Bloom Privacy Policy

1. Introduction

Adelyons Software LLC ("we," "our," or "us") operates the Bloom mobile application (the "App"). Bloom is a private, invite-only space where the people who love you leave words of affirmation — short text notes, voice clips, or photos — that you can open on a hard day. This Privacy Policy explains what data we collect, how we use and protect it, who we share it with, and the choices and rights you have.

Our commitment: Bloom has no public feeds, no followers, and no advertising. We do not sell your data, and we never generate affirmations with AI — every note is written by a real person you invited.

2. Information We Collect

Authentication Data

• Google Sign-In: If you sign in with Google, we receive your Google account email and a Google-issued ID token used to authenticate with our servers. We do not receive your Google password.
• Apple Sign-In: If you sign in with Apple, we receive your Apple user identifier and, on first sign-in only, your email and display name. Apple may relay or mask your email at your option.
• Facebook Login: If you sign in with Facebook, we receive a Facebook user identifier and your basic profile (name, email if you grant it). We do not receive your Facebook password.

Profile Data

• Display name and avatar: Used to show who left a note and to identify you within a box. Your email is never shown to other users.

Content You and Your People Create

• Notes: The text, voice recordings, and photos that you or the people you invite add to a box.
• Box data: Box titles, themes, membership, and invite records (single-use invite tokens, the email or phone you sent an invite to, and membership status).
• Reserved & saved notes: Which notes you have reserved or saved, and when notes were opened.

"Find Your Circle" (Optional Facebook Friends)

• If — and only if — you explicitly opt in to "find your circle," we request the Facebook user_friends permission to surface friends already on Bloom so inviting them is one tap. This friend data is used only to seed invites. It is never persisted as a public social graph and never shown to anyone else. You can use Bloom fully without granting this.

Subscription & Purchase Data

• Subscription status: We store whether you have an active Bloom+ entitlement, mirrored from RevenueCat (our subscription manager). Actual payment details (card numbers, etc.) are handled by the Apple App Store or Google Play — we never see or store them.
• Keepsake book orders: If you order a printed keepsake book, we send the notes you choose and a shipping address to a print-on-demand partner to fulfill the order.

Device & Diagnostic Data

• Push token: A Firebase Cloud Messaging token so we can notify you when a new note arrives.
• Device information: Device type, OS version, and app version for functionality and crash diagnostics.

What We Do NOT Collect

• Your contact list (we never read your phone or email contacts)
• Your precise location or GPS coordinates
• Advertising identifiers or cross-app tracking identifiers for advertising
• Google, Apple, or Facebook account passwords

3. How We Use Your Data

• To provide the App: Deliver your box, your notes, invites, reserves, and notifications.
• To keep Bloom safe: Operate reporting, rate limiting, and optional automated screening of note text for slurs or threats before a soft-anonymous note is delivered (see Section 7).
• To manage subscriptions: Unlock Bloom+ features and fulfill keepsake book orders.
• To communicate with you: Send the notifications you enable and respond to support requests.
• No advertising, no selling: We do not use your data for advertising and we do not sell it.

4. Storage & Security

• Cloud storage: Your profile, notes, and box data are stored in Supabase (a PostgreSQL-based cloud platform). Voice and photo media live in a private storage bucket; access is granted only through short-lived signed URLs issued per request.
• Access control: Row-Level Security ensures a box's notes are readable only by that box's owner, and contributors can see only their own membership — never anyone else's notes.
• Encryption: All data is encrypted in transit (TLS) and at rest using industry-standard encryption.
• Sign in once: Your session is kept in your device's secure storage so your box follows you to any new device. Nothing essential is trapped only on one phone.

5. Sharing & Third-Party Services

We share data only with the service providers needed to run Bloom. Each processes data under its own privacy policy:

• Supabase — database, authentication, and media storage. Privacy policy.
• Google — Sign in with Google. Privacy policy.
• Apple — Sign in with Apple. Privacy policy.
• Meta / Facebook — optional Facebook Login and "find your circle." Privacy policy.
• Firebase Cloud Messaging (Google) — push notifications. Privacy policy.
• RevenueCat — subscription management. Privacy policy.
• Apple App Store / Google Play — process all payments; we never receive your payment details.
• Print-on-demand partner — only if you order a keepsake book, and only the notes and shipping address needed to fulfill it.

People you invite see the notes within shared boxes as designed by the App. We do not otherwise disclose your data to third parties except to comply with the law or protect users' safety.

6. Permissions & Why We Need Them

• Microphone: Required only when you record a voice note.
• Photos / Camera: Required only when you add a photo to a note. We access only the photos you choose — never your whole library.
• Notifications: To let you know when a new note arrives. Optional and adjustable in settings.
• Internet: To sync your box across devices and store media securely.

7. Real People, Content & Moderation

• No AI affirmations: Notes are written by real people you invite. Bloom does not generate notes with AI.
• Reporting & removal: Every note is system-attributable, so a bad actor can be blocked across a box. You can report any note, and the box owner can delete any note instantly. We act on reports of objectionable content within 24 hours.
• Spam protection: We rate-limit how many notes a contributor can send to a box to prevent harassment.
• Optional text screening: Before a soft-anonymous note is delivered, its text may be automatically screened for slurs or threats. This screening runs on note text only; we do not use it to build advertising profiles.

8. Data Retention & Deletion

• Delete a note: You can delete individual notes at any time.
• Delete your account: You can delete your entire account — and all your boxes, notes, and media — from within the App, or by emailing dev@adelyons.com. We remove your data within 30 days of the request.
• Backups: Encrypted backups maintained for disaster recovery are purged on a rolling schedule.
• Legal holds: We retain data only as long as needed to provide Bloom or as required by law.

9. Children's Privacy

Bloom is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact dev@adelyons.com and we will delete it. Where local law sets a higher age of digital consent, that age applies.

10. Your Privacy Rights

GDPR (EU / EEA / UK)

• Legal basis: We process your data to perform our contract with you (running your box), on the basis of your consent (e.g., optional Facebook friends, microphone, notifications), and for our legitimate interest in keeping Bloom safe and functional.
• Your rights: Access, correct, delete, restrict, or port your data, and withdraw consent at any time. Email dev@adelyons.com.
• Transfers: Your data may be processed on infrastructure located in the United States.

California (CCPA/CPRA)

• You may request to know, delete, or correct your personal information. We do not sell or share your personal information as those terms are defined under California law.

11. Changes to This Policy

We may update this Privacy Policy as Bloom evolves or to meet legal requirements. Material changes will be communicated in-app or by updating the "Last Updated" date above. Continued use of Bloom after an update constitutes acceptance of the revised policy.

12. Contact Us

Questions about this Privacy Policy or your data? Contact:

Adelyons Software LLC
Email: dev@adelyons.com
Web: adelyons.com