Loopeli for smartphone (on the App Store: “Loopeli”)

App for family members: video calls, messages and postcards to the tablet

Android (com.loopeli.carer), iOS (com.loopeli.app)

Loopeli for Tablets / Loopeli för surfplattor

App on the tablet used by the older person: video calls, messages, postcards and radio

Android (com.loopeli.elder), and an older iOS version that is still available but no longer updated

my.loopeli.se

Web service where family members create an account and manage their subscription, and where municipalities, care providers and their staff sign in

Web

loopeli.se

Our website

Web

Account: e-mail address, first and last name, display name, phone number and language. Your password is stored only as a hash (bcrypt) on the server. It is never stored on your phone.

You, when you register and sign in

To create and manage your account, sign you in and send service e-mails (e.g. e-mail confirmation, password reset and invitations)

Profile picture, if one is uploaded

You on my.loopeli.se, or another family member

Shown to your family and on the tablet

Subscription and payment: subscription status, trial end date, customer and subscription IDs at Stripe, the last four digits and brand of your card, and any B2B code. You enter your card number directly with Stripe. It never reaches Loopeli’s servers.

You and Stripe

To manage your subscription and payment

Passkey (iOS): the passkey’s public key, ID and technical data, and which e-mail address and device it belongs to. The private key is stored on your device and can be synced through iCloud Keychain or your password manager. Face ID and Touch ID never leave the device, and Loopeli never receives biometric data.

Your device

Password-free sign-in

Device and notifications: a device ID that the app calculates from manufacturer, model, model code and memory size (not the IMEI, serial number, Android ID or advertising ID). Also a push token from Firebase, on iOS a VoIP token from Apple that goes only to the call service Voximplant, and a technical call ID built from your user ID and device ID.

Automatic

To deliver notifications and calls to the right phone. An account can be signed in on one phone at a time. If you sign in on a new phone, the previous one is signed out.

Content you send: postcards (photo and text), text messages with answer options, the tablet user’s name and profile picture, and the volume you set for the tablet during a call. We also store when postcards and messages were delivered, seen and answered.

You

Loopeli’s core features

Video calls: microphone audio and camera video while the call is in progress. Also call events (e.g. answered, missed or declined), time, duration and participants. Your display name and profile picture are shown to the person you call.

Your phone and automatic

To make calls and show call history

Pairing code: the six-letter code that you type in, or scan as a QR code, to connect your account to the tablet. The camera image is interpreted only on your phone and is not sent anywhere.

You

To connect your phone to the tablet

Family: other family members in the same family see your name, e-mail address and profile picture. They can also change your display name and profile picture on my.loopeli.se. If you are invited, your e-mail address is stored in the invitation. A family administrator can remove other family members from the family. The removed member’s account is then deleted, together with the messages, postcards and call history linked to them.

The service, the person who invites you and other family members

To show and manage who belongs to the family

Technical data: crash reports and performance data sent to Sentry: a random installation ID, error messages, technical log lines and requested addresses (these can contain technical keys, identifiers and display names), device model, operating system, language, time zone, battery level, free storage, network type and app version. Sentry receives the phone’s IP address when data is sent, but the app asks Sentry not to store it. Each time the app starts, it checks for updates with Expo and sends a random installation ID, platform, version numbers and IP address, and, if the app crashed on the previous start, the error message. The app checks Google Play or the App Store for new versions of itself. It also fetches the tablet app’s latest version number from Google Play and the App Store so that it can show whether the tablet needs an update. On iOS, the app checks the internet connection against a Google server and sends only the IP address.

Automatic

To find and fix errors, update the app and show a message when there is no network

Tablet identity: a random ID, an access key and a pairing code created the first time the app starts

Automatic

To connect the tablet to the family and protect requests to our servers

Profile: name, profile picture and language

A family member, or Loopeli when giving support

To show who the tablet belongs to and who is calling

Video calls: microphone audio and camera video while the call is in progress. Video starts being sent a few seconds after the call has connected. In group calls that staff lead from my.loopeli.se, the person leading the call can mute and unmute the tablet’s microphone. Also call events (missed and declined calls) with time and participants, and the audio volume during calls.

