Last updated 17 August 2026
This explains what Looci collects, why, who else touches it, and how to get rid of it.
Looci is operated by Luka Spalević, an individual based in Montenegro. No company has been registered yet; when one is, this section will name it and this policy will be reissued under it.
For anything in this document, including requests to see or delete your data, write to loociinfo@gmail.com.
localStorage and IndexedDB.
Clearing your browser data removes them, and no copy of them reaches us.| What | Why it is lawful |
|---|---|
| Account details | Contract — without them there is no account to give you. |
| Saves, extracted content, notes | Contract — this is the service you asked for. |
| Security and abuse logs | Legitimate interest — keeping the service standing up. |
| Emails about the service | Contract for essential notices; consent for anything else. |
Looci is built on other people's infrastructure. These are the only processors involved, and each is bound by its own agreement:
| Processor | What it does | What it sees |
|---|---|---|
| Supabase | Database and authentication | Your account and everything you save |
| Vercel | Hosting and content delivery | Standard request logs, including IP address |
| Sign-in, only if you choose it | That you signed in to Looci |
Some of these operate servers outside Montenegro and outside the EEA. Where data is transferred, it relies on those providers' standard contractual clauses.
Looci contains features that would send the content of a save to a third-party AI provider in order to categorise or describe it. These features are switched off in the public build. While that remains true, nothing you save is sent to any AI provider. If that changes, this page will say so before it happens, naming the provider.
If you are in the EU or the EEA, the GDPR gives you the right to access your data, correct it, delete it, export it, object to processing, and complain to your national data protection authority. Looci extends every one of these rights to all users, wherever they are, because operating two standards would be worse than operating one.
Email loociinfo@gmail.com and you will get a reply within 30 days. There is no charge.
Traffic runs over HTTPS. Database access is restricted per user with row-level security, so one account cannot read another's rows. Passwords are hashed by the authentication provider and never stored in readable form.
Looci is not intended for anyone under 16, and accounts are not knowingly created for them. If you believe a child has made an account, write to us and it will be removed.
When this policy changes, the date at the top changes. If a change materially affects what happens to your data, account holders will be emailed before it takes effect.