1. Who we are
LendLoop ("LendLoop", "we", "us", "our") is operated by TripFish, LLC, a Delaware limited liability company and the data controller for your personal data. You can reach us by mail at TripFish, LLC, 205 S 1st St, Brooklyn, New York 11211-4344, United States, or by email at hello@trip.fish.
This policy explains what personal data we collect through the LendLoop web app, iOS app and Android app (together, the "Service"), how we use it, who we share it with, and the choices you have.
2. Data we collect
Account information
When you sign in with Google, we receive your name, email address, profile image, and Google account ID. When you sign in with Apple, we receive your Apple account ID, an email address (your real address or an Apple private relay address, which we require to create the account), and your name if you choose to share it. We also store the tokens Apple gives us so that we can revoke Sign in with Apple when you delete your account.
Content you create
Items you add (names, descriptions, emojis and photos), lending and borrowing records, return dates, notes (including private recipient-name notes only the lender can see), thank-you acknowledgements, activity posts, likes, comments, crews and crew memberships, and invitations you send through the Service, including the name or email address of the person you invite.
Your connections, reports and blocks
The people you lend to, borrow from or share a crew with. Your friends on LendLoop are the people you have lent to or borrowed from. If you report content or a user, we keep the report (who reported what, the reason, and any details you add). If you block a user, we keep your block list so we can enforce it.
Messages you send us
If you use Contact us, we keep your message, topic and reply email, plus your account ID (if signed in), app version and build, platform (web, iOS app or Android app) and the screen you came from, so we can answer you. We email it to our support inbox; the message text is not sent to analytics.
Information we receive from other users
We receive information about you from other users when they record a loan, identify a participant, or invite you, including your name and contact information. This can happen even if you do not have a LendLoop account: for example, a user may enter your email address to invite you to a crew.
Product search
Product search sends the text you enter to Google. Importing a link asks the linked website for its page and images. Search requests pass through our server, and our server request logs record the search text.
Device, log, usage and diagnostic data
IP address, browser and device type, operating system, whether you are using the iOS or Android app and its build number, in the apps the phone model, operating system version and the app vendor identifier your phone assigns to our apps, session and cookie identifiers, and push notification device tokens if you allow notifications. The Android app sends notifications through Google's Firebase Cloud Messaging: when you allow notifications, its Firebase software registers the app with Google, which receives a Firebase installation ID and the push token together with technical details about the device and app (such as the Android and app versions) and your IP address. Our server keeps request logs that include your IP address and the page or API address requested. We also collect information about how you use the Service, such as app installs and opens, pages and screens viewed, features used and other interactions, and error messages when something goes wrong in the app. Our analytics providers derive an approximate location (such as city and country) from your IP address. We and our analytics providers use cookies, local storage and similar technologies to collect this information.
Offline copy in the mobile apps
The iOS and Android apps keep the same read-only snapshot of your recent data in app storage for offline viewing: your items with small copies of their photos, your active loans (with the other person's name, profile photo and due date) and your crews. This snapshot stays on your device, is not backed up to iCloud on iOS, and is excluded from Android cloud backup and device transfer. It is replaced each time the app syncs and deleted when you sign out or delete your account. We don't receive anything new from it. Items you add while offline, and any photos you attach to them, are also kept in app storage until the app is back online and adds them to your account.
3. How we use your data
- To provide and operate the Service, including sign-in, share links, reminders, the activity feed and crews.
- To send you service messages, such as reminders, invitations and notices about your account.
- To understand how the Service is used, diagnose errors, and develop, improve and test features, including new and paid features.
- To review reports, enforce blocks, and protect the Service and its users, including detecting and preventing abuse, fraud and security incidents.
- To comply with legal obligations and enforce our Terms of Service.
We may also create aggregated or de-identified information that does not identify you, and use it for any lawful purpose.
4. Legal bases (EEA / UK users)
LendLoop is currently offered in the United States. If data protection law in the European Economic Area or United Kingdom applies to our processing of your data, we use account and loan information to perform our contract with you; we use limited security records, reports and block lists to protect the Service, based on our legitimate interests; where consent is required (for example, push notifications, or optional analytics where the law requires consent), we process that data only with your consent, which you can withdraw at any time; and we keep records where the law requires us to.