The tablet and automatic

Calls with family members and staff, call history, and showing the volume to the caller

Messages and postcards: messages and postcards received, answers to messages (Yes, Ok or No) and when they were delivered and seen

Family members and staff send; the tablet user answers

To show messages and postcards and let the sender see the answer

Tablet status:
– battery level and charging, with timestamps
– manufacturer, model and the device name set on the tablet
– operating system and version, and whether the tablet supports mobile telephony
– app version, build number, when the app was last updated and whether an update is available
– network type, Wi-Fi signal strength and link speed (not the network name), and mobile network generation
– the connection to the call service
– which permissions are granted
– whether the app is pinned to the screen
– whether a screen lock is set (not the code itself)
– when the app started, went to sleep or to the background, and when the tablet was woken
– the last five screens shown in the app, with timestamps

The tablet, automatically. A short status is sent every five minutes. Charging changes, low battery and wake-ups are sent as they happen. A detailed status is sent when a family member, staff or Loopeli asks for it.

So that family members, staff and Loopeli can see that the tablet works and give support. When the battery reaches 25%, an e-mail alert is sent to the staff connected to the tablet.

Contacts: name, profile picture and technical IDs of the family members and staff connected to the tablet. The tablet receives more profile data from the server, including family members’ e-mail addresses, but stores only name, picture and ID.

The service

To show who can be called and who is calling

Notifications: push token and installation ID from Firebase, and a notification topic chosen by language

Automatic

To wake the tablet for calls and deliver messages, postcards and remote commands (e.g. a status request or an app restart)

Technical data: crash reports and performance data sent to Sentry: a random installation ID, error messages, technical log lines and requested addresses (these can contain technical keys, identifiers and contacts’ names), device model, operating system, language, time zone, battery level, free storage, network type and app version. Sentry receives the tablet’s IP address when data is sent, but the app asks Sentry not to store it. The app also checks for updates through Google Play.

Automatic

To find and fix errors and keep the app up to date

Staff account: e-mail address, display name, organisation, profile picture, password (stored as a hash), language and two-step verification setting. When the account is created, a temporary password is sent by e-mail. It is stored in readable form so that the organisation’s administrator and Loopeli can help you sign in the first time, and it is deleted when you choose your own password through the invitation link. If you change your password another way, the temporary password remains stored, but it can no longer be used to sign in.

The organisation or Loopeli creates the account, and you fill in the rest

Sign-in and administration

Two-step verification: six-digit one-time codes sent by e-mail and valid for five minutes

Automatic

Secure sign-in

Sign-in history: the time of each password sign-in

Automatic

Security, and sign-in reports to the organisation

Messages and calls with the tablets you are connected to: message text, answers and call events. Video calls in the browser use your computer’s camera and microphone. In group calls, the person leading the call can mute and unmute participants’ microphones. When the tablet user answers your message, you get an e-mail with the answer, the user’s name and up to 280 characters of your message.

You and the service

To keep in touch with the people you work with

Reports: the organisation and Loopeli can export call reports and sign-in reports. Call reports contain the staff member’s name and e-mail address, the tablet user’s name and ID, and the call type, date, time and duration.

The service

Follow-up for the organisation

Organisation account: the organisation’s e-mail address, name, password (hash) and language

Loopeli, when the organisation is set up

Administration

Invitations: the invitee’s e-mail address and link to the organisation

The person sending the invitation

To invite staff

Google tag (through Google Site Kit)

Visit statistics (Google Analytics)

Only if you consent. Google consent mode is set to denied by default.

Meta Pixel

Measures ads and makes it possible to show ads to visitors on Facebook and Instagram

Only if you consent to marketing. Loopeli and Meta are joint controllers for the collection and transfer of the data to Meta. Meta is responsible for its own further processing.

Microsoft Clarity

Statistics on how visitors use the pages, including clicks, scrolling and mouse movements (session recording)

Only if you consent to statistics

Google reCAPTCHA

Protects the forms against spam and automated submissions. Google then receives the IP address and information about the browser and how the page is used.

