Privacy

DRAFT, pending lawyer review. This is not legal advice and it is not in effect. Do not rely on it as Loelia’s privacy policy until a lawyer has reviewed it and it is published without this banner. Draft date: October 12, 2026. Effective date: TODO.

Who we are

Loelia is a wall calendar for a household. The company is Loelia Studio LLC, being formed in Texas. The Texas filing is still pending, so “LLC” is not in the site footer yet.

TODO: street address, and the public company name, once the LLC is filed.

Where Loelia is offered

Loelia is offered to households in the United States.

TODO: whether the website or the Play listing will block use from outside the United States. This draft treats the product as US-only. It does not describe a technical block, because none is built.

The household account

One login belongs to one household. The account holder is an adult. Profiles, including profiles marked Kids, are part of that household. Children do not get their own Loelia logins.

TODO: the minimum age of the account holder, and a lawyer’s read on children’s privacy. Kid profiles make this stricter. The Play target audience is parents, not children.

Information we keep

We keep what the household puts into Loelia, and what connected calendars send us:

• Account. Household name, email, and a scrypt hash of the password. We do not keep the password itself.
• Profiles. Names, colors, icons, whether a profile is marked Kids, and adult PINs. A PIN only locks the tablet. It is not the household password.
• Calendar. Events you add (titles, times, notes, and who they are for), places and addresses, and coordinates returned by address search.
• Home. A home address, if you set one, for weather, travel time, and nearby place suggestions.
• Feeds. Calendar links you paste, and the events those feeds contain. Sports teams you turn on.
• iCloud. If you connect iCloud, the Apple ID email you enter and an app-specific password, encrypted at rest with AES-256-GCM. We never ask for your Apple ID password. We read the calendars you pick. If you turn a calendar to two-way, changes in Loelia can be written back to that iCloud calendar.
• Google Calendar. Signing in with a Google account is not offered to households yet. When it is, we expect to store an encrypted token and the events from the calendars you choose. We would not see your Google password. TODO: confirm this paragraph when Google sync ships.
• Tablets. A device id, model, app build, and when the tablet was first and last seen, so the household can sync.
• Support mail. What you send to support@loelia.app.

We do not sell household data. We do not use it for advertising.

TODO: a full list of database tables for the Play Data safety form, checked against the live schema the week this draft is finalized.

Speech

Speaking to Loelia uses the tablet’s speech recognition. On a typical Android tablet that is Google’s speech service. Loelia receives the words, not a recording we store.

TODO: confirm Loelia never stores the audio, and add Google’s speech privacy terms the way the Maps terms are named below.

AI (xAI)

Some features send text or a photo to xAI (Grok), including Quick Shot flyer reading and, when that feature is on, list commands. Loelia Assist is the optional add-on that raises the AI allowance. It is also xAI. We do not use household data to train a Loelia model.

A Quick Shot photo is sent to xAI to read the flyer. Loelia does not keep the picture. You review the draft before anything is saved. AI results can be wrong.

A cost note in our own docs says xAI keeps API inputs about 30 days for abuse checks, and that a zero-retention setting exists and is not turned on. That note is not a promise.

TODO: confirm xAI’s current retention, and whether zero-retention will be on before launch. Add the xAI privacy policy URL after that check.

Maps, places, and weather

Text you type for a place is sent from our server to Google (Places and Geocoding) to suggest addresses. The tablet uses the Google Maps SDK to draw a map. Travel time uses Google Routes. We store the address and coordinates on the event. We do not use the tablet’s GPS, and we do not ask for a location permission.

Addresses such as a child’s school stay in the household. We do not use them for analytics.

The home area is sent to WeatherAPI.com for the weather strip. The weather key stays on our server. The tablet does not see it.

TODO: confirm we do not store the forecast beyond what it takes to show it. Add WeatherAPI.com’s privacy policy URL.

Google Maps Platform terms: https://cloud.google.com/maps-platform/terms. Google’s privacy policy: https://policies.google.com/privacy.

Tablet details and crashes

An optional “Share my tablet details” switch is planned. If it ships, it would collect the tablet model, Android version, and screen size only, and only if you turn it on. It is not in the app today.

Crash reports today are Play Console vitals, not a separate crash tool we added. TODO: the Data safety line for Play vitals.

Payments

Subscriptions are sold on the Loelia website through Stripe, not inside the app and not by Google Play. Stripe is not set up yet. It waits on the LLC, an EIN, and a bank account. When it is on, card numbers go to Stripe, not to Loelia. Stripe’s privacy policy: https://stripe.com/privacy.

TODO: name the exact Stripe fields we store (customer id, subscription id, plan, period end) once billing is built. We do not store card numbers.

Where it is stored

The household database is Postgres on Neon, in AWS US East (Ohio). The API runs on Render in Ohio. This help site and the marketing site are Cloudflare Workers. Cloudflare also provides DNS. Nightly backups go to a private Cloudflare R2 bucket and are deleted after 28 days. Neon can restore the database to a moment in the last 7 days.

Passwords are stored as scrypt hashes. iCloud app-specific passwords and Google refresh tokens are encrypted at rest with AES-256-GCM. Traffic uses HTTPS.

TODO: a fuller security review. Tighter auth and monitoring are launch work and are not all done.

Deleting a household

How to ask is on Delete a household. The in-app and website buttons are not built yet.

When you delete your Loelia account, we delete your household’s information from our live systems right away. Copies may remain in our backups for up to 30 days, until those backups expire and are permanently erased. We use backups only to recover from a system failure, and if we ever restore one, we delete your household again. We keep a record that a deleted household existed (an ID and the deletion date, nothing personal) so its tablets can be told it was deleted.

TODO: a proposed later rule would email a warning and then delete data after 12 months with no plan. That rule is not decided and is not part of this draft.

Service providers

These companies process household data for us. They are not advertising partners, and we do not sell the data to them:

• Neon, for the database
• Render, for the API
• Cloudflare, for DNS, the websites, and backup files
• xAI, for AI features
• Google, for speech, Maps, Places, Geocoding, and Routes
• WeatherAPI.com, for weather
• Stripe, for card payments on the website, once billing is on
• Apple, only if you connect iCloud. Apple receives the calendar changes you choose to write back

TODO: privacy-policy URLs for Neon, Render, Cloudflare, WeatherAPI.com, and Apple, after a lawyer picks which ones belong in the published policy.

This website

The marketing site has used Cloudflare Web Analytics since October 3, 2026. This help site does not add its own analytics.

TODO: update this paragraph if analytics is later turned on for the help site.

Changes

We will post updates on this page. TODO: how households are told. Product email is not set up.

Contact

Email support@loelia.app. See also the Terms.