Privacy, in plain English

Last updated: May 2026 · Lookn is built by a tiny team. We treat your data the way we’d want ours treated.

Who we are

Lookn is operated by the maker of the Lookn app, a small team based in Ontario, Canada. The "we," "us," and "Lookn" in this policy refer to that team. The "Services" are the Lookn mobile apps on iOS and Android, the website at looknapp.com, and everything connected to them.

What we collect

• Account info. Your email and a password hash (we never see the password itself). If you sign in with Apple or Google, only the email they share with us. If you sign in with Apple’s private-relay email, we honour the relay.
• Your content. Moods, journal entries, streaks, habits, dome settings, adventure progress, koko name, and similar app state. Stored linked to your account so it syncs across your devices.
• Device & technical info. Device model, OS version, app version, language, time zone, crash logs, and a random install identifier. Your IP address is briefly used by our infrastructure to deliver responses; we do not keep IP-keyed logs longer than 30 days. We do not collect IDFA (Apple) or AAID (Google) advertising identifiers — Lookn has no ads.
• Push tokens. If you opt in to notifications, Apple or Google gives us an opaque token that lets us send a push to your device. The token is tied to your account and is deleted when you turn notifications off or delete the app.
• Purchase records. If you buy a subscription or in-app item, Apple or Google sends us a receipt confirming the purchase and renewal status. We do not see your card number, billing address, or CVV.
• Anonymous usage events. Counts like "opened journal," "completed task," "started adventure." Tied to a random ID, not to your name or email. Used to figure out which features people actually use.
• Anonymous web analytics. On looknapp.com we use Microsoft Clarity for aggregated, session-level diagnostics (clicks, scrolls, where things break). Clarity runs only on the marketing site, only after you tap "Accept" on the cookie banner, and never inside the iOS or Android app.
• Support messages. If you email us, we keep the email and any screenshots you choose to attach so we can help and follow up.
• Friend-mode connections. If you connect with a friend, we store the link between your accounts and the items you explicitly choose to share. We don’t hash or upload your phone’s address book.

What we don’t collect

• The text of your journal entries — for analytics, AI training, marketing, or anything else. Your words stay yours.
• Your contacts, photos, calendar, precise location, microphone, or HealthKit data — unless a specific feature explicitly asks and you say yes.
• Advertising identifiers (IDFA / AAID). There are no ads in Lookn.
• Biometric data, face scans, or voice recordings.

Why we’re allowed to use your data (GDPR / UK GDPR legal bases)

If you’re in the UK, EU, or EEA, the law expects us to name a legal basis for each kind of processing. Ours are:

• Contract. We process your account, content, and purchases to deliver the app you signed up for.
• Legitimate interests. We process anonymous usage events and crash logs to keep the app working and improve it — balanced against your privacy and easy to opt out of.
• Consent. Push notifications, optional analytics, and optional friend-mode sharing run only after you opt in. You can withdraw consent at any time.
• Legal obligation. Tax records, fraud investigations, lawful government requests.

How long we keep things

• Account & content: for as long as your account exists. Deleted within 30 days of account deletion.
• Backups: rolling 30-day window. Deleted content fully disappears from backups within 30 days of deletion.
• Server logs (IP, request lines): 30 days.
• Crash reports: 90 days.
• Anonymous usage events: up to 24 months in aggregate; raw events expire after 90 days.
• Purchase receipts: 7 years (tax law).
• Support emails: 2 years after the last reply, then deleted.

Who can see your data

Lookn does not sell your personal information and we do not share it with advertisers, data brokers, or AI model providers. We do use a small set of vetted service providers to run the app on our behalf:

• Amazon Web Services (AWS) — hosting, storage, authentication, push fan-out. US regions.
• Apple App Store & Apple Push Notification service — app delivery, in-app purchases, push on iOS.
• Google Play & Firebase Cloud Messaging — app delivery, in-app purchases, push on Android.
• Sentry — crash and error reporting (scrubbed of journal content before send).
• Cloudflare — DNS, DDoS protection, and edge caching for looknapp.com.
• Microsoft Clarity — anonymous web analytics on looknapp.com only, after cookie consent.
• Postmark — transactional email (password resets, receipts).

Each of these processes data on our behalf under a written data-processing agreement. None of them is permitted to use your data for their own purposes.

The Lookn team also sees data in two narrow cases: (1) aggregated, anonymous numbers like "x% of users completed a streak this week"; (2) the specific account data needed to answer a support email you sent us.

International data transfers

Lookn is operated from Canada and our infrastructure lives in AWS US regions. If you’re in the UK, EU, or EEA, this means your data crosses borders. We rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our processors, plus an additional safeguards review before we onboard any new sub-processor. You can ask us for a copy of the relevant SCCs at support@looknapp.com.