Always, to protect the forms (legitimate interest)

Giving family members access to Loopeli: account, connection to the tablet, calls, messages, postcards and family

Contract (Art. 6(1)(b))

Giving tablet users access to calls, messages, postcards and radio

Legitimate interest (Art. 6(1)(f)): letting the tablet user and the family keep in touch. This also applies when a municipality or care provider provides the service: the organisation buys Loopeli so that the user can keep in touch with the family.

Giving staff access to the service

Legitimate interest (Art. 6(1)(f)): giving the staff of organisations that use Loopeli access to the service the organisation has bought

Managing subscriptions and payments

Contract (Art. 6(1)(b))

Keeping accounting records

Legal obligation (Art. 6(1)(c)), Swedish Bookkeeping Act

Security: sign-in, one phone per account, two-step verification, sign-in history and technical logs

Legitimate interest (Art. 6(1)(f)): protecting accounts and the service

Operations, troubleshooting and support: crash reports, tablet status, battery alerts and updates

Legitimate interest (Art. 6(1)(f)): keeping the service working. For family members also contract (Art. 6(1)(b)).

Service e-mails: e-mail confirmation, passwords, invitations, one-time codes, message answers and battery alerts

Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f))

Statistics and marketing on loopeli.se (Google tag, Meta Pixel, Microsoft Clarity) and other non-essential cookies

Consent (Art. 6(1)(a))

Protecting the website’s forms against spam (Google reCAPTCHA)

Legitimate interest (Art. 6(1)(f)): protecting the forms against spam and misuse

Newsletter

Consent (Art. 6(1)(a)). You can unsubscribe at any time.

Answering demo requests from loopeli.se

Legitimate interest (Art. 6(1)(f)): answering your request and booking the meeting

Handling questions and requests about your rights

Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f))

Elastx

Runs the servers for the API and my.loopeli.se and stores technical logs

All data passing through our servers, and technical logs

Sweden

MongoDB (managed database service)

The service’s database

Accounts, profiles, messages, postcard text, call history, tablet status, etc.

EU/EEA or USA, see section 10

Google (Google Cloud Storage)

Image storage

Profile pictures and postcard pictures

EU/EEA or USA, see section 10

Google (Firebase Cloud Messaging and Firebase Installations)

Push notifications to phones and tablets

Push token and installation ID. The content of notifications: message text and answers, names, postcard text and image links, the sender’s profile including e-mail address, and remote commands.

EU/EEA and USA

Apple (Apple Push Notification service)

Delivering notifications to iPhones (through Firebase) and waking the app for incoming calls

Push and VoIP tokens, the content of notifications (e.g. message text, answers and names) and the caller’s name

USA

Voximplant

Video calls and call notifications

Audio and video during calls, user IDs, display names, profile picture links, push tokens, IP address and call events

USA and other countries, see section 10

Sentry

Crash reports and performance data from the apps

A random installation ID, error messages, technical log lines and requested addresses (these can contain technical keys, identifiers and display names), device model, operating system, language, time zone, battery level, storage, network type and app version. Sentry receives the IP address when data is sent, but the app asks Sentry not to store it.

USA

Expo (EAS Update)

Updates to Loopeli for smartphone

Random installation ID, platform, version numbers, IP address and, where relevant, the error message from a crash

USA

Mailjet

Service e-mails

E-mail address and name, confirmation, password and invitation links, temporary passwords, one-time codes, the tablet user’s name, message excerpts and battery alerts

EU/EEA

Stripe

Subscription payments and fraud prevention

E-mail address, card details, subscriptions and invoices, and the IP address and browser and device information from Stripe.js

EU/EEA and USA

Oderland Webbhotell AB

Runs the website loopeli.se

Visitors’ IP addresses and form data

Sweden

Newsletter service

Newsletter

E-mail address

EU/EEA or USA, see section 10

Accounts for family members, staff and organisations

As long as the account exists. Deleted on request, see section 12.

Messages and postcards

As long as the family exists, or until someone in the family deletes them on my.loopeli.se (Delete postcards, Delete messages).

Call history

The family’s call history is kept until someone in the family deletes it on my.loopeli.se (Delete call history) or the family is deleted. The call service’s technical call log (who called whom, when and for how long) is kept by the call service for a limited period according to its settings.

