Privacy Policy

The short version

• Your journal can live on your device only. That is the default. In that mode your journal text never reaches a server.
• If you choose cloud storage, the text of your entries is encrypted before it is stored (AES-256-GCM, with a key derived for your account).
• To paint an entry, the text of that entry is sent to Google’s Gemini API. There is no way to generate a painting, a reflective quote or a video without that happening. It is the single most important sentence in this document.
• Your profile portrait never leaves your phone, and a character selfie is never stored as an image by us.
• The app contains no analytics, no crash-reporting, no advertising and no tracking software of any kind.
• We do not sell your data. We never have and we do not intend to.
• You can export your whole journal as a ZIP file, free, on any plan — and delete your account whenever you like.

Who we are

Bloom Journal is made and operated by Holistic Humble Bee, based in Romania. For everything in this policy — questions, requests, complaints — write to hello@bloomjournaling.com. Holistic Humble Bee is the data controller for the personal data described here.

Where your journal lives

Device storage (the default)

When you start, Bloom asks where your journal should live and on this device is the default answer. In that mode your entries are written to a private database inside the app’s own storage, and your paintings and videos are downloaded to files there. Nobody else — including us — can read them. There is no sync, and there is no copy on our servers to lose, to leak or to hand over.

The consequence, stated plainly because it cuts both ways: if you lose the phone, we cannot get your journal back for you. There is nothing to restore from. That is what the ZIP export in Settings → Export & Print is for, and it is free on every plan.

Cloud storage (if you choose it)

You can switch to cloud storage at any time, which copies your journal to our servers so it follows you between devices. Before an entry is stored, the app encrypts its text fields on your device with AES-256-GCM: the entry text itself, its title, its daily reflection, the overlay and whisper quotes, the video quote and the internal painting prompt. The key is derived per account and is held only in the app’s memory — it is never written to your device’s storage.

This is not end-to-end encryption, and we will not call it that. The key is derived by our server from a master key we hold, so in principle we could decrypt cloud entries. What the encryption buys you is real but specific: anyone who reached the database itself — a stolen backup, a misconfigured rule, a subpoena of the storage layer alone — would find ciphertext. We do not read your entries, and nothing in the product needs us to.

Some fields are deliberately not encrypted, because the app has to sort and count them without decrypting your whole journal: the date of an entry, its mood, and internal bookkeeping like which painting file belongs to it. A reviewer of our database would see that you wrote on the 3rd and felt peaceful; not what you wrote.

Paintings and videos are stored as ordinary image and video files, not encrypted. Access rules allow only your own account to list or delete them, and the app opens them through a long, unguessable private link stored on your entry. Those links are published nowhere, but they are links: anyone you gave one to could open that one image.

We keep no backup bin for cloud media. When a cloud painting is deleted, it is gone — there is no versioned copy waiting to be recovered.

One honest note about switching: when you move your journal between device and cloud, the source copy is deliberately left untouched until the move has finished, so that a failed migration can never lose an entry. It is your rollback.

What we collect

Your account

To sign in you use an email address and password, or Google, or Apple — or you can start as a guest, which creates a real journal with no email address attached to it at all. Our authentication provider (Firebase Authentication, part of Google Cloud) stores your email address, a hashed password if you set one, which sign-in providers you have linked, and the dates you signed up and last signed in. If you sign in with Apple and choose to hide your address, we only ever see Apple’s relay address. If Apple or Google shares your name with us on first sign-in, we store that as your display name.

We send account email — password resets, address verification — from our own domain, noreply@bloomjournaling.com.

Your profile

A small profile record holds: display name, email address, whether the account is a guest, your chosen language, your device’s time zone (so an 8pm reminder is your 8pm, and so a painting knows which hemisphere’s season to paint), your storage choice, any streak-pause windows you set, your notification preferences, the date of your most recent entry (a date only — never what it said, so a reminder can skip you if you already wrote today), your subscription status, your invite code and any bonus paintings you earned.

Your journal

Entries, moods, dates, generated paintings and videos, reflections and quotes — stored as described in Where your journal lives. If you build a character so you appear in your own paintings, we store a written description of that character and a short summary you can read and edit.

Technical records

Our servers keep short-lived operational logs so we can tell whether the app is working. These are deliberately written to carry error codes, counts and timings only — no account identifiers and no journal text. That is a rule in our codebase, not an aspiration: an error message that would have embedded a database path (and therefore a user id) is replaced with a fixed code before it is logged.

While a painting or video is being made, a short-lived job record holds the AI-derived results in the clear — the title, mood, reflection and quote — so the app can collect them. The raw text of your entry is never written into that record. Every job record is stamped to self-delete 24 hours after it is created.

Your portrait, and the character selfie

The profile portrait never leaves your phone

The portrait on your account card is written to one file inside the app’s private storage and nowhere else. There is no upload, no database field, no server request — which is also why it works with no network at all. Deleting your account deletes that file; it is the one thing on the deletion list that never existed on a server, so that is the only place it can be erased from.

A character selfie is analysed once and never stored

If you build your painted character from a photo instead of from the trait builder, that photo is sent once to Google’s vision model, which returns a written description in text. We store that description and a short summary you can read and edit. The photo is never written to any bucket, any database or any file on our side — it exists in one request and in the function’s memory while it runs. We also do not keep the structured analysis of your face that the model returns; only the description that the painter needs.

The photo is resized on your device before it is sent, and location metadata is stripped. The trait builder is a full alternative path: you never have to photograph your face to use this feature.

