🌸 Bloom — Privacy Policy

Last updated: 9 August 2026

Bloom is a tool for creators to plan posts, track their own income, and organise their work. This policy explains what we store, why, and how to get rid of it. We have tried to write it in plain language rather than legalese.

The short version. Your data is yours. We do not sell it, we do not use it for advertising, and we do not share it with data brokers. You can download everything we hold at any time, and you can permanently delete your account from inside the app.

Who we are

Bloom is operated by the Bloom team ("we", "us"). For any privacy question, or to exercise any right described below, contact us at hello@bloomforcreators.com.

What we collect

What	Why we need it
Email address and password	To create your account and sign you in. Passwords are stored only as a bcrypt hash — we cannot read your password.
Display name	To greet you in the app.
Posts, captions, schedules and uploaded photos or videos	These are the content you create in Bloom. Uploaded media is stored so it can be attached to your posts.
Earnings, sales, tips and expense entries you record	To produce your own income totals, charts and tax estimates.
Subscriber and fan handles, and any notes you write about them	To power your subscriber and fan tracking. See "Information about other people" below.
Social account connections	If you connect an account for auto-posting, we store the access credential encrypted (AES-256-GCM) so Bloom can publish on your behalf. You can disconnect at any time, which deletes it.
Forwarded platform emails	If you set up email auto-tracking, emails forwarded to your Bloom address are parsed to log sales automatically. We store what we extracted plus a short recent log to help diagnose parsing problems.
Push notification tokens	To send reminders you asked for. Turning notifications off removes them.
Basic technical data	Standard server logs and your timezone offset, so scheduled posts fire at the right local time.

What we do not do

We never ask for, store, or use your OnlyFans or Fansly password.
Bloom does not log into, scrape, or automate your paid creator platforms. It cannot see your account there.
No advertising trackers, no third-party analytics SDKs, no selling or sharing of personal information for cross-context behavioural advertising.

Information about other people

Bloom lets you record fan and subscriber handles and your own private notes about them. That information is about someone else, so please be thoughtful: record only what you genuinely need for your business, keep it accurate, and do not store sensitive details about a person you would not be comfortable defending. You are responsible for what you enter about third parties. It is visible only to you, and it is deleted with your account.

How your data is used

Only to run the features you are using: showing your dashboard, sending reminders you enabled, publishing posts you scheduled, and calculating your own totals. We do not profile you and we do not make automated decisions about you.

Who we share it with

We do not sell your data. It is shared only with the infrastructure providers required to run the service:

Hosting and database providers — to store and serve the app.
A social platform you explicitly connect — when you publish a post, that post's content goes to that platform, at your instruction.
Push notification services — to deliver notifications you turned on.
Law enforcement — only where we are legally required to, and we will tell you unless legally barred from doing so.

How long we keep it

We keep your data for as long as your account exists. When you delete your account, the deletion is immediate and permanent, not a soft-delete or a hidden flag. Ordinary server logs and encrypted backups may retain traces for a short period before rotating out.

Your rights

Wherever you live, Bloom gives you these:

Get a copy. Setup → "Download my data" gives you a full JSON export of everything we hold.
Delete everything. Setup → "Delete my account" permanently erases your account and all associated records. It cannot be undone.
Correct it. You can edit anything you have entered, directly in the app.

If you are in the UK, EU or EEA (UK GDPR / GDPR), you also have rights to restrict or object to processing, to data portability, and to complain to your local supervisory authority. Our lawful bases are performance of a contract (running the service you signed up for) and legitimate interests (keeping the service secure and working).

If you are in California (CCPA/CPRA), you have rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We will never discriminate against you for exercising a privacy right.

Security

Passwords are hashed with bcrypt and never stored in readable form. Connected-account credentials are encrypted at rest with AES-256-GCM. Traffic is served over HTTPS. No system is perfectly secure, but we do not store payment card details or government ID at all, which removes the most damaging categories of breach.

Children

Bloom is strictly for adults. It is not directed at anyone under 18, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

International transfers

Our infrastructure providers may process data in countries other than yours, including the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Changes to this policy

If we make a material change, we will update the date at the top and notify you in the app. Continuing to use Bloom after a change means you accept the updated policy.

Contact

Questions, requests, or complaints: hello@bloomforcreators.com.

🌸 Back to Bloom