Your rights

Wherever you live, you can:

• Access a copy of your data — email support@looknapp.com and we’ll send a machine-readable JSON file within 30 days.
• Correct anything that’s wrong — most of it inside the app, the rest by email.
• Delete your account — Settings → Account → Delete Account, or by email. Permanent and complete within 30 days, except where law requires us to keep a record (e.g. tax records for purchases).
• Port — the same JSON export above is portable to other tools that accept it.
• Object or restrict processing for anything based on legitimate interests — usage analytics, etc. Toggle them off in Settings → Privacy or email us.
• Withdraw consent — turn off notifications, analytics, or friend-mode at any time. Past lawful processing is unaffected.
• Lodge a complaint with your local data-protection authority. In the UK that’s the ICO; in the EU it’s your national DPA. We’d rather you tell us first, but you don’t have to.

If you’re in California, Colorado, Connecticut, Virginia, Texas, Utah, Oregon, Montana, Delaware, or another US state with a comprehensive privacy law, you have the same access, deletion, correction, portability, and opt-out rights described above. To exercise them, email support@looknapp.com. We don’t treat people differently for exercising privacy rights.

"Sale" / "sharing" of personal information. We do not sell or share your personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. There is no opt-out toggle to surface because there’s nothing to opt out of.

Sensitive personal information. California treats some categories — like religion, health information, or precise geolocation — as sensitive. We do not collect those categories, and so we do not use them for inferences or secondary purposes.

Do Not Track and Global Privacy Control

We honour the Global Privacy Control (GPC) signal on looknapp.com: a GPC header is treated as a valid request to opt out of analytics cookies for that browser. Because Lookn does not sell or share personal information, there’s nothing additional GPC needs to do beyond that. We do not currently respond to legacy "Do Not Track" headers; the industry never agreed on what they meant.

Security

Data is encrypted in transit (HTTPS/TLS 1.2+) and at rest (AWS-managed encryption with KMS-managed keys). Passwords are hashed with bcrypt or Argon2id — we cannot recover them, only help you reset. We follow least-privilege access: only on-call engineers can touch production systems, only when they need to, and access is logged. We rotate API credentials on a fixed schedule and after any team change.

No system is perfectly secure. If you discover a vulnerability, please email support@looknapp.com with "security" in the subject. We’ll respond within 5 business days.

Data breach notification

If we discover a breach affecting your personal data, we will tell you and (where required) the appropriate data-protection authority without undue delay — and within 72 hours of becoming aware, unless the breach is unlikely to result in any risk to you. The notice will describe what happened, what data was involved, what we’re doing about it, and what you can do.

Children

Lookn is for users 13 and older. We do not knowingly collect personal information from children under 13. If you’re in the UK or EU you must be at least 13 (or 16 in some EU member states) to use Lookn without parental involvement. If you’re a parent and believe your child created an account, email us and we’ll delete it and any associated data. We do not knowingly create marketing profiles of minors.

Not medical or health data

Lookn is a consumer wellness app. It is not a medical device, it is not delivered through a healthcare provider, and the moods, journal entries, and breathing exercises you log are not Protected Health Information. We are not a HIPAA-covered entity, and we are not a business associate of one. If your employer or benefits provider has paid for your access, that arrangement is covered by a separate agreement and does not change what’s in this policy.

Cookies on the website

looknapp.com uses three small categories of cookies and similar storage:

• Strictly necessary — remembering you’ve dismissed the cookie banner, theme preference. Always on.
• Analytics — Microsoft Clarity session diagnostics. Off by default; on only after you accept.
• Embedded media — some help pages embed video. The provider sets its own cookies only when you play.

You can change your cookie choices at any time by clearing site data in your browser or returning to the banner via Settings → Privacy.

Push notifications

Lookn sends push notifications only after you opt in through your operating system. You can revoke that consent at any time in your phone’s settings or inside Lookn (Settings → Notifications). We do not use push for marketing — only for reminders, streaks, friend activity you’ve opted into, and account-critical messages.

Marketing communications

If you sign up for emails about new features or product updates, we’ll send them through Postmark and you can unsubscribe with one tap from any email. We don’t add you to a marketing list just because you have an account.

Business changes

If Lookn is ever acquired or merged, your data may transfer to the new entity as part of that transaction. The same privacy promises in this policy travel with it. If there’s any material change to how your data will be handled, we’ll tell you in-app before it takes effect and give you the choice to delete your account first.

Changes to this policy

If we make material changes to this policy we’ll notify you in-app and by email (if you have one on file) before they take effect. The version date at the top of this page always reflects the latest update. Past versions are available on request.

Contact

Questions, comments, or privacy requests? Real human answers at support@looknapp.com.