Legal

Privacy policy

Last updated 11 November 2026

This policy covers two things: the LOAM app (the Android host app, the desktop app for Mac, Windows and Linux, the loamnet terminal app, the web client people join with, and the server they all run) and the loamnet.com website. They work very differently, so they have separate sections. LOAM is published by Magic Zebra Ltd.

The LOAM app

Who holds your data

LOAM has no central server and no cloud service. Whoever starts a LOAM network (the host) runs the server on their own phone, laptop or Raspberry Pi. Everything posted on that network is stored on the host's device. Magic Zebra Ltd never receives it, cannot see it, and has no copy of it. The host decides how their network is configured, so on a given network the host controls the data described below.

No accounts, analytics or tracking

The app has no sign-up, and it never asks for an email address, phone number or real name. It contains no analytics, advertising, crash reporting or third-party tracking code.

That also means the app never tells us when something goes wrong. If you find a problem, or would like to ask for a feature, please let us know: open an issue on GitHub, or email Magic Zebra Ltd at opensource@magiczebra.co.uk.

Checking for updates

The Android app from Google Play asks the Play Store app on the phone whether a newer LOAM exists, when LOAM opens. The Android app from GitHub checks only when you tap Check for updates: it asks GitHub for LOAM's latest version number, and GitHub sees your phone's internet address. Neither check sends anything from your LOAM network, and neither downloads or installs anything by itself. The desktop app for Mac, Windows and Linux works the same way as the GitHub Android app: it checks only when you tap Check for updates, never on its own.

What the host device stores

• Your identity on that network: a random user id (such as user.1a2b3c4d…), the display name generated from it or one you choose, and your avatar settings or an avatar image you upload. A session cookie links your browser to that id.
• What you post: channel messages, replies, direct messages, reactions, and any images or files you attach. A location appears only if you add it to a message yourself.
• That you agreed to the network rules, and which version of them.
• Moderation records: reports you file, and actions the host or moderators take (bans, timeouts, removed messages, join approvals). When you report a message, the network's moderators can read that message and see its pictures and files, even in a direct message, while your report is open.
• Your block list: the people you have blocked. The app shows it only to you; it isn't shared with the people you blocked, with moderators, or with other networks.
• Network settings chosen by the host.

Your own device keeps a copy of the conversations you have open so the app keeps working offline. A reset tells your device to delete that copy (see below).

How long it is kept, and how it is deleted

• By default, data stays on the host device until someone deletes it. You can delete your own messages. The host can make messages expire automatically after a set time.
• The host can run an Emergency Reset, which deletes every message, user, image and file on the host and tells devices connected at the time to delete their copies. A device that was offline deletes its copy the next time it reconnects at the same address. The address can change when the host restarts, and a copy saved under an earlier address stays in that browser until its site data is cleared. A browser that used an unencrypted network on LOAM 0.7 or earlier can also keep pictures and attachments in its HTTP cache, which a reset can't reach. To remove those copies, clear cached images and files in the browser's settings. A reset pauses syncing. Linked networks keep their own copies of public channels and can send them back if the host turns syncing on again.
• The host can turn on encryption of the stored database. With encryption on, a reset also replaces the key in the Android and desktop host apps, and in the loamnet terminal app when it uses a temporary key, so the deleted data cannot be recovered from the database files left on the device. The exception is the desktop app on Linux with no keychain, where a passphrase network keeps its key in an unprotected file: flash storage may keep that file after it is deleted. A reset does not reach backups of the host device. loamnet with a fixed passphrase deletes the database files but keeps the same passphrase. With loamnet, the browser you use as admin is an ordinary browser: like anyone else's, it keeps its own unencrypted copy until the reset reaches it. Uploaded images and files are stored outside the database without encryption. A reset deletes them, but on flash storage a deleted image or file may still be recoverable.
• Uninstalling the Android host app deletes everything it stored.

When data leaves the host device

In the default setup, nothing leaves the host device except the messages delivered to the people on that network, over the local Wi-Fi or hotspot. When you join by scanning the host's QR code, the app encrypts everything between your device and the host: messages, pictures and files, both ways. Someone who types the address instead of scanning gets much less protection, unless the host requires encrypted connections (then they are asked to scan). Their sign-in cookie travels unencrypted, so anyone listening on the Wi-Fi can copy it, then read their messages and send messages as them. Their pictures and files are sent unencrypted too. The encryption does not protect against someone who can alter the network traffic while LOAM loads on your device: they could give your device a changed copy of LOAM that reads your messages. Data leaves the host device only if the host turns on one of these features:

• Sync with other LOAM networks: public channels (their names and descriptions), the messages, replies and reactions posted in them, their attachments, and their authors' user ids, display names and avatar settings are copied to the networks the host links to. Direct messages and private channels are never synced.
• Remote assistant: if the host connects the assistant to a model running on another computer, the messages you send to the assistant, and the recent history of that conversation since the host last chose where the assistant runs, go to that computer. The on-device assistant runs entirely on the host phone.
• Online assistant: the host can set the assistant to use an online chat service, such as OpenRouter, OpenAI, Groq or Mistral. The messages you write to the assistant, and the recent history of that conversation since the host last chose where the assistant runs, are then sent to that company and handled under its own privacy policy. The host chooses the service. The admin page names it and warns that messages will leave the network, and the assistant's chat names it too and asks you to confirm once on each device before your first message goes out. Nothing else goes there: not your name, not your other messages, and nothing anyone else writes. A Private network only accepts an assistant whose address is on the host or the local network, judged by the address as written.
• Mesh delivery (experimental): messages to your mesh contacts may be carried by other LOAM networks, sealed so that the networks carrying them cannot read them.

When the host downloads an on-device assistant model, the host phone fetches the file from Hugging Face, or from a web address the host enters. That request is between the host phone and that site and contains no LOAM user data.

Android permissions

• Nearby Wi-Fi devices and location: Android requires these to start a local hotspot. LOAM does not read or record your location.
• Notifications: used to show that the phone is hosting a network, and new messages for you while LOAM is in the background. They're made on the phone and go nowhere else.
• Foreground service and wake lock: keep the network running while the screen is off.
• Bluetooth and Wi-Fi Aware (mesh, experimental): used to find nearby LOAM devices to exchange sealed messages.
• Camera: asked for only on the setup step that scans another LOAM network's link code. Nothing the camera sees is stored or sent anywhere.

Children

LOAM is for adults: everyone confirms they are 18 or over before they post. LOAM collects no information that would identify a child.

LOAM's rules prohibit any sexual content involving anyone under 18. Our child safety standards explain how that is enforced and where to report a concern.

The loamnet.com website

The website uses PostHog analytics, hosted in the EU, to count page visits, clicks on the Google Play, download and GitHub links, and copies of the npx loamnet command. It sets no cookies and stores nothing on your device, and it creates no profile of you. With each page visit and counted click, PostHog receives the page address and the page you came from; your browser, operating system and type of device; your screen and window size, language and time zone; and your IP address, from which it works out an approximate location (country and city). The site is hosted by Vercel, which keeps standard server logs.

Downloads of the app are served by GitHub (or Google Play), under their own privacy policies.

Contact and changes

Questions about this policy go to Magic Zebra Ltd through the LOAM issue tracker or by email at opensource@magiczebra.co.uk. Questions about data on a particular LOAM network go to that network's host, who holds it. Changes to this policy are published on this page with a new date.