Privacy Policy

Solac Labs LLC operates Bloom Plant Care and bloomsprout.app. This policy covers the Bloom apps for iPhone and Android, our website, and support communications. Contact us at hello@bloomsprout.app.

• Account and profile information: email address, authentication information, display name, an optional username, and your account identifier.
• Plants and care: plant names, photos you take or upload, identification results, symptom descriptions, health suggestions, notes, care history, saved plants, and reminder schedules. If you start a treatment plan, we also store the plan and its dated steps, when you complete them, your check-up answers, any check-up photos, and the comparison results.
• Preferences: onboarding answers such as plant-care experience and home-light preferences, timezone, and notification settings. These are information you provide, not measurements of your home.
• Purchases: subscription product, purchase and renewal information, trial and entitlement status, and identifiers used to connect purchases to your account. On iPhone, Apple processes purchases and handles payment details; on Android, Google Play does. Bloom does not receive your payment-card number.
• Apple Ads attribution (iPhone): when you install Bloom on iPhone, Bloom uses an Apple attribution token to ask Apple whether an Apple Ads campaign led to the install. If one did, Apple's answer can include our ad organization, campaign, ad group, keyword and ad identifiers, whether the ad was tapped or viewed, whether the install was a download or redownload, the country or region, and where the ad appeared. We store the result on your device and send it to RevenueCat and Amplitude, where it can be associated with your Bloom account ID when you are signed in. This does not use IDFA or Apple's App Tracking Transparency permission.
• App activity and device information: feature and screen-use events, sessions, app opens, plant-add and care-task events, paywall interactions, app and operating-system versions, device information, and an analytics device identifier. Events can be associated with your Bloom account ID when signed in.
• Approximate location: Amplitude receives the IP address of analytics requests and can derive country, region, city, and similar approximate geographic information. Bloom does not request precise GPS location. On iPhone, Bloom does not use IDFA for tracking, and the app's Amplitude configuration disables IDFV and carrier collection. On Android, Bloom does not use the Android advertising ID, and the app's Amplitude configuration disables advertising ID, app set ID, and carrier collection.
• Diagnostics and security: crash and app-hang reports, stack traces, technical context, server request information, IP addresses, timestamps, and account or request identifiers. If you contact support, we receive your email and whatever information you choose to include.
• Notifications: your device push token when notifications are enabled, and settings needed to deliver reminders.
• Website visits: pages you view (the full page address, including any campaign tags in it), the referring page, screen size, browser language, how far you scroll, how long a page stays open, and random visitor and session identifiers stored in your browser. As with any web request, our analytics provider also receives your IP address and browser information.
• Optional Google Analytics: after you allow it, public page addresses and titles, a referring website origin, fixed campaign labels, eligible app-store link clicks, browser/device information and cookie-based visitor/session identifiers. Our configured events omit arbitrary query strings, fragments, form contents, email addresses, account identifiers and typed search text. Google receives ordinary connection information, including your IP address, and uses it for approximate location; Google states that GA4 does not log or store individual IP addresses.
• Android waitlist: if you sign up on our website, we collect your email address, signup date, the website link or form you used (such as the homepage or FAQ), and a record of your consent to Android-related emails. To limit spam, we temporarily store a coded network identifier derived from your IP address using a secret key. The waitlist database does not store your raw IP address.

We use information to identify plants, provide care and health suggestions, save and sync your collection, deliver reminders, process subscriptions, answer support requests, prevent abuse, and maintain the service. App analytics helps us understand onboarding, feature use, and where people encounter problems. Website analytics helps us understand which pages people visit and how they find the site. Diagnostics helps us find and fix crashes and hangs. On iPhone, we use Apple Ads attribution to measure which of our Apple Ads campaigns lead to installs and subscriptions.

We use Android waitlist signups to measure interest and, with your consent, send updates about Bloom for Android. Joining does not create a Bloom account or subscribe you to general marketing. There is no promised Android release date.

