| SMS one-time codes | Expire after 10 minutes |
Account deletion is immediate in the app, with a 30-day grace copy. When you delete your account (me → account → delete my account), your account record is deleted and every linked database record — profile, phone number, photos, videos and voice notes, prompt answers, swipes, matches, invites, conversations and the messages you sent, flocks, arrangements, blocks, credits, and any running boost — is deleted with it in the same operation; nobody can see you in the app from that moment. Unused credits and the remaining days of a boost are lost. Reports you filed or that were filed about you, and moderation decisions, are kept for the period in the table above, without the link to your deleted account. One copy of your profile data (your profile, prompt answers, home details if you offered a room, the email and phone number on the account, and a count of your activity) is kept in a locked, non-public table for 30 days, so that we can restore an account deleted by mistake if you write to us within that window, and handle a dispute or a legal claim about the account. After 30 days that copy is erased automatically. What remains after that is a minimal record that does not identify you on its own: the account identifier, the public-link handle (so nobody inherits a link you shared), one-way hashed versions of the email and phone number (used only to detect someone banned coming back), the date and time of the deletion and the activity counts. That record is kept for 3 years after the deletion and then erased.
Uploaded media files: your profile photos, profile video, and home photos are deleted from our storage systems at the same time as your account (they are not part of the 30-day copy). Photos, files and voice notes you send in chats are deleted from our storage when your account is deleted or when the conversation is deleted.
Backups: deleted data may persist in encrypted database backups for up to 7 days before those backups expire; backups are never used to restore deleted accounts.
9. Your rights (GDPR / AVG)
You have the following rights, free of charge. We respond within one month.
| Right | How to exercise it |
|---|---|
| Access — a copy of the personal data we hold about you | In-app: me → privacy & legal → download my data, or email privacy@loro-app.com from your account email |
| Rectification — correct inaccurate data | Edit your profile directly in the app, or email privacy@loro-app.com |
| Erasure — delete your data | In-app: me → account → delete my account (immediate in the app; a 30-day grace copy, see Section 8), or email privacy@loro-app.com |
| Data portability — your data in a machine-readable format | In-app: me → privacy & legal → download my data gives you a JSON file of your account, profile and activity at once; or email privacy@loro-app.com |
| Objection / restriction — object to processing based on legitimate interest, or ask us to restrict processing | Email privacy@loro-app.com |
| Withdraw consent — for anything based on consent | Remove optional content (video, anthem) in the app; switch off your public profile link in me → privacy & legal; switch off marketing emails in notification settings; disable push in your device settings; ask us at privacy@loro-app.com to take you off the website email list; withdrawal does not affect prior processing |
Objecting to usage data. You can object at any time to our recording of how you use the app (section 3.6) by writing to privacy@loro-app.com. We will then stop recording usage data for your account and anonymise what we already hold.
Complaints: you have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to address your concern first via privacy@loro-app.com, but you are not required to contact us before complaining.
10. Notifications and email
We ask for notification permission in context — never the moment you open the app. In the app (me → notifications) you control the master push switch and per-category preferences; your device’s system settings offer the same master control. Marketing email is opt-in and can be switched off in the same screen at any time; service emails strictly necessary for your account (such as security notices) may still be sent.
11. No advertising, no tracking, no sale of data
- We never sell your personal data.
- The app contains no advertising networks and shows no third-party ads.
- The app contains no third-party analytics or tracking SDKs. We measure how the app is used ourselves, in our own database (section 3.6) — never for advertising, and we do not profile you for marketing.
- We do not use your data for third-party advertising, share it with data brokers, or use your content to train AI models.
Cookie-type storage used by the app and the loro-app.com website is described in our Cookie Policy (/legal/cookies).
12. How we protect your data
- Every database table is protected by row-level security with a default-deny policy — data is only readable by those explicitly allowed.
- Your phone number and exact location pin live in a restricted table accessible only by you; your email never leaves the authentication system.
- Card and payment details never reach us — you pay Apple (or Google) directly.
- Server-side verification for all payments and permissions — we never trust the app alone to authorize anything.
No system is perfectly secure. If a data breach affects your rights, we will notify you and the Autoriteit Persoonsgegevens as required by law.
13. Changes to this policy
We may update this policy as Loro evolves. The version and date at the top always reflect the current revision, and a summary of the main changes is included with each version. For material changes, we will notify you in the app or by email before the changes take effect.
14. Contact
Controller: Loro — eenmanszaak (sole proprietorship) of Manuel Junguito del Hoyo, Van Heutszstraat 21, 2593 PC ’s-Gravenhage, the Netherlands, KVK 98700502 Privacy requests: privacy@loro-app.com General support: support@loro-app.com Legal / authorities (DSA point of contact): legal@loro-app.com
Loro — find your flock.