Last updated November 6, 2026
Who this covers
XRaph is run by Rex Raphael, an independent developer, and publishes the Loomplane app for iOS and Android. XRaph also runs Loomplane's hosted service at app.loomplane.com and this website, loomplane.dev. In this policy, "we" and "us" mean XRaph.
Loomplane is also software you can run yourself. When you connect the app to a Loomplane that your company or someone else hosts, that server belongs to them. Apart from push notifications, which go through our gateway (see Push notifications below), we never see what passes between your phone and that server, and their own privacy policy covers what they keep. Ask whoever runs it.
What stays on your phone
The app keeps a few things so you don't have to sign in every time you open it. All of it sits in the platform's secure storage: the Keychain on iOS, and storage encrypted with the Android Keystore on Android.
- The address of each Loomplane server you sign in to, and the public key it gives the app.
- Your session token for each of those servers, the email address you signed in with, and the workspace you last used.
- Your settings for this phone: theme, accent colour, which notices you want, quiet hours, and whether production actions ask for Face ID or your fingerprint.
Signing out of a server removes its session from your phone. Deleting the app removes the rest on Android. iOS can keep Keychain items after an app is deleted, so sign out first if you want them gone straight away.
When the app asks for Face ID, Touch ID or your fingerprint, your phone does the check. The app only learns whether it passed. Your face and fingerprints never reach the app or us.
What leaves your phone
The app talks to the Loomplane server you choose, over HTTPS (plain HTTP only for a server on your own network). It sends your sign-in details and session token, and the actions you take, like approving a plan or marking a notification read. If your workspace has the agent on, it also sends what you type to the agent, your answers to its questions and any secret it asks you for, the same way the dashboard does. It shows you what that server sends back.
The first time it opens, the app downloads its typeface, Geist, from Google Fonts. Google receives your IP address for that request, as for any web request, and Google's privacy policy covers it.
Some screens open a page in your browser, on your server's dashboard or on this site. Your browser handles those like any other web page.
The app doesn't contain advertising, analytics or crash-reporting services, and it doesn't use your location, contacts, photos, camera or microphone.
Push notifications
If you turn notifications on, the app asks your phone for a push token (from Apple on iOS, from Google's Firebase Cloud Messaging on Android) and makes a key pair. The private key never leaves your phone. The app registers with the push gateway your server names, which is ours at push.loomplane.com unless whoever runs the server changed it. The gateway receives the token and a fingerprint of the Loomplane server's key (not the key itself), so it knows which server each phone belongs to. On iPhone it also learns whether it's a test build. It seals those into a handle and keeps nothing. The app then gives the server you're signed in to that handle, along with the public key.
That server keeps a record of the phone, tied to your account on it: the public key, the gateway handle, the platform, a name for the phone (something like "Pixel 9"), the time zone, your quiet hours, your notification settings, and when the phone was added and last seen. When you sign out on that phone, the app asks the server to delete the record. Deleting your account deletes it too, and records for phones that can no longer be reached are removed as well. The server also keeps only the 20 phones you used most recently.
When the server has something for you, it encrypts the notification to your phone's public key before it sends it. The gateway gets the encrypted payload, the handle (so only the gateway can open the push token inside it), how urgent the message is, what kind it is, how long the push may wait to be delivered, a collapse ID that lets a newer notification replace an older one, a key ID for your phone (a stable fingerprint of its public key, sent with every push), and which server key signed the request. It can't read the title, the text, your workspace or the buttons. Apple or Google deliver the message to your phone, and your phone decrypts it. Apple or Google can see that a notification arrived and when, but not what it says.
The gateway doesn't store any of this itself. Its logs keep a fingerprint of the server's key, the platform, the urgency, the kind, whether delivery worked and how long it took.
If you run Loomplane yourself, you can turn push off with LOOMPLANE_PUSH_ENABLED or point the server at a gateway of your own, though that only works with an app build you publish yourself, because only our gateway reaches the store version of the app. By default a self-hosted or company-run server sends through our gateway, and the same limits apply: we can't see what it says.
What the hosted service keeps
If you use Loomplane at app.loomplane.com, from the app or the web, we keep what it needs to work:
- Your name, email address, a hash of your password (never the password itself), and any passkeys or sign-in methods you add.
- The organizations you belong to, their members and roles, and their projects, manifests, plans, deployments, variables and secrets, along with the cloud accounts and repositories you connect.
