Privacy policy

Effective 2026-10-14

What we keep, who can access it, and how you stay in control.

Lookover is operated by Webspin, LLC. This policy covers our website, mobile app and explanation service, including documents uploaded on our website or app or sent by email or text, questions and answers, the account page and family summaries. Our health data privacy notice provides additional information about health-related documents.

Health and financial information

The letters, bills and notices you send often contain financial details and sometimes health details: a medical bill, a benefits statement, an appointment letter. This section is the short form of our health data privacy notice, which is the full notice for that information and the one to read for your rights under Washington’s My Health My Data Act.

Your consent: before Lookover reads anything you send, you agree to the terms and to collection, and, in a separate box, consent to Lookover collecting and using health information to explain and keep track of it. A request by text or email asks you to reply YES and names our service providers.
What we use it for: to produce the explanation you asked for, answer your follow-up questions, keep your record, find dates, and deliver the summaries you chose. We do not sell it, use it for advertising, or use location to infer visits to healthcare facilities.
Who can see it: the people you choose to share with, which is a separate choice from sending; the service providers named in the notice and below; and authorized staff who can access explanations, processing records and support requests when needed to operate the service. The staff console does not provide access to original files or the text of documents and messages you send for explanation. See the human-access section below.
Texts from a number that is not on an account: an account cannot be started by text. Nothing sent from a number that is not on an account, or that has not yet replied YES to its invitation, is read: Lookover checks it only for STOP, HELP or START. We delete our copy straight away and keep only a one-way fingerprint of the number and a short delivery record for about 30 days, so we reply at most once a week; our text-message provider’s copy is deleted within about 30 days. A STOP from such a number is kept so that it keeps working.
Your choices: withdraw your consent in a household’s Data & privacy settings, reply STOP to any text to stop processing from that number, use People & sharing to stop sharing with anyone, and email privacy@lookoverit.com with “Health privacy request” to ask what we hold, to have it deleted, or to withdraw consent. Deadlines and appeals are in the notice.

We record your confirmation of U.S. residence and the confirmation date when required for registration or joining a household. This is your declaration of residence, not a citizenship check or a precise location record. Existing records without this confirmation are not assigned a country by inference.

