LociArc ("we", "us", "the app") is a personal read-it-later + AI summarisation service operated by the LociArc team (hello@lociarc.com). This document explains what data we collect, why, how long we keep it, and how you can delete it.
1. Data we collect
We collect the minimum data needed to run the service. Concretely:
| Category | Examples | Why |
|---|---|---|
| Account | Email, display name, hashed password, OAuth subject ID | To authenticate you and contact you for security events |
| Saved content | URLs you save, AI-generated summary/tags, folder/tag metadata | This is the core product feature — your vault |
| Notification channels | Telegram chat ID, email opt-in flag | To deliver Daily Brief / Time Capsule pushes you opted into |
| Device + diagnostics | App version, OS, anonymous device ID, crash stack traces | Debugging crashes (via Sentry) |
| Usage analytics (mobile app only) | In-app events (screens viewed, buttons tapped), tied to your account ID — no email or name | Understanding usage to improve the product (via PostHog) |
| Server logs | IP address, user agent, request path, response status | Operational logging — kept ≤30 days |
We do NOT collect: contact lists, photo libraries, location, microphone, advertising identifiers, or biometric data.
2. How we use the data
- Authentication — email + hashed password / OAuth tokens are used only to sign you in. We use refresh-token rotation so a stolen token expires within 30 days and can be revoked.
- AI processing— the URL you save is fetched by our backend, the page text is extracted (via Jina AI Reader), then embedded and summarised using Google's Gemini API (
gemini-2.5-flash+gemini-embedding-001) through Google's OpenAI-compatible endpoint. The article body is sent to Google for that hop; see Google's API terms. We do not train any model on your data. - Notification delivery — if you pair Telegram, the bot uses your chat ID solely to deliver your own brief; no broadcast.
- Crash reporting — we forward stack traces to Sentry with
sendDefaultPii: false(no IP, no email is auto-attached). We do not run any third-party advertising SDK. - Usage analytics — the mobile app uses PostHog to measure how the product is used (events such as screens viewed and buttons tapped). Events are tied only to your account ID, never your email or name, and are not used for advertising. You can opt out via your OS privacy controls; if we do not configure a PostHog key, this is disabled entirely.
3. Data we do NOT sell
We do not sell, rent, trade, or share your personal information with third-party advertisers. We do not run third-party ads SDKs.
4. Sub-processors
| Vendor | What they receive | Region |
|---|---|---|
| Google (Gemini API) | Article body + URL for summarisation/embedding | US |
| Jina AI (r.jina.ai) | The page URL, to fetch and extract readable text | Global |
| Sentry | Crash stack traces (no PII) | US/EU |
| PostHog | App usage events tied to account ID (no email/name) | US/EU |
| Postgres (self-hosted, pgvector) | All vault data | Operator-controlled server |
| Redis (self-hosted) | Job queue payloads (transient) | Operator-controlled server |
5. Data retention
- Vault items, folders, tags — kept until you delete them or delete the account.
- Refresh tokens — 30 days, then automatically expired.
- OTP codes (email login) — 10 minutes, then deleted.
- Server logs — 30 days, then rotated out.
- Crash reports (Sentry) — 90 days (Sentry default).
- Account deletion — when you tap Delete Account, we cascade-delete every row owned by your user ID within 30 seconds, revoke all refresh tokens, and queue a Telegram unpair.
6. Your rights
- Export your data (GDPR-style JSON or Markdown bundle) — Profile → DATA_EXPORT.
- Delete your account — Profile → DANGER_ZONE → DELETE ACCOUNT. You will be asked to type your account email to confirm. The action is irreversible.
- Disconnect Telegram — open Telegram, send
/unpairto the bot.
For requests we cannot fulfil from the app (legal subpoena, LGPD data subject request, etc.) write to hello@lociarc.com; we respond within 30 days.
7. Children
LociArc is not directed at children under 13 (under 16 in the EEA). If you believe a child has signed up, email us and we will delete the account.
8. Security
- Passwords are hashed with bcrypt (cost ≥ 10).
- Tokens are stored on-device in Expo SecureStore (iOS Keychain / Android EncryptedSharedPreferences).
- All traffic is TLS 1.2+.
- The server-side SSRF guard blocks the app from being abused as a proxy to internal/private/loopback addresses.
9. Changes
When we change this policy, we will update the Last updated date above and notify users via email and an in-app notice for material changes.