Privacy policy

Last updated: 2026-11-01 (draft)

The short version

PraiseLoop turns a business's customer reviews into draft social posts. You approve every post before it goes anywhere, and you decide whether and where to publish it. This policy explains what we collect, why we need it, who we share it with, and how to have it deleted. We do not sell personal information, and we do not use it for advertising. PraiseLoop is a pilot, and some of the integrations described below are not live yet.

Who we are and how to contact us

PraiseLoop is operated by Stephen Davis, operating as PraiseLoop, in Ontario, Canada. In this policy, "we", "us" and "our" mean Stephen Davis, operating as PraiseLoop. We are responsible for the personal information described here.

Email privacy@praiseloop.ca for privacy questions, access or correction requests, or to ask us to delete your data. Email hello@praiseloop.ca for everything else. We aim to answer privacy requests within 30 days.

This policy covers the PraiseLoop web app, the PraiseLoop phone app and this website.

What we collect

We collect what the service needs to work and what you choose to give us. We do not ask for more.

Your account and sign-in

• Your name. It may come from your sign-in provider, or you may set it yourself. You can change it in your profile. When you set it yourself, it is limited to 80 characters.
• Your email address. With Google, this is the verified address Google provides. With an email sign-in code, it is the address you type. With Apple, it may be Apple's private relay address.
• Your sign-in methods. We record which providers you have linked (Google, Apple, Microsoft or an email code), the provider's stable account ID, the email address shown for that method, and when it was added and last used. For Microsoft the ID is your tenant and object ID. For Google and Apple it is their subject ID. For email it is the normalized address.
• We do not keep Google, Apple or Microsoft access tokens or identity tokens after sign-in. They are checked and then discarded. We store no passwords.
• For email sign-in, we store the address, a keyed hash of the six-digit code (never the code itself), how many attempts were made, and when the code was created, expired, was used or was replaced. Codes last 10 minutes and work once. Used and expired records are kept as an audit trail and may be pruned.
• Session records: a hash of the session token (not the token), whether the session is for the browser or the phone, when it started, when it was last used and when it expires. Browser sessions last 8 hours. Phone sessions last 30 days after last use, up to 90 days in total.
• On your phone, the app keeps its session token in the device keychain, along with your notification choice. The token is not kept in plain app storage.

Your business profile

• The business name, timezone, brand colours, template and quote-size settings, tone (friendly, premium or playful), posting days and times, weekly post target, and your logo image if you add one.
• If you ask us to learn your brand voice, we store the short voice profile we generate, the web address of the public page you gave us, and when it was updated. We read that one page, use at most about 6,000 characters of its readable text for the request, and do not keep the page text afterwards.

Reviews you import

• For each review: the rating from 1 to 5, the review text, the reviewer's name if your file has one, the date of the review, the source (manual import or Google), an optional source review ID, an optional source URL, and when we imported it.
• We compute a fingerprint from the rating, reviewer name, text and date so that a repeated import does not create duplicates. We record when one row is a duplicate of another.
• Review text can mention customers by name or include other personal details. We store it as you provide it. You are responsible for having the right to use it.
• Google review sync is not live. Reviews come from what you import today.

Drafts, captions, images and approval history

• For each draft: the chosen quote, the caption, its status, a scheduled time if one is set, the path to its image, a version number, when it was created and updated, and when you marked it as shared.
• An internal note field can hold a short sanitized status or error code, for example when a generation job failed.
• Every status change is recorded with the actor, the time, the action, the reason, and the old and new status.
• Your logo and the generated quote-card images are stored in private storage on our server. We serve them only to the signed-in owner. They are not public and are not listed anywhere.
• On the free plan, images carry a small PraiseLoop watermark.

Push notifications

• If you turn on notifications, we store the Expo push token for each device, the platform (iOS or Android), and when it was registered and last seen.
• We keep a delivery record for each weekly notification: the business, the week, the token, the number of posts, the delivery status and attempts, the provider ticket ID, a sanitized error code, and timestamps.
• Notifications contain a count, the business name and a link into the app. They do not contain review text or captions.

Plan and usage

• Your plan (free or pro), where it came from (the default, an operator change or a store purchase), its expiry, and when it last changed.
• A history of plan changes with the actor and the reason.
• Daily counters for AI generation and previews: the date, the kind of call and the number of calls. These enforce limits. They do not contain review text.

