Bloom Privacy Policy

1. Introduction

Bloom ("we", "us", "the App") is a focus, mindfulness, and sleep habit-building app. This Privacy Policy explains what information we collect, use, store, and share, and the rights you have. By using Bloom, you acknowledge that you have read and understood this Policy.

Scope: the App is offered to users outside mainland China and is not directed to users within mainland China. If you are located in mainland China, the App is not offered to you; please do not use it.

2. Information We Collect

(a) Information you provide

• Account info: email and password (stored encrypted); or, when you use Sign in with Apple, the identifier and (authorized) email returned by Apple.
• Profile: display name and avatar (if set).
• User content: garden data you create, flower records, shared-garden invitations and memberships.

(b) Information collected automatically

• Session data: duration, intention, timestamps, and completion/interruption status of focus/mindful/sleep sessions.
• Sleep/schedule data: your bedtime/wake window and sleep session records. Note: this is used only for in-app experience and not for medical diagnosis.
• Usage & analytics: feature usage, screen views, crash logs, device model, OS version, app version, and coarse region (for localization and pricing).
• Device identifiers and push tokens (to deliver notifications).

(c) Transaction information

• The current version of the App is completely free, involves no subscriptions or in-app purchases, and we collect no transaction-related information.
• Once paid features launch: subscriptions and in-app purchases will be processed by the Apple App Store, and we will receive only Apple's transaction receipts/subscription status to validate entitlements, but we do not collect or store your card or payment details.

3. How We Use Information

• Provide and maintain core features (accounts, timing, planting flowers, garden sync, shared gardens).
• Validate subscription/IAP entitlements and process Restore Purchases.
• Send notifications you opt into (daily reminders, sleep reminders, friend invites).
• Improve the product, analyze retention/conversion, and fix crashes and bugs.
• Anti-fraud and security (e.g., server-side validation of session rewards, preventing duplicate grants).
• Comply with legal obligations and respond to lawful requests.

4. Sharing & Third Parties

We do not sell your personal information. We share only:

• Service providers: as necessary to provide the service, we use the following infrastructure providers — Supabase (backend, database, authentication, push-token storage, basic operational and crash logs), Expo / EAS (app builds, OTA updates, push relay, and crash/diagnostic logs), RevenueCat (subscription and in-app-purchase entitlement management; enabled once paid features launch), and Apple (Sign in with Apple, APNs push, App Store in-app purchases). We use only the basic diagnostics and usage analytics provided by these providers to improve our own product; we do not integrate any advertising SDK and do not perform cross-app tracking.
• Payment platform: Apple, to process subscriptions and IAP.
• Other users: when you join or create a shared garden, your display name, avatar, and contribution data are shown to other members of that garden.
• Legal: when required by law, subpoena, or lawful government request.
• Business transfer: in a merger, acquisition, or asset sale, with continued protection under this Policy.

5. Storage, Location & Security

• Data is stored with Supabase (hosted on AWS US East region, us-east-1).
• All transit uses HTTPS/TLS; sensitive credentials are stored in the device Keychain; sensitive server-side data is encrypted at rest.
• We apply reasonable technical and organizational safeguards, but no system can guarantee absolute security.

6. Data Retention

• We retain your account and garden data while your account is active.
• After you delete your account, we delete or anonymize your personal data within 30 days (except where law requires retention, e.g., transaction records for tax/audit).
• Planted/withered flower records are immutable while the account is active (to guarantee uniqueness) and are removed upon account deletion.

7. Your Rights

Wherever you are located, you may:

• Access and correct your personal information.
• Export your data (by email request; we will provide it within a reasonable period).
• Delete your account in-app (Settings → Account → Delete Account), which cascades to server-side data.
• Turn off notifications and withdraw consent.

GDPR (EEA/UK users): rights to access, rectify, erase, restrict, port, and object; you may complain to a supervisory authority. Legal bases include contract performance, legitimate interests, and your consent.

CCPA/CPRA (California users): rights to know, delete, correct, and opt out of "sale/share." We do not sell your personal information. You will not be discriminated against for exercising your rights.

To exercise rights, contact danyang.zhao@swiftpass.cn.

8. Children's Privacy

Bloom is intended for a general audience and not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us to delete it.

9. Tracking & Advertising

We do not use your data for cross-app tracking and do not serve third-party ads. Our analytics are used only to improve our own product.

10. International Transfers

Your information may be transferred to and processed on servers outside your country. We use appropriate safeguards (e.g., Standard Contractual Clauses) for such transfers.

11. Changes

We may update this Policy. Material changes will be announced via in-app notice or email, and the "Last Updated" date above will be revised.

12. Contact

SwiftPass Technologies Co., Ltd. · Email: danyang.zhao@swiftpass.cn · Address: Room 5401 & 5402, 5/F, Block A, Tower 2, Shenzhen Bay Innovation & Technology Center, No. 3156 Keyuan South Road, Gaoxinqu Community, Yuehai Sub-district, Nanshan District, Shenzhen, China