Privacy Policy

Last updated: September 5, 2026

1. Introduction

Loot (“we,” “our,” or “us”) is a creator platform operated by Nozomio Labs that pays creators for short-form videos and ad assets promoting brands such as Folk. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use goloot.app.

By using Loot, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Personal information

Name and email address (via Clerk authentication, including Google sign-in)
Country of residence and date of birth (to confirm you are 18+)
TikTok and Instagram handles
Contact details you provide (Telegram or WhatsApp)
Payout information (processed via Whop)
Your invite code and the creators who join through your invite link

2.2 Connected social accounts

You can link a social account either by entering its handle and placing a one-time verification code in the account bio, or by connecting the account through Instagram (Meta) or TikTok login. When you connect an account we receive an access token, which we store encrypted and use only for the purposes below. The permissions we request are:

Instagram: basic profile information and post insights (the “instagram_business_basic” and “instagram_business_manage_insights” permissions)
TikTok: basic profile information, public account statistics, and your list of public videos (the “user.info.basic”, “user.info.profile”, “user.info.stats”, and “video.list” scopes)

We never request permission to post, comment, message, or manage your account, and we never post on your behalf. You can disconnect an account at any time from Settings, which deletes the stored token.

2.3 Content and submission data

Video assets you upload for Ads Lab quests
Links to your published TikTok and Instagram posts
Public profile data of the social accounts you link (handle, avatar, bio, follower and video counts, recent video statistics), used to confirm ownership and to determine your verification status
Public performance metrics of those posts (views, likes, comments, captions), collected on a recurring schedule to calculate payouts
For Ads Lab assets, the advertising spend a brand records on your asset, used to unlock spend bonuses
Submission status, review notes, and earnings history
Messages you send to Loot Support and to brands inside the app

2.4 Automatically collected information

Device and browser information
IP address and approximate location
Usage analytics and interaction with the platform (via PostHog)
Cookies and similar technologies required for authentication

3. How We Use Your Information

Provide, operate, and maintain the platform
Review video submissions and verify program requirements
Track the public performance of your posted videos and calculate earnings
Process payouts through our payment partner
Credit invite rewards when a friend joins through your link and finishes setting up their account
Send transactional emails and in-app notifications about reviews, verification status, earnings, and payouts
Answer your support messages, including through an AI assistant (see section 6)
Verify identity and prevent fraud or abuse
Improve the product and comply with legal obligations

We do not sell your personal information and we do not send marketing email.

4. Information Sharing and Disclosure

4.1 Service providers

Clerk: authentication and identity management
Convex: database and backend functions
Cloudflare R2: private storage for uploaded video assets
Whop: payout processing and identity checks
Meta (Instagram) and TikTok: account connection through their login services
ScrapeCreators: retrieval of public post metrics
Resend: transactional email delivery
PostHog: product analytics
Vercel: hosting, content delivery, and routing of AI requests for the support assistant

4.2 Within the program

The Loot review team and the brand you create for see your submissions, linked handles, and performance metrics in order to review content and administer payouts. Brands that run your Ads Lab asset receive the video file and your display name.

4.3 Invite links

Anyone who opens your invite link can see your display name and avatar. Your email address and earnings are never shown.

4.4 Legal requirements

We may disclose information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Social Media Data

When you submit links to your TikTok or Instagram posts, we collect publicly available information about those posts (views, likes, comments, captions, and the video itself) to confirm the post is from your linked account, review it against the quest brief, and calculate payouts. When you connect an account, we additionally read your public profile and public video list through the platform’s official API. We do not access your private messages, analytics dashboards beyond the permissions listed above, or any non-public content, and we never post on your behalf.

If you remove Loot from your Instagram or TikTok connected apps, the platform notifies us and we delete the stored token. Instagram data deletion requests sent by Meta are honored automatically.

6. AI Support Assistant

Messages you send to Loot Support are first answered by an AI assistant. To answer, it may read your account details, submissions, earnings, and payout status. Your message and that context are sent to the model provider for processing and are not used to train their models. The assistant cannot move money or change your account without a human reviewer. You can ask for a human at any time.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Submission and earnings records may be retained for accounting and audit purposes.

When you delete your account from Settings, we remove your name, avatar, and linked social accounts and mark the account closed. Payout and earnings records are kept as required for accounting and fraud prevention. To request full erasure of remaining personal data, contact us at the address below.

8. Data Security

We use appropriate technical and organizational measures, including encryption in transit and at rest, encrypted storage of social access tokens, a private storage bucket for uploaded videos (accessed only through short-lived signed links), and secure authentication through Clerk. No method of transmission or storage is 100% secure.

9. Your Rights

Depending on your location, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at the address below. We respond within 30 days.

10. Age Requirement

Loot is not intended for anyone under 18. We do not knowingly collect personal information from minors. If you believe we have collected information from someone under 18, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the “Last updated” date. Material changes are announced in the app.

12. Contact Us

Nozomio Labs · Email: loot@nozomio.com, or message Loot Support inside the app.