Connections you choose to add

• Google Business Profile review sync is not live. Google has not approved API access. If it becomes available and you connect your location, we would store the location name, an encrypted Google refresh token, the connection status, a page checkpoint for an interrupted import, the time and count of the last sync, and a sanitized error code.
• Buffer automatic posting is not live. If it becomes available and you connect Buffer, we would store encrypted OAuth credentials and the channel you choose. When you approve a post for scheduling, we would send Buffer the approved caption and image and your chosen channel. We would not send Buffer your other drafts or your reviews.

Technical data

• We do not store your IP address in our database. To limit abuse, the server keeps short-lived counters in memory for failed sign-in attempts and email code requests, counted per IP address. These counters are lost when the server restarts.
• In production, our server logs are designed to exclude review text, captions, email addresses, access tokens and provider responses. They record event names, counts and sanitized error codes. Account deletion logs a file count, not file names.
• Server logs rotate automatically. Each service keeps at most about 30 MB of recent log lines, and older lines are deleted, so the logs hold only recent activity.
• This website is hosted by GitHub Pages. The app is reached through a Cloudflare Tunnel. Those providers carry the request and may keep standard technical logs under their own policies.

Why we use it

• To provide the service you asked for: store your business, import reviews, choose quotes, write captions, render images, run the weekly queue, show your plan, and send the notifications you turn on.
• To sign you in and keep your account secure, including checking your session on every protected request and recording your sign-in methods.
• To prevent abuse and keep the service fair: rate limits on sign-in and email codes, daily AI limits and plan limits.
• To support you: answer your emails and investigate problems. We look at your data only with your permission, unless we must for security or legal reasons.
• To meet the law and enforce our terms.

We do not use your personal information for advertising. We do not sell it. We do not create profiles of you for other organizations.

We rely on your consent, which you give by using the service, and on the need to provide the service you asked for. You can withdraw consent, but some features will then stop working.

AI processing

• Captions are written by an AI model. To write them, we send the review quote, your business name and your chosen tone. If you have a brand voice, we send that too. We do not send the reviewer's name, your email address, your sign-in details or your logo.
• The app uses OpenAI, currently the gpt-4o-mini model, or OpenRouter with a model the operator selects. OpenAI is used when its key is configured; otherwise OpenRouter is used. The provider can change as the service develops.
• For brand voice, we send the readable text of one public page you give us, up to about 6,000 characters, and ask for a short profile. We do not fetch private pages.
• We send only what the feature needs. Once a request reaches a provider, we do not control how that provider stores or uses it. OpenAI's and OpenRouter's own privacy policies and terms apply. Please read them if this matters to you.
• AI output can be wrong, incomplete or bland. Every caption and image is a draft. You review and approve it before it is posted. AI review replies are a planned Pro feature and are not available.

Who we share it with

We share personal information only with the providers that help us run PraiseLoop, and only what each one needs. Where they process data for us, they act on our instructions. Sign-in providers also handle your account under their own terms. We do not sell personal information. We do not share it for advertising.

• Google, Apple and Microsoft. Sign-in. We receive your name, your email address and a stable account ID. We do not receive your password.
• Resend. Sends sign-in code emails. It receives the email address and the message.
• OpenAI or OpenRouter. Writes captions and brand-voice profiles. It receives the fields listed under AI processing.
• Expo. Delivers push notifications to your phone. It receives the push token and the notification content, which is a count, the business name and a link.
• Buffer. Only if you connect it, and only when automatic posting becomes available. It would receive the approved caption, the approved image and your chosen channel.
• Cloudflare. DNS and the network tunnel that reach the app. It carries requests to us.
• GitHub Pages. Hosts this website.
• Our own server. Hosts the app and stores the data. During the pilot this is a server the operator controls at home. A rented server (VPS) is planned; this policy will name that provider before data moves.
• Zoho Mail. Hosts our mailboxes so we can receive and answer email.

We may also disclose information if the law requires it, if we need to enforce our terms, or to protect someone's safety. We will tell you unless the law forbids it.

This policy does not cover social networks, app stores or other services you use alongside PraiseLoop. Their own policies apply.

Google API Services User Data Policy

PraiseLoop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can read that policy at developers.google.com/terms/api-services-user-data-policy.

What we read from Google. Today we use Google only for sign-in, with the basic scopes openid, email and profile. We receive your name, your email address and your Google account ID. We do not read your Gmail, calendar, files or contacts. If review sync becomes available and you choose to connect your business location, we would read that location's reviews: the review text, rating, reviewer name, review date and review ID. We would not read anything else. That connection does not exist today.

