Loom has no account to sign up for and no server to sign in to. What you log stays on your iPhone and, if you use iCloud, in your own private iCloud database — where Loom cannot read it either.
Effective 21 August 2026 · Loom for iOS, version 1.0
01 / The short version
The rest of this page is the same six statements written out carefully, because a privacy policy has to be precise. Nothing below contradicts anything here.
02 / Who is responsible
Loom for iOS is published by Tom Haythorn, an individual developer. For anything on this page — a question, a correction, or a request about your data — write to tom@ridetogether.io.
Under the UK GDPR and the EU GDPR, that makes me the data controller for any personal data Loom processes. In practice the answer to "what personal data does Loom process?" is: none that ever reaches me. The sections below explain exactly what that means, and where the data does go.
03 / What Loom stores
This is the complete inventory. If something is not on this list, Loom does not store it.
| What | The detail you entered | Where it lives |
|---|---|---|
| Bikes | A name you choose, an odometer reading, the ride source, and a Strava gear ID if you imported the bike from Strava | Device · your iCloud |
| Rides | Date and distance, and whether you entered it by hand or imported it | Device · your iCloud |
| Health workout IDs | Only if you connect Apple Health: a list of which workouts have already been turned into rides, so none is imported twice | Device only — never iCloud |
| Wax events | Date, the odometer reading at the time, hot wax or drip lube, and which product and chain you used | Device · your iCloud |
| Products | The brand and product name you typed | Device · your iCloud |
| Components | Chains, service, tyre and sealant trackers — labels, target intervals, the odometer at each change, and any note you wrote | Device · your iCloud |
| Settings | Units, appearance, language and your alert preferences | Device only |
| Strava tokens | Only if you connect Strava: the access and refresh tokens Strava issues | Device Keychain only |
| Loom Pro status | A single true-or-false, so the app and its widget agree on whether you subscribe | Device only |
Loom stores its data in your private iCloud database — the same mechanism Apple's own apps use. It is tied to your Apple Account, protected by Apple, and governed by Apple's Privacy Policy. Neither I nor anyone else can read it, and there is no dashboard anywhere that shows me your rides.
There is no separate iCloud switch inside Loom: it follows your device's own setting. Turn Loom off under Settings › your name › iCloud and the app keeps working entirely on the device.
04 / What Loom never does
These are not policy promises that a future build could quietly drop. There is no code in Loom that could do any of them — the app ships with no third-party libraries at all.
05 / Apple Health
Loom can save you typing by reading rides you have already recorded elsewhere. It is entirely optional, and Loom works fully without it.
Two read permissions and nothing else: workouts and cycling distance. Loom requests no permission to write to Health, so nothing it does can alter your Health data.
From each cycling workout, Loom copies the date and the distance, and separately notes the workout's identifier so the same ride is never imported twice. Heart rate, power, route, calories and every other metric are neither read nor stored.
Into a ride in Loom, on your device, exactly as if you had typed it in. It is never sent to me, and never to a third party. Health data is used for one purpose: keeping your odometer and your chain's wax life current.
Nothing from Apple Health is stored in iCloud. The list of workout identifiers stays on the device that read them and is never synced. What reaches your iCloud is a ride — a date and a distance — indistinguishable from one you typed by hand.
You can withdraw this at any time under Settings › Privacy & Security › Health › Loom, or by disconnecting inside Loom. Rides already imported stay in Loom as your own records; delete any of them individually if you would rather they didn't.
06 / Strava
If you connect Strava, you authorise it on Strava's own website, not inside Loom. Loom never sees your Strava password.
Read access to your activities, including private ones, and to your profile so that your bikes can be matched to your Strava gear. No write permission is requested — Loom cannot post, edit or delete anything on Strava.
From each cycling activity: the date, the distance and the activity's ID. From your profile: your bikes' names and gear IDs, if you choose to import them. The access and refresh tokens Strava issues are held in your device's Keychain and nowhere else. Disconnecting deletes them.
Your use of Strava is governed by Strava's own privacy policy. Loom sends your Strava data to no one, and no data travels from Loom to Strava.
Strava import may not be available in every release. It depends on Strava's approval of Loom as a developer application, and manual entry and Apple Health never depend on it.
07 / Loom Pro
Loom Pro is an auto-renewing subscription sold through the App Store. The purchase happens entirely within Apple's system: Loom never sees your name, your payment card, your billing address or your Apple Account. What the app receives is a single answer to a single question — is this subscription active? — which it stores on the device as one true-or-false value.
Purchases, billing, refunds and renewals are handled by Apple under Apple's Privacy Policy. You can manage or cancel any time in your Apple Account settings.
A lapse is not a lockout. If Loom Pro ends, every kilometre, wax event and component record you logged stays in Loom, on your device and in your iCloud, readable in full. The subscription gates what the app can do next, never what it will show you about your past.
08 / Notifications
Loom's alerts at 80% and 100% of a chain's predicted wax life are local notifications. They are scheduled by the app on your device, from numbers already on your device. There is no push server, nothing is sent over the internet to deliver them, and no one — including me — knows that one fired.
You can turn them off in Loom's settings or under Settings › Notifications › Loom.
09 / Your control
For exactly as long as you want it. Loom deletes nothing on a schedule and expires nothing — a wax log is only useful because it is long. Nothing is archived anywhere you cannot reach.
Every ride, wax event, bike and component can be edited or deleted inside the app, and deleting a bike removes everything attached to it. To remove all of it at once, delete the app. To remove the iCloud copy as well, use Settings › your name › iCloud › Manage Account Storage.
You have the right to access, correct, erase, restrict and port your personal data, and to object to its processing. Loom is built so that you exercise all of them without asking anyone: the data is in your hands and in your Apple account, not in mine. I cannot fulfil an access or deletion request for data I have never held and cannot see — but if you believe I hold something about you, write to tom@ridetogether.io and I will answer.
If you are in the UK or the EU and are not satisfied with my answer, you may complain to your national data protection authority — in the UK, the Information Commissioner's Office.
10 / The rest
Loom is a maintenance tool for cyclists and is not directed at children. It knowingly collects no data from anyone, of any age.
Where the GDPR applies, the processing described here rests on your consent — given at the permission sheet for Apple Health, at Strava's own authorisation screen, and withdrawable at either — and on the legitimate interest of running the app you asked for.
Loom transfers nothing internationally, because Loom transfers nothing. Where your iCloud data is physically stored is a matter between you and Apple, described in Apple's privacy policy.
If Loom ever changes what it stores or where it goes, this page changes first and the date at the top changes with it. A change that materially affects your data will be announced in the app before it takes effect, not after.
Tom Haythorn · tom@ridetogether.io
There is no Loom server. That is the policy; the rest is detail.