Image files (profile pictures and postcard pictures) in the storage service

Image files are deleted manually as part of the account deletion in section 12.

Tablet status

Only the latest report is kept. Each new report replaces the previous one.

Tablets registered but never connected to a family

Until the tablet is connected to a family or the registration is removed

Staff sign-in history

As long as needed for security and for reports to the organisation

One-time codes for two-step verification

Valid for 5 minutes. Expired codes can no longer be used.

Password reset links

Valid for 24 hours and removed once used

Temporary staff password

Until you choose your own password through the invitation link (see section 6)

Invitations (the invitee’s e-mail address)

Until the invitation is cancelled, the invitee is removed from the family or the account is deleted

Passkeys

Until you delete the passkey in the app or the account is deleted

Customer data at Stripe (e-mail address, payment method, subscription and invoices)

As long as the subscription or account exists. Invoices and other accounting records are kept for as long as the Bookkeeping Act requires.

Sign-in on the phone (family members)

Sign-in data is deleted from the phone when you sign out, and the server then removes the push token and device ID. Some settings (e.g. whether you have created a passkey) and the app’s image cache remain until the app is uninstalled or the system clears the cache. On Android, the app’s data can be included in the phone’s backup to your Google account if you use that feature.

Data on the tablet

See section 5

Browser storage on my.loopeli.se

Up to 30 days by default

Newsletter and demo requests from loopeli.se

See section 7

Accounting records

Until the end of the seventh year after the end of the calendar year in which the financial year ended (Swedish Bookkeeping Act, chapter 7, section 2)

Technical application logs

As long as needed for operation and security

Web server access logs (IP address)

As long as needed for operation and security

Crash reports at Sentry

A limited period, as set in Sentry

Database backups

Encrypted and stored in Google Cloud Storage in the EU; deleted when no longer needed

Call logs at Voximplant

A limited period, as set by Voximplant

Camera

Video calls, scanning the QR code when connecting to the tablet, and taking photos for postcards and for the tablet user’s profile picture

Microphone

Audio in calls

Photos (iOS: photo library; older Android: storage)

Choosing pictures for postcards and for the tablet user’s profile picture. On Android 13 and later the system photo picker is used, and the app gets only the pictures you choose.

Notifications

Calls, message answers and sign-out

Phone and calls (Android: phone numbers, phone state, manage own calls, call foreground service)

Android requires these for Loopeli calls to work with the phone’s calling system and keep running in the background. The app does not read your phone number, call log or contacts, and it places no regular phone calls. On older Android versions, the app can see whether a regular mobile call is in progress. That information stays on the phone.

Display over other apps (Android)

Showing incoming calls full screen, including on the lock screen

Wake screen, lock screen and vibration (Android)

Turning on the screen and vibrating for incoming calls

Bluetooth and audio settings

Routing call audio to the speaker, headphones or a Bluetooth headset

Face ID (iOS)

Passkey sign-in happens in the system’s own dialog. The app never receives biometric data.

Background modes and VoIP (iOS)

Receiving calls when the app is not open

Internet and network state

Talking to the service and showing when there is no network. The network name is not read.

Camera and microphone

Video calls

Phone and calls (phone numbers, place calls, phone state, manage own calls, call foreground service)

Calls through Android’s calling system. The app does not read phone numbers, the call log or contacts.

Bluetooth and audio settings

Call audio and volume

Display over other apps

Showing incoming calls, messages and postcards on top of other apps

Notifications

Notifications, and the notice shown while a call runs in the background

Exemption from battery optimisation

So that calls get through even while the tablet is idle

Start automatically when the tablet starts

Reopening the app after a restart or update

Keep awake and vibrate

Waking the tablet and vibrating for calls

Internet and network state

Talking to the service. Wi-Fi signal strength and link speed are reported in the status, but not the network name.

Screen pinning (kiosk mode)

The app pins itself to the screen so that the user does not leave it by mistake. The app also contains a device administration component but never asks to activate it. If a tablet has been set up with Loopeli as device owner, this is used only to keep the app pinned to the screen. Loopeli uses no functions to lock the device, change the screen-lock code or wipe the device.

Proximity sensor

Used during calls. The data stays on the tablet.