Privacy Policy

This Privacy Policy explains how Lotra collects, uses, shares, retains, and deletes personal data when you use the Lotra app and lotra.app, including accounts, groups, Live Location, messaging, SOS, safety alerts, and paid plans.

Who we are

Lotra is developed and operated by Tal Novik, based in Israel (“Lotra”, “we”, “us”). We are responsible for the personal data described in this policy. You can reach us at support@lotra.app.

Data we collect

Account data. Your email address, display name, Firebase user ID, sign-in method, and account deletion request metadata. If you sign in with Apple or Google, we receive the name and email address that provider shares with us, which may be an Apple private relay address if you choose to hide your email.

Profile photo. If you choose one, the photo you select from your photo library is stored and shown to members of your groups and chats. Photo library access is used only to pick this photo.

Groups and preferences. Group names, invite code metadata, memberships, roles, group settings, language and unit preferences, notification preferences, remembered SOS targets, and tutorial progress. Onboarding preferences may include your intended use, optional referral source, plan interest, and whether you created, joined, or skipped setting up a group.

Location. When Live Location is enabled, Lotra collects precise location coordinates, accuracy, heading, timestamps, and sharing status so active group members can see your current or last known location. Background location is used only after you grant the device permission and enable Live Location. We use location to calculate group distances for safety alerts, and when you request a walking route, the start and end points are sent to Google to calculate it.

Battery status. While Live Location is enabled, Lotra shares your battery level and charging state with your active group members so they can see when your phone may be about to run out and receive low-battery alerts.

Messages, SOS, and activity. Messages you send, chat participation and unread metadata, group activity, SOS events, safety alert events, and notification records.

Device and security data. A random installation ID, an active session ID, platform, general device model, and app version, used to keep your account active on one device at a time; Expo push tokens for notifications; and app integrity checks from Apple (DeviceCheck/App Attest) and Google (Play Integrity) through Firebase App Check, which confirm requests come from the genuine Lotra app.

Purchases. Your plan, store, product, purchase, renewal, expiry, refund, and Trip Pass status, the groups you sponsor, and hashed store transaction identifiers. Apple and Google process payment; Lotra never receives card or bank details.

Diagnostics. Crash reports, diagnostic logs, sanitized map telemetry, app version, build and platform tags, error details, and paywall and purchase outcome events. Sentry is configured not to send default personal information, screenshots, view hierarchy, automatic network breadcrumbs, or session replay.

Data we do not collect

Lotra does not collect contacts, microphone recordings, photos or videos from the camera, or advertising identifiers, and does not track you across other companies’ apps or websites. Camera access is used only to scan group invitation QR codes. We do not sell personal data.

How we use data

We use data to create and secure your account, keep it active on one device, show your profile to your groups, manage groups and roles, share Live Location and battery status with active group members when enabled, send SOS, safety, battery, and chat notifications, deliver messages, calculate walking routes, verify purchases and apply plan limits, process account deletion and password reset requests, prevent abuse and fraud, troubleshoot errors, and improve reliability. Onboarding preferences help us personalize setup and understand product needs; they are not shown to other users.

Legal bases

Where data protection laws such as the GDPR require a legal basis, we rely on: performing our contract with you to provide the features you use; your consent for Live Location, background location, notifications, camera, and photo library access, which you can withdraw at any time in the app or your device settings; our legitimate interests in keeping Lotra secure, reliable, and free of abuse and in understanding how the app is used; and compliance with legal obligations.

How data is shared

With your groups. Active members of a group can see your display name, profile photo, role, Live Location, last update time, battery status, SOS alerts, messages in that group, and the group’s current plan. Direct messages are visible to the people in that chat.

With service providers that process data on our behalf: Google (Firebase and Google Cloud for authentication, database, functions, hosting, storage, and App Check; Google Maps and Directions for maps and routes; Play Integrity); Apple (Sign in with Apple, App Attest/DeviceCheck, and push delivery); Expo for delivering push notifications; RevenueCat for verifying store purchases and managing subscriptions and Trip Passes; Sentry for crash and error diagnostics; and Resend for account deletion and password reset emails. Apple and Google also process in-app purchases under their own terms and privacy policies.

