Earlier version, dated 28 October 2026. It was replaced on 28 October 2026. Read the current privacy policy.
Last updated: 28 October 2026
Loomavoy ("we", "us") is a trip-planning service operated by Norton Media Enterprise, LLC, a South Carolina limited liability company based in Myrtle Beach, South Carolina, USA. Contact: support@loomavoy.com.
| What | When | Why | Where it is kept |
|---|---|---|---|
| Trips: destination, dates, travellers, stops, planned times, notes, budget and preferences | While you plan | To show and save your plan | In your browser only (this device's local storage), unless you are signed in, when the trip is also saved to your account |
| Email address | When you create an account or sign in (password, passkey or email code) | To identify your account and open your trips on other devices | Your Loomavoy account |
| Password, if you set one | When you create an account or add a password | To sign you in | Your account, only as a one-way PBKDF2 hash; we can't read it |
| Passkeys, if you add one | When you add a passkey | To sign you in with your device | Your account (the public key only; your fingerprint or face never leaves your device) |
| 6-digit email codes | When you create an account or reset a password | To confirm you own the address | Stored hashed for up to 15 minutes; sent by our email provider, Resend |
| Nationality, if you choose to save it | Only if you save it | Hotel suppliers price some rates by the guest's nationality | Your account, or your browser if you tick "Set as my default" |
| Account details, if you choose to save them: name, date of birth, gender, accessibility needs, mobile number and contact email, home address, an emergency contact, TSA PreCheck (Known Traveler Number) and Redress numbers, passport (issuing country, number and expiry), seat and special-assistance preferences | Only when you save them on your Account page | To fill in booking forms faster and keep your travel details in one place | Your Loomavoy account. Date of birth, address, emergency contact and the passport, Known Traveler and Redress numbers are encrypted before they are stored, and the app only ever shows the last 4 characters of a document number again. Each can be removed at any time, and deleting your account removes them all. They are sent to a hotel, airline or partner only when you use them for a booking |
| Hotel booking: lead guest's first and last name, email and phone; the room, dates, guests and price. The billing country is checked against US sanctions and not stored | When you book a hotel | Our booking partner and the hotel need them to make and service the booking | The booking record (separate from your account) and the supplier |
| Flight booking (when flight booking opens): each traveller's name, date of birth, gender and nationality (and passport number and expiry if entered); the contact's name, email and phone; the flights and price | When you book a flight | Airlines require them to issue tickets | Sent to Nuitee and the airline. Loomavoy keeps the travellers' names, the contact details, the flights and the price with the booking record. It does not keep dates of birth or passport numbers |
| Payment card details | When you pay | To pay for the booking | Entered only in our booking partner's secure payment form. Loomavoy never receives or stores card numbers |
| Searches (destination, dates, guests, filters, airport text) | When you search | To get results from our data and booking partners | Sent to the partner that answers the search. Loomavoy keeps no search history; place and hotel-list results may be held in a short server cache (up to one hour) so repeated searches don't call the partner again |
| A one-way hashed key derived from your connection's address | On each search request | To keep usage within fair limits | Usage counters (provider, time window, count). The address itself is not stored by Loomavoy's service |
| Standard web server logs (IP address, time, page, browser) | Visiting the website | Security and operating the site | Our web host, under its standard log retention |
Things that stay on your device: the calendar file (.ics) is created in your browser when you download it, and the "Download your data" file is created there too. Nothing is sent to us when you make them.
We do not collect precise location, contacts or photos. We don't sell personal information or use it for targeted advertising. The app loads no advertising or analytics code today. If we add advertising later, we will update this policy before any ad code is loaded.
Activities and tickets: Loomavoy does not sell activities itself today; tours and tickets from Viator or Tiqets, and event tickets from Ticketmaster, are booked on their websites. If an activities supplier is added in Loomavoy, this section will name it before any booking details are shared with it.
Loomavoy is not directed to children. You must be at least 16 to create an account, and at least 18 to make a booking.
We will post changes here with a new date, and tell signed-in users about significant changes.
See also our booking terms and terms of use.