Information we collect

Account and payment records: contact details, plan, subscription status, consent records and billing identifiers. Records of your acceptance of the terms and of your consents include the version, time and method, one-way fingerprints of your addresses and, depending on how you agreed, the wording you were shown and its checksum, the interface language and the software information your browser or the app reports. At checkout they also include your agreement to the automatic renewal and the wording of the payment provider’s terms checkbox. They do not include your IP address, and we do not use them as a device fingerprint. Stripe, Apple or Google collects payment details for purchases made through its checkout; we receive the information needed to manage your subscription, not your complete card number.
People on your account: names and contact details you or an account holder provide, invitations, confirmations, sharing preferences and access history.
What you send: photos, documents, email content and attachments, texts, follow-up questions and corrections. These may contain financial, health or other sensitive information about you or others. Photos can also carry information added by the camera, such as the time and place they were taken; the stored original may keep it, and Lookover does not use it.
What we produce: explanations, extracted names, amounts, dates and reference details, the people a document concerns, warning signs, reminders, summaries and account context used to interpret later submissions. These are automated inferences and can be wrong.
Support and technical records: help requests and replies, delivery status, processing records, security and access logs, and website request information such as IP address and browser details.
Phone calls: if you call the Lookover number, the calling number and the call, which may be recorded and transcribed, as described under service providers.
The Lookover app, if you install it: the name and type of each phone or tablet you sign in on (the name may be one you gave the device), an identifier the app creates for that installation, and, only if you turn notices on, the token your phone’s notification service issues. If you pick someone from your contacts when adding a person, the app reads only the entry you tap; it does not ask for access to your contacts. If you add a due date to your calendar, the app opens your phone’s own new-event screen with the document’s title and a link; Lookover does not read your calendar. The optional app lock uses your phone’s own Face ID, fingerprint or passcode check; Lookover never receives that data. Photos you take in the app can be saved as encrypted drafts until you send them. Drafts are scoped to your account and household and excluded from device backups. While you look at a draft, the app keeps readable working copies in its protected storage. Drafts and their copies are removed after successful submission or sign-out, or during cleanup after one day. Background uploads and opening originals also create temporary files in protected app storage; these are cleared after completion and during the next launch after an interruption. Notices contain a short generic sentence and never the contents of a document.
Diagnostics and optional app usage: when crash reporting is configured for the app or our servers, Sentry receives technical error reports and connection metadata; app reports also include the type of device and the operating-system and app versions. Reports from our servers and from the app are filtered to exclude document text, questions, email addresses and credentials. Help improve Lookover is off unless you turn it on in the app. When it is on, we collect limited interaction events, such as an upload starting or failing, linked to your account and household, and keep them for 180 days. Turning it off in the app’s Profile & security page stops collection and deletes the events already collected.
Apple or Google sign-in: if you choose one of these options, we receive the provider identifier and verified information it shares, and the name Apple shares the first time if your account has none. Apple may supply a private relay email address. If that email already belongs to a Lookover account, the two are linked only after you enter a code we email to that address. We keep an encrypted Apple token to revoke access when you remove that sign-in method or delete your account; a pending revocation token is retained until the provider confirms the request.
Preferences: your language; your own time zone, as your browser or the app reports it while you are signed in, which we use so that app notifications that can wait reach you between 8 am and 8 pm where you are, and to show dates about your account in your time; each household’s time zone (taken from your browser or phone when the household is created, or, if that is not available, from the time zone your browser or phone last reported, another of your households or your phone number’s area code), which sets the same hours for emails and texts to the whole household, such as weekly summaries and reminders; and your notice and summary choices. Your own time zone is removed when your account is deleted.

We receive information from you, people participating in your account, and providers that handle payments, messages and service infrastructure. We do not connect to your bank or continuously read your inbox. Only send information you have the right to share, and cover unnecessary identifiers before taking a photo.

How we use it

We process information to explain what you send, answer follow-up questions, keep your record, send reminders and authorized summaries, administer subscriptions, provide support, prevent abuse and comply with legal obligations. Corrections and saved context help improve explanations for your account. Explanations inform your decisions; Lookover does not make legally significant decisions about your eligibility for credit, insurance, employment or healthcare.

We do not sell personal information, use it for targeted advertising, or share it for other companies’ marketing. We do not use your documents or personal information to train general-purpose systems, including large language models, without a separate opt-in. Account-specific context and processing needed to answer you are different from training a general-purpose system.

Family sharing is a real privacy choice

Each sender chooses whether to share their documents, explanations and extracted details with each named person. Getting explanations and family sharing are separate choices. Manage these permissions in People & sharing in your Lookover account. A summary recipient must also accept their email invitation; if their address changes, the new address must accept again. The account holder can always see their own records. Get permission before inviting another adult; being related does not authorize you to consent for them.

Use People & sharing in your Lookover account to withdraw sharing permission for one person or everyone. New account views, summaries, alerts and exports will exclude your records for those people. Disconnecting one sending address stops new documents from it and ends the sharing of what it sent; those documents stay for the person who sent them. When a person leaves a household or is removed from it, the documents they sent there are deleted 30 days later. During those 30 days they can download them from Households in their account, and the documents come back if the person rejoins, though any sharing that ended when they left must be turned on again. Documents they shared stay for the people they shared them with unless the person chooses to delete them when leaving; a person removed by the manager does not make that choice. They can delete what they shared later from Households. Otherwise it stays while someone it was shared with can still see it, and no longer than the household exists. None of these actions recalls messages or copies already delivered. Contact us to request deletion or help with your rights.

