Privacy

Loftling is an iPhone app that turns a photo of your room into a design, and loftling.com is its website. This page says exactly what happens to your data in both.

Last updated: 7 October 2026

What the app collects

• The photo you choose. Only the one you pick, only when you pick it. The app never browses your library — iOS shows you the picker and hands us back the single image you tapped. Location and other camera information is stripped on your phone, before anything is sent.
• The instruction you type, if you type one. It travels with the photo and is deleted the same way.
• A random ID our server gives this device. It is not your name, not your email, and not Apple's advertising identifier. It exists so we can count your designs against your allowance.
• A check that the app is genuine. Before that ID is issued, your iPhone asks Apple to vouch that this is a real, unmodified copy of Loftling; on an iPhone where that check cannot work, the ID is issued without it. Apple answers us about the app, not about you.
• Your subscription. Apple's signed record of your purchase is kept on our server with the random ID, so the app knows your plan; RevenueCat, our subscription provider, also sees whether a subscription is active — not who you are.
• How the app is used, through PostHog: fourteen named moments — the app opened, a photo chosen, the style step shown, Generate tapped, the consent sheet closed without agreeing, a design delivered or failed (with an error code), a design saved to Photos, the share sheet opened, the plans screen shown, a purchase started or completed, a trial started, and your answer to "How did you find Loftling?". Never a picture, never your words, never an ID of ours. PostHog files them under an anonymous ID of its own, which we never join to ours.
• Crash and error reports, through Sentry: what the app was doing when it crashed or froze, and an error's code when registering with our server, a purchase, a restore or Delete my data fails. Sentry is set not to store your IP address, and the reports carry no screenshots and no recordings.
• A message you send us, if you use Send feedback in Settings: your words, and your email only if you type one so we can reply. The app adds its version, your iPhone model (such as "iPhone18,3", not a name) and your plan. It is kept on our server with the random ID, so that Delete my data can find it.

What loftling.com collects

• The email you type into the waitlist form, if you type one. Tally runs the form and stores the addresses. We use yours to tell you when Loftling opens.
• Visit counts, through Cloudflare Web Analytics, which Cloudflare states "does not collect or use your visitors' personal data." Cloudflare also serves loftling.com and forwards mail sent to hello@loftling.com.

Why we collect it

To make your design, to keep your free allowance honest, to make a subscription work, to see where the app breaks or confuses, to learn how people find the app, to read and answer the messages you send us, to tell the people on the waitlist when it opens, and to count visits to loftling.com. Nothing else. We show no ads, we never use your data for advertising, we do not profile you, and we do not sell or share anything with data brokers.

Where the GDPR applies: our legal basis for sending your photo and your words to OpenAI is your consent, which you give on the screen before your first design and can withdraw at any time in Settings. For the allowance count and the subscription it is performance of the contract you have with us when you use the app. For the usage counts and crash and error reports it is our legitimate interest in keeping the app working, and for your answer to how you found it, in knowing where people come from. For a message you send us it is our legitimate interest in answering you and improving the app. For the waitlist it is your consent, given when you type your email. For the visit counts on loftling.com it is our legitimate interest in knowing whether people find loftling.com.

How long we keep it

• Your photo, your typed instruction and your design are never written to our disk at all. They exist only in our server's memory while the design is being made, and the finished design is dropped as soon as your phone has it, or after ten minutes if it never collects it. Our server keeps no gallery: your past designs live only on your phone (see "Where your designs live").
• The count against your allowance: on a paid plan, until the week it counts ends, so the number is right. On the free plan: as long as the random ID exists (below).
• The record of each design attempt — when it ran, whether it worked, what it cost us, never the picture and never your words: 60 days, so we can check our provider's bill. If the random ID is deleted first, the record stays until its 60 days are up, tied to nothing.
• Your subscription record: until 30 days after the period you paid for ends — also when it is refunded before then.
• The random ID: deleted 30 days after it was last used, once no subscription is active on it.
• A message you send us: deleted at once by Delete my data; otherwise 180 days after it arrives. If the random ID is deleted first, the message stays until its 180 days are up, tied to nothing.
• Our server's log — when requests ran and how they ended, with design ids; never an IP address, a photo or your words: 60 days.
• Our database backups are deleted after 60 days. Until then, a backup still holds what the database held when it was made, including anything deleted since.
• Usage counts (PostHog): 1 year. Crash and error reports (Sentry): 30 days.
• Your waitlist email: until we have told you Loftling is open, and never longer than 12 months from the day you joined.
• OpenAI, which draws the image, keeps its own abuse-monitoring log for up to 30 days — longer only where the law requires it or where it is needed to stop harm. OpenAI states it does not use this data to train its models and keeps no application state for the service we use. We cannot shorten that.

