Privacy Policy

Bloomly is a personal growth companion — habits, focus, vision boards, spending, and reminders. We take your privacy seriously. This policy explains what we collect, why, and the choices you have.

In plain terms: most of your day-to-day data lives on your device. When you sign in, we sync an encrypted copy to your account so you can access it across devices.

Authentication data

When you create an account, we collect your email address and a securely hashed password (or the OAuth identifier if you sign in with a provider). We use this only to identify you and secure your account.

Local storage

Habits, focus history, vision goals, planner entries, reflections, mood entries, expenses, savings targets, reminders, and app preferences are written to your browser's localStorage. This data lives on your device and is not sent to our servers unless you're signed in and cloud sync is enabled.

Cloud synchronization

When signed in, we sync your app data to your row in our database (Supabase / Lovable Cloud) so you can restore it on another device. Each user can only read and write their own row — access is enforced by row-level security at the database layer.

Notifications

If you grant browser-notification permission, Bloomly sends local, in-browser notifications for reminders, focus session completions, and vision-board nudges. Nothing about the content of these notifications leaves your device — they are generated locally.

Diagnostics & feedback

When you submit feedback through the in-app Feedback Center, we store your message, category, the app version, and your browser's user-agent string alongside your account so we can follow up. When you use the Diagnostics panel, information stays on your device unless you explicitly export or paste it into a support message.

Analytics

We may collect minimal, aggregated usage metrics (e.g. anonymized page views and error reports) to improve reliability. We do not sell your data and we don't use third-party advertising trackers.

• Supabase (Lovable Cloud) — authentication, database, and storage. Data is encrypted in transit (TLS) and at rest.
• Cloudflare — hosting and edge delivery of the app.
• Browser vendors — you use Bloomly through your browser, which is subject to its own privacy policy.

We do not share your personal data with third parties for marketing purposes.

• To provide the core product features you signed up for.
• To sync your data across the devices you're signed in on.
• To secure your account and prevent abuse.
• To respond to your feedback and support requests.
• To fix bugs and improve reliability.

You can, at any time:

• Export all of your locally stored data as JSON from Settings → Data.
• Delete individual sections or reset all local data from Settings → Data.
• Sign out to stop cloud sync on that device.
• Request account and data deletion by emailing support@bloomly.app.
• Ask us for a copy of the data we hold about you, or ask us to correct it.

Depending on where you live, you may have additional rights under laws such as GDPR or CCPA. We honor those rights on request.

We retain your account data for as long as your account is active. If you delete your account, we remove your synced data from our systems within 30 days, except where we are required to retain it by law.

We use industry-standard practices to protect your data — encrypted transport, row-level security in the database, short-lived access tokens, and a strict content security policy on the app itself. No system is perfectly secure, but we work hard to keep yours safe.

Bloomly is not directed to children under 13. If you believe a child has provided us personal information, please contact us and we will remove it.

We may update this policy from time to time. When we do, we'll update the "Last updated" date above and, for material changes, notify you in-app.

Questions or concerns? Email support@bloomly.app. We read every message.