Privacy Policy

Effective October 14, 2026

Loka is a memory practice project from Scivana. This policy explains local app use, optional cloud sync, this website, and optional Loka emails.

Using Loka locally

You can use Loka Studio and the mobile app without providing a name or email. Peg words, image variants, PAO cues, memories, practice results, and preferences are stored on the device. Local onboarding does not create a cloud account or subscribe you to emails.

Direct Wi-Fi sync

You can pair Studio and the mobile app on the same private Wi-Fi network without creating an account. A short-lived QR code identifies the computer’s HTTPS certificate and gives the paired phone its own saved credential. Library content and practice updates travel directly between the devices over that encrypted connection. Keep Studio open and the computer awake while syncing. You can forget paired phones or turn off Wi-Fi sync in Studio.

Choosing cloud sync

Creating a cloud account requires a name, verified email address, password, and agreement to the Terms and Privacy Policy. Signing in asks only for email and password. Cloud sync also requires a trusted account/device connection. Cloud sync uses an internet relay and works away from your shared Wi-Fi network. It is a separate option from direct Wi-Fi sync.

Supabase Auth handles password verification and password credential storage. Loka submits passwords over HTTPS and does not store them in the library, app preferences, or Cloudflare D1/R2. Resend delivers account confirmation, email-change confirmation, and password-reset emails through Supabase Auth. Registration requires email confirmation before cloud access. You can update your name, email, and password after signing in, using your current password to authorize changes. A replacement email stays pending until confirmed. Phones also sign in to the same account before cloud pairing.

Loka encrypts library content, images, audio, and practice events on the device before sending them to Cloudflare. Private Cloudflare R2 storage holds encrypted media and catalog files; Cloudflare D1 holds account and device records, encrypted-event indexes, and sync metadata. Account profile details, consent records, device names, platform, connection times, object sizes, and routing metadata are not part of the encrypted library payload.

Trusted device keys and recovery words protect access to the encrypted library. An email address and password alone cannot decrypt an existing library on an untrusted device. Network providers process IP addresses and request metadata needed to deliver and secure the service.

Optional AI and speech providers

Local models process content on the computer. If you choose an external provider for a supported feature, the app sends that feature's required content to that provider. Review the provider's privacy terms before using it for sensitive content. Studio must be available to generate replacement recordings with its selected voice; the phone can use its selected system voice while waiting.

Loka updates and marketing consent

The optional updates checkbox appears during registration and is separate from required legal consent. The account confirmation email also confirms your Loka updates choice when you selected it; leaving it unchecked does not subscribe you. Loka uses Resend to deliver these messages and, after confirmation, optional Loka product news and memory practice ideas. Only the dedicated Loka email subscription is updated when you choose Loka updates. Account-wide unsubscribe and suppression preferences are respected.

You can withdraw the Loka update choice using an unsubscribe link in an update. Account deletion removes cloud records and requests withdrawal from Loka updates; provider failures may need to be retried before deletion can finish. Essential sign-in and security messages are separate from optional marketing.

This website

This static website is hosted on Cloudflare Pages. It does not use advertising trackers, analytics scripts, third-party fonts, or a visitor account. Cloudflare processes requests to deliver and protect the site. The recall demonstration runs in your browser and does not transmit your answer.

Retention, export, and deletion

Local records remain until you remove them, clear the app's storage, or uninstall it. Cloud library records and account profile details are retained while the account is active. Studio offers an encrypted account export and a cloud-account deletion control. Deleting the cloud account does not delete the computer's local Studio library. Removing an image association does not immediately erase content-addressed bytes that may be shared with other associations or retained in your own exports and backups.

Consent records and confirmation tokens are used to process and document email choices. Security logs and operational records may be retained by service providers under their policies. Keep recovery words and exported archives private; Loka cannot reconstruct a lost encryption key for you.

Contact and changes

For a privacy question or request, contact the Loka project. Do not include private library content, recovery words, or account credentials in a public issue. Material policy changes will be published here with a new effective date.