Last updated: 27 July 2026
Loxley is a collective boycott app. This policy describes exactly what the app collects, why, and how to get rid of it. It describes the app as it actually behaves, not as a general statement of intent.
Loxley does not ask for and does not collect your name, email address, phone number, password, date of birth, address, or payment details. There is no sign-up form, no public profile, and no password, because there is nothing to log in to.
You can look around without identifying yourself at all. Opening the app creates an anonymous session with a random identifier held in your device's keychain, and that is enough to read everything the app shows.
Joining a boycott or proposing one requires Sign in with Apple. This is asked for one reason: a member count that nobody can vouch for is worth nothing, and the count is the only number this product has. Signing in also means your membership survives reinstalling the app and follows you to your other devices.
When you sign in, Loxley receives **an opaque user identifier that Apple generates for Loxley alone**. It cannot be matched against you in any other app. Loxley requests no name and no email address, not even one of Apple's private relay addresses, and is therefore never sent either. That identifier is the only thing about you that Loxley holds.
Tied to that anonymous identifier:
Standard server logs, including IP addresses, are generated by the hosting provider as a normal part of serving requests and are retained on their default schedule. Loxley does not use them to build a profile of you.
Boycott pages show aggregate figures: total members, total signatures, total amount withheld, total units diverted, and per-day totals. Your individual entries are never shown to other users and are never attributed to you.
Boycott proposals you submit are published to other users if a moderator approves them. They appear without any author name. Do not put anything in a submission that you would not want published.
App Tracking Transparency
The app keeps a copy of the content it has loaded, plus any actions you took while offline, in its own private storage so that it opens instantly and does not lose your work on a bad connection. Deleting the app removes that copy.
App content and accounts are hosted on Supabase, which runs the database and the anonymous authentication. Data is transmitted over an encrypted (HTTPS) connection.
Loxley is not directed at children under 13 and does not knowingly collect information from them.
Open Profile > Delete Account. This immediately and permanently deletes your account and everything attached to it: your boycott membership, your logged days, your submissions, your reports, and your blocks. Aggregate boycott totals are recalculated without your contribution. This cannot be undone and does not require you to contact anyone.
Because Loxley holds no identifying information about you, it cannot look up "your" data if you write in: the anonymous identifier on your device is the only key to it. In-app deletion is therefore the reliable way to exercise erasure. If you have a question about this policy, contact the address below.
If this policy changes materially, the app will present the updated version before you continue using it.