Payments and subscriptions

Bloom Pro is sold as an in-app subscription through the Apple App Store and Google Play. They take the payment. We never see or store your card number, your billing address or any other payment detail.

We use RevenueCat as the intermediary that tells us whether a subscription is active. We identify you to RevenueCat by your Bloom account identifier only — not your email address and not your name. RevenueCat receives the store receipt information needed to validate a purchase, and notifies our server, over a cryptographically signed request, when your subscription starts, renews, lapses or is cancelled. Our server records the plan and its expiry date on your profile. That single record is what decides how many paintings you may make; the app is never trusted to say it for itself.

Because the store owns the billing relationship, cancellations, refunds and payment problems are handled there — and deleting your Bloom account does not cancel a subscription. See Delete your account.

Notifications

Reminders are opt-in. No notification is sent unless your device has granted permission and your profile has notifications switched on; a missing preference is treated as “no”, never as consent. You can turn everything off with the master switch in Settings → Notifications, which also releases your device’s notification registration from our servers.

To deliver a reminder we store the notification token your device is issued by Firebase Cloud Messaging, along with your time zone and language so the message arrives at the right hour in the right words. Reminder text comes from a fixed catalogue we wrote — no notification ever contains anything you journaled. Signing out and deleting your account both remove your device’s registration.

No analytics, no ads, no tracking

This is short because there is nothing to describe. The app ships:

• no analytics SDK — no Firebase Analytics, no Amplitude, no Mixpanel, nothing;
• no crash-reporting SDK — no Crashlytics, no Sentry;
• no advertising or attribution SDK, and no advertising identifier is read;
• no third-party tracker of any kind, and no cross-app or cross-site tracking.

The only cloud services in the app are the ones it needs to function: authentication, the database and file storage for cloud mode, the server functions that generate paintings, cloud messaging for reminders, and the purchase SDK described above.

This website matches. It makes zero third-party requests: the fonts are served from this domain, there is no analytics, no cookie is set, and there is no JavaScript on any page. Reading our privacy policy does not tell anyone that you read it.

How long we keep things

Where your data is processed

Our server code — every function that touches your journal — runs in Google Cloud’s europe-west1 region, in Belgium. Your account, and your entries if you chose cloud storage, are held in Google Cloud services (Firebase Authentication, Firestore and Firebase Storage) within that same project.

Two categories of processing reach beyond that:

• Our AI providers, Google and WaveSpeed, process what we send them on their own infrastructure, which may be outside the European Economic Area.
• Apple, Google Play and RevenueCat process subscription data on their own infrastructure, in accordance with their own privacy policies.

Where personal data is transferred outside the EEA, it is done under the transfer mechanisms those providers make available, such as the European Commission’s standard contractual clauses. If you would like the current list of our providers, ask us and we will send it.

Your rights

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the rights below. We extend the same handling to everyone, because maintaining two standards would be both more work and worse.

Access and portability

Settings → Export & Print produces one ZIP file containing every entry and every painting, in standard formats that work without Bloom. It is free on every plan and needs no request to us. You can add a passphrase to it.

Correction

Entries, moods, your display name, your character description and every setting are editable in the app.

Erasure

Delete individual entries in the app, or your whole account — how to delete your account. If you cannot open the app, email us and we will do it within 7 days.

Objection, restriction, and withdrawing consent

Turn notifications off in Settings; keep your journal on your device only; or simply never request a painting, in which case nothing is sent to an AI provider. Each is a switch you hold, not a request you file.

Complaint

You can complain to your local data protection authority. In Romania, that is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Our legal bases: we process your account data to perform our contract with you (giving you an account and a journal); we send your entry text to AI providers to perform that contract too, because generating the painting is the service you asked for; we keep the hashed anti-abuse ledger and the operational logs under our legitimate interest in not being defrauded and in keeping the app working; and notifications rely on your consent, which you can withdraw at any time.

Deletion, and the one thing that stays

Deleting your account removes your account, your entries, your paintings and videos, your character, your profile and settings, your notification registrations, your invite code, and the copy on the phone you delete from. Our server verifies that the data is actually gone before it removes your sign-in, so a partial failure leaves you an intact account and a retry rather than orphaned data.

What stays is a one-way SHA-256 hash of your email address in a small anti-abuse ledger, together with counters and internal references. It holds no name, no writing, no images and no readable address, and the hash cannot be turned back into your email. It exists so that a free allowance cannot be farmed by deleting and re-creating an account each month — each painting costs us real money to make, and the alternative would be a smaller free plan for everybody. A related hashed row records that a person has already claimed a referral reward or redeemed an invite code, once, ever.

Ask us and we will delete those rows too. The full picture, including timings and the subscription warning, is on the account deletion page.

Children

Bloom Journal is written for adults and is not directed to children. We do not knowingly create accounts for anyone under 13, or under the higher age of digital consent where local law sets one. If you believe a child has an account, write to us and we will delete it.

Changes to this policy

When we change how the app handles data, this page changes with it and the date at the top moves. For a change that materially affects you — a new provider receiving your journal text, say — we will tell you in the app before it takes effect, rather than quietly editing a page and hoping you re-read it. We keep no archive of previous versions on this site; ask and we will send you the previous text.

Contact

Holistic Humble Bee · Romania
hello@bloomjournaling.com

Privacy questions, data requests and complaints all go to the same address, and a human reads it.