5. Who receives your data
We use the following service providers to host, run and support the Service. We may change providers over time and will update this list.
| Recipient | What they receive |
|---|---|
| Railway (hosting, database, file storage) | Everything the Service stores: accounts, sign-in tokens, content and photos, loan and social relationships, invitations, reports, block lists, push device tokens, and server request logs with IP addresses. |
| PostHog (analytics) | Your LendLoop user ID, cookie or device identifiers, usage events, platform and app build, app install and open events, error messages, and IP address (from which they derive approximate location). We do not send them your name, email address, item titles or the names of the people you lend to. |
| Resend (email delivery) | Recipient email addresses and message contents, including names, item and loan details, invitation links, account-deletion notices, content reports sent to our moderators, and Contact us messages sent to our support inbox. |
| Apple | Sign in with Apple requests and token revocation when you delete your account; for iOS push notifications, your device token and the notification contents (for example, an item title and the name of the other person). |
| Google sign-in requests; the text you enter in product search (Google Programmable Search); for Android push notifications (Firebase Cloud Messaging), the Firebase installation ID and device token, device and app details, and the notification contents (for example, an item title, the name of the other person and the screen the notification opens). |
Google and Apple also process sign-in data under their own privacy policies. We also share personal data:
- With other users, as described in section 6.
- Business transfers: in connection with a merger, acquisition, financing, sale of assets or similar transaction, or in preparation for one.
- Legal and safety: when we believe it is required by law or necessary to protect the rights, property or safety of LendLoop, our users or others.
- With your consent or at your direction.
We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined by California law.
6. What other users can see
LendLoop is a social service, so some of what you create is visible to other people:
- People you lend to or borrow from can see the item, the loan details, and your name and profile photo.
- Anyone holding an active share link can view its invitation details (the item, the lender's name and photo, and the loan terms).
- Your lending activity is visible to friends by default. Friends are people who have completed a loan with you. You can make activity public, which means anyone can see it, including people without an account, or private. You can change your default in Profile → Privacy.
- Crew members can see items you add to that crew and your membership in it.
- If you block someone, you no longer see each other's activity or comments.
Other users can copy or share what they can see, and we are not responsible for what they do with it.
7. Retention and deletion
We keep your account and content while your account is active. You can delete your account in the app under Profile → Data & Account. Deletion is scheduled 30 days after your request; during that grace period your push notification registrations are removed from our servers and you can cancel the request. After the grace period we delete your account, items, photos and other content, revoke Sign in with Apple, and email you to confirm that deletion is complete. Records Google keeps about an Android app installation (such as its Firebase installation ID) follow Google's own retention.
- Loans with other users: another user's own records of a loan with you may keep the details they entered. Crews you created that have other members are transferred to another member.
- Reports and block lists: kept while needed to handle the report and protect the Service, and deleted with your account.
- Contact us messages: kept while needed to answer you, and deleted with your account.
- Server request logs: kept by our hosting provider for a limited period, generally no more than 30 days.
- Emails: our email provider keeps delivery records for a limited period.
- Email delivery and suppression: we keep a suppression list of addresses that bounced, complained or unsubscribed so we stop sending email they should not receive, and keep delivery-problem records for 90 days.
- Analytics: events are tied to your user ID, not your name or email, and are kept under our analytics providers' retention settings.
- Backups: copies may remain in database backups until they expire on our hosting provider's backup schedule.
We may keep specific records for longer where we need them to comply with a legal obligation, resolve a dispute, or address abuse.
8. Your choices and rights
You can edit your profile and content in the app, change who can see your activity, block users, manage notifications, and delete your account. Depending on where you live, you may also have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To make a request, email hello@trip.fish, preferably from the address on your account. If you signed in with Apple using a private relay address, or no longer have access to your account email, tell us and we will verify your identity another way. An authorized agent may make a request for you with your written permission. We will not discriminate against you for exercising these rights.
You can turn off push notifications in your device settings, and limit cookies and similar technologies through your browser settings.
9. Children's privacy
LendLoop is only for people 18 and older, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account or has given us personal data, contact hello@trip.fish and we will close the account and delete the data.
10. Where we process data
LendLoop is a US-based service offered in the United States. We and our service providers store and process data in the United States and, for some providers (such as Apple and Google for push notifications), in other countries where they operate. Where the law requires safeguards for transfers of personal data, we use them, and you can contact us for information about them.
11. Security
We use reasonable measures designed to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee the security of your data.
12. Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above and, where required by law, let you know about material changes.
13. Contact
TripFish, LLC, 205 S 1st St, Brooklyn, New York 11211-4344, United States · hello@trip.fish.