Privacy policy

Last updated 24 October 2026

loophole is a community map of bathroom codes. This page explains what we collect, why, and what you can do about it. In short: you can look up codes without an account, and if you sign in we keep only what we need to run the app. We don’t sell your data and we don’t show ads.

loophole (“we”, “us”) is the controller of your personal data under the UK GDPR. You can reach us at james.s.capel+loophole@gmail.com.

Without an account

You can browse the map, search and view codes without signing in. To do that:

Location. If you allow it, your browser gives the app your location so it can centre the map and sort stores by distance. The map area or search point is sent to our server to find nearby stores. We don’t store your location, and you can say no and pan the map by hand.
On your device. We save the last map position in your browser’s local storage so the map opens where you left it, and briefly save an unsent code in session storage if the page has to reload. This never leaves your device. If you close the welcome card, a cookie remembers that so it stays closed.
IP address. We use it to rate-limit requests and stop abuse. Rate-limit records hold a key derived from your IP address and a request count, and are kept for a short time. Our host also keeps standard request logs.

When you sign in

You sign in with Google (or Apple, where offered). We don’t have passwords. We receive and store:

your name, email address and profile picture, and your account id with that provider;
the sign-in tokens the provider returns. We only ask for your basic profile and don’t use these tokens to access anything else in your account;
a session record (a session token, when it expires, and the IP address and browser that signed in), so you stay signed in. This is held in a cookie that is strictly necessary for signing in; we use no advertising or analytics cookies.

Google user data. We use the information Google shares with us only to create your account, sign you in and show your name and picture to you in the app. We don’t share it with anyone, use it for advertising, or use it to train AI models. loophole’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What you add

Codes you share (the code, access type, tags, any note, and when you added it) are public. They are shown on the map without your name. We keep a link to your account so you can see your codes, and to stop abuse.
Votes (“Worked” / “Didn’t work”) are stored against your account. Only the totals are public.

Please don’t put personal information about yourself or anyone else in a note.

Why we use it (legal basis)

To provide the app you signed up for: your account, sessions, codes and votes (performance of a contract).
To keep the service secure and the codes trustworthy: rate limits, logs and abuse prevention (our legitimate interests).
Location, only when you allow it in your browser (consent, which you can withdraw at any time).

Who else processes it

We use a few providers to run the app. They process data on our behalf, under their own terms:

Vercel hosts the app (servers in London) and keeps request logs.
Neon hosts our database (London).
Google and Apple handle sign-in when you choose them.
OpenFreeMap serves the map tiles. Your browser loads them directly, so OpenFreeMap sees your IP address and the map area you view.

Some of these companies are based in the US and may process data there, under safeguards such as the UK–US data bridge or standard contractual clauses. Store data comes from OpenStreetMap and contains no information about you.

How long we keep it

Your account, votes and sign-in records: until you delete your account.
Sessions: until they expire or you sign out.
Rate-limit records and host logs: a short period, typically days to weeks.
Codes: when you delete your account, codes you shared stay on the map (other people rely on them) but are no longer linked to you. Ask us if you want them removed too.

Your rights

You can ask us for a copy of your data, to correct it, to delete it (including your whole account), to restrict or object to how we use it, or to receive it in a portable format. Email james.s.capel+loophole@gmail.com from the address on your account and we’ll reply within one month. You can also revoke loophole’s access from your Google account settings.

If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk.

Children

loophole isn’t meant for children under 13, and we don’t knowingly collect their data.

Changes

If we change this policy we’ll update the date at the top, and tell signed-in users in the app about any significant change. See also our terms of service.