What our server never writes down

The photo · the design · the description you type for a design · your IP address · your name · your location · any advertising identifier. Your email only if you type it into Send feedback, so we can reply. The per-minute limit that protects the service counts IP addresses in memory only. PostHog does receive your IP address and uses it to estimate a rough location; that cannot be switched off, so we tell you here.

Where your designs live

On your phone. Each finished design is saved in the app's own folder: the design as the original file; its "before", your photo's pixels at most 1024 pixels on its longer side, without its location or camera details; and a list of your designs with each one's style, layout choice and the words you typed. Those files are included in your phone's normal backup, wherever you keep it. Delete my data deletes them, and so does deleting the app.

Who else touches it

• OpenAI OpCo, LLC — draws the design. Receives the photo and your words.
• RevenueCat — handles subscriptions. Receives a purchase record, not your photo.
• Apple — takes the payment, vouches that the app is genuine, and tells our server whether a subscription is still active when its period ends. We never see your card.
• PostHog — counts how the app is used. Receives the fourteen moments above and your IP address.
• Sentry — collects crash and error reports. Stores no IP address; receives no photo and no words.
• Tally — runs the waitlist form. Receives the email you type there.
• Cloudflare — serves loftling.com, counts visits and forwards our mail.
• Our server runs on rented hardware in Germany.

We share nothing with anyone else. Each of them may use its own suppliers to do its part, as its own policy says (Tally's form, for example, reports its own errors to its own monitoring). There is no advertising network in the app or on loftling.com.

We confirm that each of them provides the same or equal protection of your data as this policy states, under the terms we have accepted with them, and we share your data with them only for what is described above. Each publishes its own policy: OpenAI at openai.com/policies/privacy-policy, and for what we send it through its API, developers.openai.com/api/docs/guides/your-data, RevenueCat at revenuecat.com/privacy, Apple at apple.com/legal/privacy, PostHog at posthog.com/privacy, Sentry at sentry.io/privacy, Tally at tally.so/help/privacy-policy, Cloudflare at cloudflare.com/privacypolicy.

How it is protected

Everything between your phone and our server travels over HTTPS. The random ID lives in your iPhone's Keychain, is marked this-device-only, and never syncs or restores from a backup. Our server is a single rented machine in Germany holding one database file, and only we can reach it.

Where it goes

Our server is in Germany. OpenAI does not give us a fixed country for this step: our account's data residency is set to Global, and the model we use is not one OpenAI offers per-region. PostHog and Sentry store what they receive in the United States; Tally, within the European Union; Cloudflare runs on its global network. Your data may therefore be processed outside the country you are in.

What you keep

You own your photo and you own the design we make from it. We take no right to use either in our marketing, our App Store screenshots, or to train anything. The only permission we need is the narrow one required to make the design you asked for: to send your photo to OpenAI, receive the result, and hand it back to you.

Your rights, and how to use them

Wherever you live, you can ask what we hold about you, ask for it to be deleted, and object to how we use it. In the EU and the UK these are rights under the GDPR.

In practice there is very little to ask for, and that is by design: there is no account, we do not know your name, and your photo is gone within moments of your design appearing. What remains is a count tied to a random ID, and any message you sent us.

Two controls are in the app, under Settings › Privacy:

• Turn off AI processing. Our server records that you withdrew your permission, as soon as the app can reach it, and the next time you ask for a design, we ask again first.
• Delete my data. This deletes, on our server, the ID for this device, the record of your permission, every design attempt it made and every message you sent from it — at once, and from our database backups within 60 days; on your phone it deletes your saved designs and the ID itself. On the free plan your free count goes too. On a paid plan the count for the week you are in is kept until the week ends, so that deleting and starting again does not hand out a fresh allowance. It needs a connection: offline, nothing is deleted and the app tells you so.

Deleting the app leaves its ID in your phone's keychain, unused, until Loftling is installed and opened again, which deletes it; our copy is deleted after 30 days without use, once no subscription is active on it. To leave the waitlist, write to us and your email is deleted.

To ask us anything, write to hello@loftling.com — we answer within 30 days. If you think we have handled your data badly, you can complain to your local data protection authority.

Children

You must be 18, or have a parent's or guardian's permission. We do not knowingly collect anything from anyone younger.

Who we are

Mikhail Shin, an individual developer. Chilonzor-31, 7, 131 · Tashkent 100208 · Uzbekistan · hello@loftling.com

(Apple shows its own trader contact details for us on our App Store product page in the European Union, as the Digital Services Act requires. Those are Apple's display of our trader registration; the address above is how to reach us about this policy.)

Changes

If we change what happens to your photo, we will ask you again in the app before the next design. We will not rely on you re-reading this page. If a change affects your waitlist email, we will email you before it takes effect.