Security
Where data goes, how long it is kept, who processes it
This page summarises how LociArc handles data. The legally binding text is the Privacy policy.
Figure 04 · Data flow
Data flow when you save a link
- 01DeviceTokens in Keychain
- 02LociArc APITLS 1.2+, SSRF guard
- 03QueueSelf-hosted Redis
- 04WorkerExtract, summarise, vectorise
- 05Jina ReaderReceives the URL only
- 06Google Gemini APIArticle text for summarising
- 07PostgreSQL + pgvectorSelf-hosted
Encrypted in transit
Every connection uses TLS 1.2 or later, with HSTS.
Passwordless sign-in
A one-time email code that expires after 10 minutes, or sign in with Google or Apple.
Tokens stored securely
Kept in the iOS Keychain and Android encrypted storage, rotated on every refresh.
Full control
Export to JSON or Markdown. Delete your account and all its data from inside the app.
Commitments
- 01We do not sell, rent or trade personal data.
- 02No advertising SDKs, no advertising identifiers.
- 03Your content is not used to train models.
- 04No access to contacts, photo library, location, microphone or biometrics.
- 05Crash reports are sent to Sentry without IP or email.
Retention
- Saved items, collections, tagsUntil you delete them
- Sign-in OTP codes10 minutes
- Refresh tokens30 days
- Server logs30 days
- Crash reports90 days
log₁₀(t) · 10 min → 90 d → ∞
Sub-processors
| Provider | Data received | Region |
|---|---|---|
| Google Gemini API | Article text and URL for summaries and vectors | US |
| Jina AI Reader | Page URL for text extraction | Global |
| Sentry | Crash reports without identifying information | US / EU |
| PostHog | App usage events tied to account ID, no email or name | US / EU |
| PostgreSQL, Redis | Library data and queue payloads | Servers managed by LociArc |
Your rights
Export
Profile, Data section. JSON or Markdown.
Delete account
Profile, Danger zone. Revokes every session and unlinks Telegram.
Unlink Telegram
Send /unpair to the bot.
Other requests
Email hello@lociarc.com, answered within 30 days.
Coming soon
Get notified when LociArc arrives on the App Store and Google Play
One email on release day. No marketing, and your address is never shared.