Removing a summary recipient stops their future summaries and alerts. The unsubscribe link in a weekly summary, alert or reminder email stops that household’s summaries, alerts, reminders and invitations to that address, and the household cannot add the address back for them; only the person who unsubscribed can turn them on again, while signed in to their own account. The link in a daily round-up email turns off only the round-up. If an address marks a Lookover email as spam, we stop sending it summaries, alerts and reminders from every household.

Sharing and processing are separate. Replying STOP, or withdrawing your permission for Lookover to read what you send, does not change who you share with: documents you already shared stay visible to those people until you change that in People & sharing. Reminders and urgent alerts about a document go to each person who can see it, according to their own notice choices. Your follow-up questions and Lookover’s answers are visible only to you. Billing notices go to the person who pays for a subscription; notices about a failed payment or an ended subscription also go to the person managing the household.

Household comments are shared notes on a document. Anyone with current permission to view that document can read its comments. They are separate from private questions to Lookover and are not used when Lookover answers questions. You can delete your own comments. Comments are removed with their document. When their author leaves the household or deletes their account, their comments stay and are shown as from a former member; delete them first if you do not want that, or contact us. Removing access prevents future viewing but cannot recall copies someone has already made.

Automated reading and authorized human access

Explanations, follow-up replies and translations are produced automatically by software, without a person reviewing them first. If you ask who explains your documents, Lookover tells you so and how to reach a person. The staff console does not provide access to original files, the text of documents and messages you send for explanation or archived processing inputs and outputs. Authorized staff can access explanations, extracted details and processing records, including the address a document came from, through restricted tools for necessary service operations; those content views are logged. Staff can read and answer requests you send to support, messages asking for a person, and corrections you send with Report a mistake, and can correct a saved explanation in response. Staff can also read a privacy request whose email address has not yet been confirmed, but cannot reply to it until it is confirmed. Staff can ask the service to read a document again from its retained original without opening the original. Infrastructure-level access may still be possible for authorized security, recovery or legal operations, and service providers have their own access controls. Automated reading does not mean all human access is technically impossible.

Service providers and other disclosures

Providers receive information needed for their role, and may retain limited records under their own terms and legal obligations. These are the providers that receive personal information:

Hosting and email: Amazon Web Services supplies infrastructure, storage and email delivery, in its US East (N. Virginia) region. Email sent to the addresses we publish, such as our support, legal and privacy addresses, is forwarded to a mailbox operated by Webspin, LLC on Google Workspace; that mailbox also receives our internal service alerts, which identify accounts but not document content.
Document processing: Anthropic processes what you send to sort and screen it (including for signs of a scam), read and explain it, extract the names, dates, amounts and reference details we save, answer your follow-up questions, understand what a message you send is asking, write the opening of your weekly summaries, check submissions against our content rules, and translate messages and saved explanations into the language you choose. Lookover calls Anthropic directly. We use no other processing provider for customer content; before we use another, we will name it here first and request settings that disallow data collection for training. Those settings are not a guarantee of zero retention or zero human access.
Text messages: Twilio, our messaging provider, and participating carriers process numbers, message content, attachments and delivery records as needed for messaging. Before we text a sign-in or confirmation code to a number, and before a number is added so that Lookover can text it a request to reply YES or an invitation, we ask Twilio what type of line it is, because Lookover texts only mobile numbers. We keep that answer, under a one-way fingerprint of the number rather than the number itself, so we do not ask again, except that we ask again after about 90 days about a number that was not a mobile line, in case it has become one.
Phone calls: calls to the Lookover number reach an automated help line run by Retell over Twilio. It says at the start that the call may be recorded and transcribed. It does not read documents or access your account. These providers process the calling number and the call, including any recording and transcript, as needed to run the line. The call is transcribed while it happens; no recording or transcript is kept after the call, only its time, length and calling number.
App notices, updates and diagnostics: Apple and Google deliver app notices. A notice carries a short generic sentence and internal identifiers for the household and document, never their content. Expo (650 Industries) delivers updates to the Lookover app: each time the app starts, it sends Expo the app’s version and platform, an identifier for the installation and its network address, but no document or account content. Sentry receives the error reports described above.
Payments: Stripe handles checkout, payment methods, subscription billing and payment-related fraud screening for web purchases. Apple and Google manage purchases made through their respective app stores.

