Your data should have clear boundaries.
Understand what LoopGuard processes, where data moves, how retention works, and how to request access, export, correction or deletion.
Data we process
LoopGuard processes account identifiers such as email, device identity and status, OAuth/session and pairing metadata, enabled capabilities, support requests, and execution/activity/security metadata needed to operate and protect the service. When you ask ChatGPT to use your Mac, the tool inputs and the requested file, search or process results can transit LoopGuard so the request can be completed. Free-form file, process, environment and support inputs can contain sensitive information, so only send what is necessary. LoopGuard does not sell personal data.
Storage, processors, retention and control
Account, authorization, device, support and operational records are stored in Supabase; the public web/API surface is hosted on Vercel; remote device transport is hosted on Railway. Email sent to support@loopguard.dev is received through Resend and stored in LoopGuard’s private support records. OpenAI/ChatGPT receives tool data when you choose to use LoopGuard from ChatGPT and that data is also governed by OpenAI’s terms and privacy settings. Local files are not bulk-uploaded merely because a folder is allowed: content is read or changed when an authorized tool request requires it. Account and device records are retained while needed to provide the account. Support, operational, audit and security records may be retained as long as needed to resolve requests, preserve service integrity, prevent abuse, troubleshoot incidents or satisfy legal obligations. A deletion request removes or anonymizes data that is no longer required for those purposes. You can revoke a Mac, pause AI access, remove folder access, and request an export or deletion.
Privacy requests
For access, export, correction or deletion requests, use the LoopGuard support form and choose Privacy request. Use the email associated with your account when possible. We may ask for limited verification needed to protect the account before acting on a request.