What we do with it. We use Google user data only to provide the features you asked for: signing you in and, in future, importing your reviews so PraiseLoop can prepare posts for your business. We do not use it for advertising. We do not sell it. We do not use it to train or improve generalized AI models. We do not let people read it, except for support with your permission, or for security or legal reasons.

When a review is turned into a post, the review quote is sent to our AI provider to write a caption, as described under AI processing. That is part of providing the feature to you.

How long we keep data, and deletion

We keep your account data while your account exists. You can delete your account at any time in the app or on the web. Both have a Delete account button in your profile.

Deletion is immediate and complete in the live database. One transaction removes your owner record, businesses, reviews, drafts, approval history, generated images, logos, sign-in methods, plan and usage records, push tokens, sessions, and any Google connection. Media files are removed from storage after the database change. There is no soft delete and no recovery period.

Backups. We do not currently keep backups of the database or the image storage, so deleting your account leaves no copy of your data with us. If we start keeping backups, we will update this policy first. We expect to keep them for no more than 14 days, and data from a deleted account could remain in a backup for that long.

Email sign-in code records are kept after use or expiry as an audit trail, and may be pruned.

Buffer and social networks. Posts you have already shared are outside our control. Deleting your account does not remove them from Instagram, Facebook or anywhere else you posted them. If you connected Buffer, deleting your account removes the access tokens we stored. To remove PraiseLoop from your Buffer account itself, revoke it in your Buffer settings, and manage or delete any scheduled posts there.

Deleting your account does not cancel an App Store or Google Play subscription. Cancel it in the store.

You can also email privacy@praiseloop.ca and we will delete your account for you.

Security

• We use HTTPS for the app and this website, so data is encrypted in transit.
• Provider tokens are encrypted at rest with AES-256-GCM. The encryption binds each token to its owner and business, so a token cannot be reused for another account.
• Session tokens are stored only as hashes. Sign-in tokens from Google, Apple and Microsoft are not stored.
• Every API route that handles account or business data is checked against the signed-in owner. Another owner's business, draft or image returns not found.
• Uploads are size-limited, and private images are served only through an authenticated route.

No system is perfectly secure. We cannot promise absolute security. If a breach affects your information, we will tell you and the Office of the Privacy Commissioner of Canada as the law requires.

Cookies and tracking

• The app sets only the cookies it needs to sign you in: the session cookie and the short-lived cookies the sign-in library uses during sign-in. There are no analytics, advertising or tracking cookies.
• This website sets no cookies at all. It has no JavaScript, no analytics, no trackers, no embedded content, no remote fonts and no remote images. Everything it needs is served from praiseloop.ca.
• We do not use cross-site tracking or advertising identifiers.

Where your data is processed

The operator is in Ontario, Canada. During the pilot, the app runs on a server the operator controls at home, reached through Cloudflare. When it moves to a rented server (a VPS) with a hosting provider, we will update this policy to name the provider and say where the server is, before owners' data moves there.

Some of our service providers are based in, or process data in, other countries, including the United States. When data is processed outside Canada, it is subject to the laws of that country.

Our providers' own policies describe where they process data.

Your choices and rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you can ask to see the personal information we hold about you, ask us to correct it, withdraw consent, and ask us to delete it.

• You can delete your account in the app or by emailing privacy@praiseloop.ca.
• You can withdraw consent at any time. If you withdraw consent for something the service needs, we may not be able to keep providing it.
• We aim to answer within 30 days. If we need more time, we will tell you why.
• If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.

Customers' reviews

Reviews you import are about your business. They may include a customer's name or other details.

You are responsible for having the right to use each review, including any permission your customer or the source platform requires. If a review comes from a platform with attribution or reuse rules, you must follow them.

We store only the review fields listed above and use them only to prepare posts for your business. We do not publish them ourselves. You decide whether and where to post.

If someone asks you to remove their review from PraiseLoop, contact us and we will help.

Children

PraiseLoop is for business owners and managers. It is not intended for anyone under the age of majority.

We do not knowingly collect personal information from children. If you think a child has given us information, email privacy@praiseloop.ca and we will delete it.

Changes to this policy

We may update this policy. We will change the date at the top. For material changes, we will email the address on your account before the change takes effect.

If you keep using PraiseLoop after a change, the new policy applies.