For legal reasons. We may disclose data if required by law or to protect the safety, rights, or property of users, Lotra, or others. If Lotra is transferred to a new owner, data may be transferred as part of that transaction under this policy.

International transfers

Lotra’s database is hosted by Google Cloud in the European Union (Belgium). Backend functions run in the United States, and our service providers may process data in the United States and other countries. Where required, these transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses included in our providers’ data processing terms.

Location controls

Live Location is optional and can be paused from Settings. When it is paused, the app stops sharing new coordinates and battery status and group members can no longer receive new updates from you. You can also change location, notification, camera, and photo permissions in your device settings.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. You can edit your name and photo and delete your account in the app. For other requests, email support@lotra.app from the address on your account; we respond within 30 days and may need to verify your identity. You can also complain to your local data protection authority, such as Israel’s Privacy Protection Authority or a supervisory authority in the EU or UK.

Children

Lotra is not directed to children under 13 and they may not use it. Users aged 13 to 15 may use Lotra only with the consent of a parent or guardian. If we learn that we hold data from a child without the required consent, we delete it. Parents or guardians can contact support@lotra.app.

Account deletion

You can delete your account in the app from Settings > Account > Delete Account, or use the public deletion page if you no longer have the app installed. The public page is available at /delete-account.

Account deletion removes or anonymizes your account, profile, profile photo, public profile, group memberships, live location records, notification data, push tokens, device session, billing state, and user-attributed SOS references where applicable. We also ask RevenueCat to delete its customer record linked to your account. Groups you own are transferred to another active member or deleted if no other active member exists.

Deleting your account does not cancel a Premium subscription. Apple or Google keeps billing it until you cancel it in your store account’s subscription settings.

Messages sent by a deleted account are replaced with the tombstone text "Message deleted" and shown as coming from "Deleted user" so remaining chat participants keep conversation continuity without retaining the deleted account's message text or identity.

Retention

We retain data while your account is active and as needed to provide the app. After deletion, some limited records may be retained only where required for security, fraud prevention, operational logs, legal compliance, or to prove that a deletion request was processed.

Data category	Retention default
Account, profile, photo, group membership, and location data	Deleted on account deletion where applicable.
Messages and group activity	Kept while the chat or group exists so members keep their history; removed when the group is deleted.
Deleted-user messages	Sender is anonymized and message text is replaced with "Message deleted".
External deletion requests	Unverified, expired, no-account, rate-limited, and failed records are retained up to 30 days. Processed scrubbed audit records are retained up to 90 days.
SOS precise location	Stripped after 24 hours; non-location SOS metadata is retained up to 30 days after resolution.
Safety alert events and in-app notifications	Retained up to 90 days.
Walking route usage counts	Retained up to 7 days.
Password reset rate-limit records	Retained up to 48 hours.
Paywall and purchase outcome events	Retained up to 90 days.
Store purchase notifications	Retained up to 180 days.
Purchase and entitlement state	Retained as needed for access, restores, refunds, duplicate-claim prevention, accounting, and store obligations. Lotra-linked state is deleted on account deletion where permitted; Apple, Google, and RevenueCat may keep transaction records as their own obligations require.
Device session	Only the current session is kept; it is replaced when you move to a new device and deleted on sign-out or account deletion.
Push tokens	Deleted on sign-out, account deletion, invalid-token detection, or after 180 days without refresh.
Operational logs and diagnostics	Cloud Logging default logs target 30 days or less; required Google Cloud audit logs may be retained by Google Cloud for 400 days. Sentry retention follows the active Sentry plan.

Security

Data is transmitted using encrypted connections. Access to app data is restricted through Firebase Authentication, Firestore Security Rules, Firebase App Check, a single active device session, and trusted backend Cloud Functions for sensitive actions such as purchases, account deletion, and group administration. No system is perfectly secure, but we work to protect your data.

Changes to this policy

We may update this policy as Lotra changes. We will update the effective date above and, for material changes, notify you in the app or by email before they take effect.

Contact

For privacy or support questions, or to exercise your rights, contact support@lotra.app.