Our original-document retention setting does not control every provider’s separate retention. For example, Anthropic’s standard commercial API retention is generally up to 30 days, with exceptions for agreed terms, certain features, safety investigations and legal requirements. Provider settings and contractual terms determine the processing that applies.

We may also disclose information when legally required, to protect rights and security, or as part of a business transfer subject to applicable privacy commitments and required notices or consents. These purposes do not authorize selling text-message consent or using your documents for unrelated advertising.

Text-message permission and mobile information

Your permission to receive Lookover text messages is specific to Lookover. We do not sell, rent, transfer or share text-message opt-in data or consent with third parties or affiliates for their own use, including marketing or promotional purposes. The other sharing permissions in this policy exclude text-message opt-in data and consent; they do not grant another business permission to text you.

Messaging providers and carriers process information necessary to deliver, support and operate Lookover messages on our behalf. This does not give them permission to market to you or use your consent for another messaging program. Disclosures required by law remain subject to applicable law. See our text message terms for how to stop texts or request help.

We do not sell mobile numbers or share them for others’ marketing. Household managers can see the contact details and setup status needed to manage people in their household. That visibility does not transfer your permission to receive Lookover messages to anyone else. If the last three texts to a number fail permanently within 30 days, Lookover stops texting it. When the person who uses that number cannot be told by email, because the number has no Lookover sign-in with an email address or that account is being deleted, we email the person managing each household the number is connected to: the email gives the number and the household and says that texts to it could not be delivered and have stopped, so they can update it. It contains nothing the number sent. A STOP is your own choice and is not reported to the manager.

How long we keep information

Originals and temporary content: the default original-document retention is 30 days. The person managing a household can choose 7 days, removal after processing, or keeping originals until the person who sent them deletes them, the setting changes, or the household is closed. Archived processing inputs and outputs are kept for at most 30 days even when originals are kept longer. “Remove originals after processing” temporarily stores originals to process your request, then removes them and does not save new archived processing inputs and outputs. When Lookover recognizes what you send as an identity document, such as a driver’s license, passport or payment card, we delete the original and that reading’s processing archive right after reading it, whatever the retention setting. Recognition is automatic and can miss a document; anything it misses follows your retention setting, and archives from later questions about it follow the 30-day limit above. Existing originals are removed during the next cleanup. Failed processing and cleanup retries can delay removal.
Support: support requests sent by email or text are kept for between 7 and 30 days, following the original-document setting. Separate website support conversations expire after 30 days of inactivity, or 180 days for privacy requests. A request made without signing in must be confirmed from its email address; if it is not confirmed within 24 hours, the request and its contents are deleted. Website support is private to the requester and authorized support staff, not shared with the household. Deleting your account removes support conversations linked to it. Provider retention is separate.
Privacy-request log: for each privacy request we keep a minimal record of when it arrived, its type, whether the email asking to confirm it went out, whether and when it was confirmed, when it ended and how, with a one-way fingerprint of the requester’s email address or account. It contains nothing the request said. We keep it for 24 months after the request ends (or after it arrived, if it never ends), including when the request is never confirmed or the account is deleted, so that we can show how we handled privacy requests.
Your ongoing record: explanations, saved questions and answers, extracted document-specific reference details (such as addressees, service addresses, billing periods and charges), corrections, household comments, reminders and sharing records remain while the account is active so the service can provide context and summaries. Reference details are not a complete copy of a document. Household managers can separately turn off saved details across documents and saved dates and reminders; doing so removes those records but does not erase saved explanations, their reference details or conversations. Records tied to a document that is under review or a legal hold are removed when the hold ends.
When service ends: when a household is closed, or a subscription that began at checkout ends, deletion of the household’s content is scheduled 30 days later. A household that began on the free plan, or whose subscription ended through a refund its purchaser asked for, returns to the free plan instead and keeps its records. The cleanup process also requests supported provider deletions and retries failures. This is not a promise that every copy on every system disappears at exactly 30 days.
Limited exceptions: database backups are kept for up to 7 days, and copies taken before a system update for up to 35 days; deleted information can remain in them until they expire. If we ever have to restore the database from one of them, before the service uses it again we re-apply the deletions, withdrawals of permission, ended sharing, opt-outs such as STOP and unsubscribes, and the other privacy choices recorded after it was taken, and sign everyone out. Only the privacy changes made in about the last minute before a loss of the database itself could be lost with it. Operational logs are kept for 14 days. We keep billing, security, consent, audit, deletion and processing-cost records (with no document content), and information necessary for a legal obligation or dispute, for as long as that purpose requires. These records are restricted and are not a continuing document archive. Records of who a message was delivered to, including the address, are kept with the household’s record while it exists; messages sent outside a household, such as sign-in codes, are deleted about 30 days after they are sent, once their delivery outcome is settled. The addresses on messages we receive are cleared within about two days of receipt, leaving a one-way fingerprint, except for items under review or a legal hold. An incoming email is held briefly with storage encryption before it is processed and deleted. After an account is deleted we keep one-way fingerprints of its addresses with acceptance, consent, opt-out, spam complaint and bounce records, and the line type of phone numbers we checked, so that consent evidence stays available and an opt-out keeps working. To keep the free start to one per person, we also keep a one-way fingerprint of each email address and phone number that has used it, even after the account is deleted. If you take part in referrals, we keep referral and payment evidence for up to seven years after its last financial activity, as the referral terms describe.