- An audit trail of changes (who, what and when), deployment logs, and notifications.
- IP addresses, browser or app version, and sign-in times, which we use to keep accounts safe and stop abuse.
Secrets and cloud credentials are encrypted before they're stored. The security page explains how.
The agent and other AI features
Loomplane has an optional agent that reads your projects, plans and deployments and can work on them for you. It's off until an admin of your workspace turns it on, and while it's off nothing goes to an AI provider. The same goes for knowledge search, which needs its own switch.
With the agent on, what you ask it and what it reads to answer you go to the AI model provider your workspace uses. That can include deployment logs, plans, manifests, commit messages and the names of your services and variables. Your workspace's AI settings page shows which provider that is: the server's default, or a key from Anthropic, OpenAI or another OpenAI-compatible service that an admin added. On app.loomplane.com the server's default runs on our account with that provider, so it processes the data for us. A key your workspace adds is your own account, under that provider's own terms. Before anything reaches the model, Loomplane scans it for secrets, and it scans the answer before you see it.
A secret the agent asks you for never goes to the model. You type it into Loomplane, it's stored encrypted like any other secret, and the agent only learns that it was set. Provider API keys and a Hugging Face token are stored encrypted too, and nobody can read them back, you included.
Your conversations with the agent (your messages, its answers and the steps it took) stay on the server until you delete them, or until the workspace is deleted. A reported answer is the exception: its report keeps a copy, as the next paragraph explains. Only you can add to or delete a conversation you started. Admins of the workspace can read it. The questions the agent asks people, their answers, and the reports it opens about problems in production stay with the workspace like the rest of its history. The audit trail records each step the agent takes, but never a secret value, a question's text or an answer.
If you report an answer, the question, the answer and your note go to whoever runs the server, so they can review it. On app.loomplane.com that's us. Workspace admins can read every conversation in the workspace, so an admin can report an answer in one you started, and then your question goes too. A report doesn't expire. It stays after the conversation is deleted, so the operator can still review it, until they remove it, and you can ask them to. On app.loomplane.com, email rex@xraph.com (the address under Your rights). The audit trail records the report with its ids and reason, not the text.
With knowledge on, the agent can search your workspace's documents, such as its reports. To do that the server sends those documents to an embedding provider, which turns them into vectors the server stores. If your workspace has connected GitHub, a report can also open an issue in the repository it's about, through your workspace's GitHub App.
On a server you or your company run, whoever runs it picks the providers, and their policy covers what's sent.
How we use it
To run the service you asked for: sign you in, show you your projects, and carry out the plans and deployments you approve. To send the emails you've chosen to get, such as deployment notices and invitations. To keep the service secure and fix what breaks. We don't sell your data, and we don't use it for advertising.
Who else handles it
We use a small number of providers to run the hosted service, such as the cloud company that hosts it and the service that delivers its email. If your workspace uses the agent on our default provider, that AI provider is one of them. They process data only to provide those services to us.
When you connect a cloud account, a repository host or another integration, Loomplane sends that provider what's needed to do what you asked, like the configuration for a deployment you approved. Their own terms cover what they do with it.
We'll disclose data if the law requires it, and we'll tell you first when the law allows.
How long we keep it
Your account data stays while your account is open. When you delete your account, your name, email address, password and sign-in methods are erased at once, and your sessions and API keys stop working. Backups that still hold a copy expire within 30 days. Workspaces and their projects belong to the organization, so they stay for its other members, and their member lists and audit trails show an anonymous ID where your name used to be. A record of the terms and consents you accepted is kept as proof of what you agreed to.
The account deletion page has the steps.
Your rights
Wherever you live, you can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live (the EU, the UK and California, for example), the law may give you further rights, such as objecting to how we use your data or complaining to your data protection authority. Email rex@xraph.com from the address on your account and we'll answer within 30 days.
Where it's stored
The hosted service runs in the United States. If you use it from somewhere else, your data is transferred there, with the protections this policy describes.
Children
Loomplane is a tool for software teams and isn't meant for children. You need to be at least 16 to create an account. If you think a child has given us data, email us and we'll delete it.
Changes
When this policy changes, we'll update it here and change the date at the top. If a change matters to how your data is used, we'll also tell you by email or in the app before it takes effect.
Contact
Questions or requests about your data go to rex@xraph.com.