BloomBloom is a pour-over coffee app. This policy explains what it collects, why, how it is protected and what you can do about it. In short: only what the app needs to work, encrypted where it is personal, never sold and never used for ads.
Who is responsible
Bloom is developed by João Souza, who decides how your data is used and is responsible for it under Brazil's General Data Protection Law (LGPD) and similar laws.
What we collect
- Account: your name, e-mail address, country and language, plus a profile photo if you add one.
- Your coffee: the bags you register (with their photos, if you add any), your recipes, your brews (time, weights, curve, rating and tasting notes) and the scales you pair.
- Purchase: whether you bought the lifetime license. The App Store or Google Play handles the payment; we only receive their confirmation, never your card details.
- Technical data: your IP address and basic request data, used briefly to protect the service from abuse and to fix errors.
We do not collect your location, contacts or advertising identifier. The app has no analytics, no ads and no third-party trackers.
Why we use it
- To run the app: your stock, recipes, history and statistics, on any device you sign in to, and the lifetime license once you buy it.
- To sign you in: we e-mail you a single-use code instead of using passwords.
- To keep the service safe: limiting repeated attempts and investigating errors.
The legal bases are the performance of the service you asked for and, for security, our legitimate interest (LGPD art. 7, V and IX).
How we protect it
Your name, e-mail, country and photos are encrypted on our server (AES-256), so they are unreadable without our key. Sign-in codes and session tokens are stored only as one-way hashes. Data travels over an encrypted connection, and photos are only ever shown to you.
Who we share it with
Nobody, for their own purposes. We rely only on the providers needed to run Bloom: the hosting of our server and database, and an e-mail delivery service that receives your address and the code to send. They process data on our behalf and under our instructions.
The App Store and Google Play distribute the app under their own privacy policies.
Phone permissions
- Camera and photos: only when you add a photo of a bag or of yourself.
- Bluetooth: only to connect to a scale.
You can refuse either one; the rest of the app keeps working, and every brew can be done by hand.
How long we keep it
Your data is kept while your account exists. Sign-in codes expire in 10 minutes and sessions in 90 days. When you delete your account, everything in it is deleted at once: profile, photos, coffees, recipes and brews.
Your rights
- See and correct your data: Profile shows and edits your name, country, photo and language.
- Delete everything: Profile → Delete account.
- Confirm what we hold, get a copy, or ask anything else the LGPD grants you (art. 18), through the contact below.
Self-hosted servers
Bloom is open source, so anyone can run their own server. If you use the app with a server you or someone else runs, that server's operator decides how your data is handled, and this policy does not cover it. In that case the app sends nothing to us.
This website
This site uses no cookies, no analytics and no trackers. It is served by Cloudflare, which processes your IP address to deliver the pages and protect them from attacks.
Children
Bloom is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes, we update this page and the date at the top. Significant changes are also announced in the app.
Contact
For any request about your data, or a question about this policy, use the support contact on Bloom's App Store or Google Play page.