A verified request to exercise a legal deletion right is handled under the applicable legal deadline, separately from routine cancellation cleanup. Copies received by family members or retained by your own email provider or carrier are outside our direct control.

Safety checks and restricted submissions

Automated checks may flag content that our terms do not accept. A flagged submission may be held without an explanation while we review the decision. We record the sending person and address, household, the item or message concerned, date, channel, category, confidence, the automated and staff assessments and the outcome; for a held question or message we also keep its text, encrypted, until the review ends. These records last while the household exists. They are automated assessments, not findings that a person has broken the law. Before a refusal counts against a sending address, either a second automated check of the same submission for the same rule, or a staff reviewer, must agree; the second check has its own processing record and archive, kept as described above. If the second check does not agree or cannot be completed, or if the automated reading declines the submission, the item is held for staff review and does not count. While an item is held or refused, only its sender sees that it exists, Lookover sends no reminders for it, and a question about it gets a short status reply instead of an answer. You can contact support to challenge a mistake. Three refusals within 30 days pause a sending address.

For a refused submission, we remove our original file and submitted text and clear the associated processing archive, with retries if storage is temporarily unavailable. We retain limited safety and operational records so we can review mistakes and prevent repeated misuse. An ordinary review hold may temporarily delay the normal original-storage cleanup. Neither a hold nor a refusal grants other household members access to the submission. The staff console shows safety metadata, not the original or submitted text.

A legal preservation requirement takes priority over routine deletion, including requests to remove originals or close an account. Suspected child sexual abuse material is blocked and placed under a restricted legal hold for assessment and any required reporting. Relevant content and associated records may be retained and disclosed to the appropriate authorities as required or permitted by law. Such material is unavailable through ordinary customer and staff document viewers. Authorized legal handling is separate from routine support, and does not use the content to improve your explanations.

Security, cookies and location

Originals, document text, explanations and questions are encrypted with a key for each household, and administrative access is restricted. So are what a document is, who sent it, what a date is for and the reference details we save. Contact addresses, the names of households and people on an account, and the fields used to sort and date records (such as the type of sender, whether action is needed, the amount, the due date and the safety verdict) are protected by our storage encryption instead. No system is completely secure. Ordinary email and SMS are not end-to-end encrypted, and messages may be visible on shared devices or lock screens.

