LootFlow records the weekly drops you get in CS2 and works out the return against the cost of Prime. This policy states plainly which data it handles, why, who it is shared with, and what you can demand.
Who is responsible for your data
Controller: KeepOK.
Contact for anything privacy related: miguel@nspx.dev.
Data subject requests are answered within 15 days, as Brazilian data protection law requires.
What is handled, and on what legal basis
Guest mode — accounts, drops, goals and collection stay on the device itself (the browser `localStorage`, or the app's own local storage). A summary is sent to Apple's iCloud even without signing in — balance, received, invested, ROI, this week's drops, the name and value of the last item, currency and language, to power the home-screen widget and the Apple Watch. This stays inside your own iCloud account: it is not a server of ours, and we do not read its contents. To turn it off, it is your iCloud account that decides: Settings → your name → iCloud → apps using iCloud → LootFlow. Basis: performing what you asked the app to do.
Google sign-in — Google hands us your name, e-mail and profile picture, used only to identify your account. Basis: consent, given when you choose to sign in.
Sign in with Apple — Apple hands us an identifier and, if you allow it, your name and e-mail. If you choose to hide your e-mail, what reaches us is a relay address from Apple itself and your real one never appears here. Basis: consent, given when you choose to sign in with Apple.
Cloud sync — while signed in, your game data is written to Firestore so you can open it on another device. To turn it off: on the website, under Settings → Privacy; in the app, by signing out or using guest mode. Basis: consent.
Public profile and friends — turning on the public profile lets other people see what you chose to expose (nickname, picture, level, statistics). It starts off. Basis: consent.
WhatsApp reminders — the bot is down since the free hosting ended, so the app collects and stores no phone number at all. Any number that was saved has been deleted from the device and the cloud: the purpose ended, the data went with it. If the service returns, collection resumes only with your consent, and this text changes first.
Friend code — turning on the public profile gives you a code in the format `LF-XXXXXX` to share with anyone you choose. Whoever has your code can confirm it exists, only to send you a friend invite — the code alone reveals neither your name nor your e-mail, and the list of codes cannot be enumerated by anyone. Basis: consent, given when you turn on the public profile.
Who the data is shared with
No data is ever sold. These are every third party the app reaches:
Google (Firebase Auth and Firestore) — authentication and sync, when you sign in. Firestore runs in São Paulo; authentication goes through Google infrastructure outside Brazil.
Apple — three channels, all inside Apple's own infrastructure: (1) authentication, when you sign in with Apple; (2) the widget and Watch summary, written to iCloud (key-value storage) even without signing in — see the guest-mode item above; (3) on Vision Pro, your account session (identifier, name, e-mail and the token that keeps you signed in) is kept in iCloud Keychain, so the app opens already signed in on each of your devices without asking again. All three stay inside your iCloud account — we do not read them. To turn any of them off: Settings → your name → iCloud.
Item pictures — the app downloads no picture until you pick a source under Settings → Item pictures. Pick *Steam* and your device starts contacting Valve servers; pick *My own source* and it contacts the address you gave. Neither happens under the default, *No pictures*.
Steam Community Market — queried for item prices. In the app the query goes straight to Steam, with no intermediary. On the website it passes through a proxy hosted abroad, which receives the text you searched for. Either way, no account or identifier travels with it.
Public exchange rate API — queried to convert dollars to reais. None of your data is sent.
Google Fonts — the app typefaces load from Google servers.
International transfer
Part of the processing happens outside Brazil — Google authentication, the price proxy, whichever picture source you choose, and the typefaces.
On Google services this is covered by standard contractual clauses, with protection equivalent to what Brazilian law requires.
iCloud and iCloud Keychain are also operated by Apple with servers outside Brazil. The content stays encrypted inside your own iCloud account — it is not a server of ours, and it is the same mechanism Apple uses to sync Photos, Notes and Keychain across your devices.
In guest mode, with no iCloud account on the device and no price lookups, nothing leaves your device.
What the app does not do
LootFlow shows no advertising today and sells nothing.
It runs no audience analytics, builds no behavioural profile, and sells data to nobody.
If any of that changes, this policy is updated before the change ships, and the date at the top changes with it.
The source is open, so every claim above can be checked line by line.
How long data is kept
For as long as your account exists. You can delete it whenever you want, by category or all at once.
Deleting the account wipes both the cloud copy and the device copy.
Guest mode data disappears if you clear browser data — which is why exporting a backup in Settings is worth doing.
Your rights
See — everything is on screen, and the export gives you the raw content.
Correct — any record can be edited at any time.
Delete — in the app's Settings, under data and privacy: by category (drops, accounts, goals) or all at once.
Delete the account — in the app's Settings, under the danger zone: *Delete account* on the website and on Vision Pro, *Delete all data* in the iPhone app while signed in. It wipes both cloud and device.
Portability — on the site and in the iPhone app, under Settings → Export, as CSV, XLSX or JSON. The Vision Pro has no such screen yet; use either of the other two, which read the same account.
Withdraw consent — turn off sync, the public profile or the reminders whenever you like; none of it locks you out of the app.
To exercise any of these without touching the app, write to miguel@nspx.dev.
GDPR and CCPA
For anyone using LootFlow from the European Union or from California, the same rights above apply under a different name:
GDPR (EU) — right of access, rectification, erasure ("to be forgotten"), portability, restriction of processing and objection, and the right to withdraw consent at any time without affecting what was done before.
Legal basis, under the GDPR: art. 6(1)(a) — consent — for sign-in, sync, the public profile and the friend code; art. 6(1)(b) — performance of what you asked — for guest mode and the summary that powers the widget and the Watch.
CCPA/CPRA (California) — the right to know what data is collected, to obtain a copy, to delete it and to correct it.
We do not sell or share personal data for advertising purposes, so there is no "opt-out of sale" to exercise — there is no sale to opt out of.
Exercising any of these rights removes no functionality from the app: the worst case is falling back to guest mode.
Contact for both: miguel@nspx.dev.
Age
LootFlow is not directed at children and asks for no age, school or location.
If you are under 18, use it with the knowledge of whoever is responsible for you.
If we learn an account belongs to a child under 12 without a guardian consenting, it is deleted.