Privacy,
in plain words.

About this policy

This policy covers Bloomletter at bloomletter.app and its studio. For support or a privacy request, contact imad065725@gmail.com.

Information we receive

• Account information: your email address, account identifier, and profile details you provide. Email and password sign-in is handled by our authentication provider, Supabase.
• Your keepsakes: the names, text, photos, drawings, voice recordings, music links, and settings you save in a letter. Local drafts are stored in your browser; saving to your account uploads the letter and its media to Supabase.
• Purchase information: checkout identifiers, order identifiers, payment status, and the Premium access associated with your account. Lemon Squeezy collects checkout and payment details on its hosted checkout. Bloomletter does not collect or store your card number.
• Technical information: hosting and service providers process request information such as IP addresses, browser details, timestamps, and error or security logs to serve and protect the service.
• Support messages: your email address and the information you include when you contact us.

When you sign in with Google

Google shares basic account information with Supabase for Bloomletter: your Google account identifier, email address, name, and profile picture. This information is stored with your authentication account and used to sign you in, identify your account, and provide profile features.

Bloomletter's Google sign-in requests basic identity, email, and profile access. It does not request access to your Gmail messages, Google Drive files, or contacts. Your Google password is entered with Google and is not given to Bloomletter.

Google sign-in information is used for these account features and service operation, not advertising or sale to data brokers. You can disconnect Bloomletter through your Google Account connections. Disconnecting Google does not itself delete letters already saved with Bloomletter.

How we use information

We use information to provide sign-in, save and load keepsakes, deliver the shared letters you choose to publish, verify purchases and Premium access, respond to support requests, and diagnose or prevent service errors and abuse.

Sharing and service providers

Letters are private by default. When you enable sharing, anyone who has the link can view the shared letter, subject to any password you set. Recipients may keep screenshots or downloaded copies, which Bloomletter cannot recall.

Supabase provides authentication, database, and media storage. Cloudflare delivers the website. Lemon Squeezy handles purchases. Google handles Google sign-in and the support inbox. jsDelivr delivers the authentication library, and linked or embedded music may connect to YouTube or Spotify. These providers receive the information needed for the features you use and may process it in countries other than where you live.

The providers' policies describe their own services: Supabase, Cloudflare, jsDelivr, Lemon Squeezy, Google and YouTube, and Spotify. Information may also be disclosed when required by applicable law.

Browser storage and security

Bloomletter uses local storage, session storage, and IndexedDB for sign-in sessions, drafts, theme and sound preferences, and information passed between pages. Clearing site data removes local drafts and preferences and can sign you out. Sign-in, payment, and embedded media providers may use their own cookies or storage.

Saved media uses private storage and temporary access links. Account access controls limit access to saved letters. No online service can guarantee absolute security; sharing a link or downloading a copy changes who can access that content.

Retention, deletion, and your choices

We retain account and saved letter data to provide the service while you keep them in your account. Manage your saved letters and account from your profile. Deleting a saved letter removes its stored media and database entry. Archiving a shared letter, where available, revokes its share link while keeping it in your account.

Account deletion removes the active account, profile, saved letters, and uploaded media. Local drafts on other devices and copies already kept by recipients are not automatically removed. Technical logs, provider backups, cached copies, support correspondence, and payment-provider records may remain under the relevant provider's retention practices or where required by law; deletion does not promise immediate erasure from every system.

To ask for access, correction, or deletion of your information, or to raise a privacy concern, email imad065725@gmail.com. We may need to verify that a request relates to your account before acting on it.

Policy updates

Changes to this policy will be published here with an updated date. For questions about the service or this policy, contact imad065725@gmail.com.