The app keeps your sign-in credential in the phone’s secure storage. Photos and messages you start in the app and have not sent yet are held on the phone as encrypted drafts; something shared into Lookover from another app waits in the app’s protected storage. Both are removed after they are sent, at sign-out, or during cleanup after a day; opening an original creates a temporary file in protected app storage that is cleared afterwards. Explanations are not kept on the phone for offline reading. The app carries no advertising software and no advertising identifier. It carries the crash reporting, the update check and, if you turn Help improve Lookover on, the usage events described above; none of them receives document text, questions or addresses. You can see and sign out every phone from your account on the website or in the app, and turning notices off in the app stops them without affecting texts, emails or your subscription.

Account pages use cookies and similar storage for sign-in, security and remembering choices such as your language and the household you last opened. The marketing site uses no cookies or advertising trackers; it remembers a language you choose in your browser’s storage. We do not sell or share information for cross-context behavioral advertising, regardless of a browser’s opt-out signal. Our websites do not respond differently to Do Not Track signals, because we do not track you across other sites and do not allow third parties to do so. Technical security and request logs may still be created.

Lookover is operated in the United States. Providers may process information in the United States and other locations where they operate; privacy protections can differ by location. Lookover is intended for adults and is not directed to children under 18. If you believe a child has opened an account, contact us and we will delete it.

Your choices and privacy rights

On the website or in the app, you can download the records you are allowed to see and manage your sharing choices. Your account download, in Account data & deletion, and a household’s download, in its Data & privacy settings, both list the service providers that receive your information, what each receives and how to contact them, and state that we have no affiliates that receive it and do not sell it; a household’s download also lists the people you shared your documents with there. You can withdraw your permission and your health-information consent for Lookover to read what you send in a household’s Data & privacy settings, on the website or in the app; this covers the addresses you have verified yourself, and we record the withdrawal. The person managing a household can change its original-document retention or close it. Your account settings separately let you manage sign-in addresses; removing an email address, phone number or Apple or Google sign-in signs out every website and app session that signed in with it.

You can delete your account after transferring or closing households you manage, turning off renewal of subscriptions you pay for, and finishing any checkout in progress. Deleting an account ends its sessions at once and pauses it for 30 days; signing in again before then cancels the deletion. Download what you want to keep before you confirm, because a paused account cannot be used. After 30 days its addresses, private questions and support conversations are removed, and the documents it sent are deleted as described above, except what it shared and chose to keep for the people it shared with.

You can also email privacy@lookoverit.com, or choose Privacy request in Support & feedback, to request access, correction, deletion, a copy of your information, or withdrawal of consent where processing depends on it. Withdrawal does not undo lawful processing already completed and may prevent the requested feature from working.

If we are closing a household you manage or paid for because of misuse, deleting your account still goes ahead on the normal schedule. So that a required closure or refund notice can still reach you, we keep only the email address or phone number that notice would use, encrypted, together with the related billing records. We remove that address when the closure is complete, and no later than 180 days after your account is deleted. We do not send a text to a number that has opted out, and we do not send your notice to anyone else.

Deleting your account

To delete your account, open Profile & security from the account menu, then Account data & deletion, then Delete account, in the Lookover app or on the website. If you cannot sign in, email privacy@lookoverit.com from the address you sign in with. What is deleted, and when, is described above.

Rights vary by location. We will verify requests using information reasonably needed to protect your account and respond within the time required by applicable law. An authorized agent may contact us with evidence of their authority. If we deny a request, you can appeal by replying to our response or emailing the same address and identifying it as a privacy appeal. You may also contact your state privacy regulator. We do not discriminate against you for exercising a protected privacy right.

Changes and contact

We will update the effective date when this policy changes, notify account holders before material changes take effect, and obtain consent where required. Contact privacy@lookoverit.com or write to Webspin, LLC, 5900 Balcones Drive, Suite 31281, Austin, TX 78731.