Where data-protection laws require a legal basis, we process information necessary to provide the features you request to perform our agreement with you; use proportionate security, reliability, and product-improvement information for our legitimate interests; comply with legal obligations; and rely on consent where required. Where we rely on consent, you can withdraw it as described in the rights section below.

Optional Google Analytics on our website relies on your consent, which you can withdraw at any time through Analytics choices.

When you choose photo identification or a plant-health check, Bloom uploads the image to our servers and sends it, together with relevant plant or symptom information, to Anthropic, whose Claude models provide the analysis. This is cloud processing, not analysis confined to your phone. Avoid including people, documents, or other personal information that is unnecessary for a plant photo.

If you add a photo to a treatment check-up, Bloom uploads it to our servers and sends it to Anthropic with your original diagnosis photo and the name of the diagnosed condition, so the two photos can be compared. The comparison is a suggestion, and you choose the final answer.

Under Anthropic's commercial API terms, customer content is not used to train its models by default. Anthropic may retain inputs and outputs under its applicable API retention rules, including for safety, abuse prevention, or legal requirements. Bloom does not promise zero retention by the AI provider. See Anthropic's data usage information.

Our upload processing strips embedded image metadata, including EXIF location, before storage. This does not remove information visible in the picture. Photos are stored using cloud storage. Image URLs can be accessed by anyone who has the exact link, so do not treat a photo URL as a private sharing channel.

An identification photo may become a reference image in Bloom's shared species catalog. Other users can then see that photo without your profile or name. Contact us if you want a reference image removed. Account deletion clears matching catalog references and attempts to remove the underlying stored photos, subject to the deletion limitations below.

We use the following providers for the purposes described here:

• Anthropic: plant images and relevant text for AI identification, plant-health analysis and check-up photo comparison.
• Supabase: account authentication and our application database.
• Cloudflare: website delivery, security, storage of Android waitlist entries, and storage and delivery of plant photos. Website requests expose ordinary connection information, including an IP address, to our hosting provider.
• Fly.io: hosting for application servers and related technical logs.
• Apple: App Store distribution, purchases and subscriptions, push-notification delivery, and Apple Ads attribution for the iPhone app.
• Google: Google Play distribution, purchases and subscriptions for the Android app, and push-notification delivery through Firebase Cloud Messaging.
• RevenueCat: purchase, entitlement, and subscription processing in the iPhone and Android apps, using account and purchase identifiers and associated device information. On iPhone, this also includes the Apple attribution token and result, app and build details, and the analytics device identifier.
• Amplitude: product analytics in the iPhone and Android apps, including app events, account and analytics device identifiers, technical device information, and IP-derived approximate location. On iPhone, this also includes the Apple Ads attribution result.
• Fastlane: website visitor analytics, including pages viewed, referrer, screen size, browser language, scroll depth, time on page, browser-stored visitor and session identifiers, and the IP address and browser information sent with analytics requests.
• Google Analytics 4: optional website analytics after you allow it, with the information described above. Our website configuration disables Google signals and advertising personalization and does not link these visits to your Bloom account. See Google’s privacy information.
• Sentry: crash and hang diagnostics in the iPhone and Android apps and, when configured, backend error monitoring. Reports may include your account ID and technical context.

Providers process information under applicable service agreements and privacy terms. Providers acting on our behalf are engaged to process data for the relevant service with appropriate safeguards. Apple and Google also handle information under their own privacy terms. We may disclose information to comply with law, protect rights and security, or as part of a merger, acquisition, or business transfer, subject to applicable notice and data-protection requirements.

We do not sell personal information or share it for cross-context behavioral advertising.

In the apps: Amplitude records selected product events and session/app-lifecycle activity. Treatment events can include the plan and day, the diagnosed condition and severity, your check-up answer, and the comparison result and confidence. We do not configure it to capture your typed search text, plant photos, or symptom notes. Sentry crash and hang reporting is enabled; screenshot attachments, view-hierarchy attachments, performance tracing, and session replay are disabled in the iPhone and Android app configurations. These limits do not mean that the apps collect no analytics or diagnostics.

Signing out resets the app's Amplitude identity for future events and clears the signed-in Sentry user association. It does not erase previously received events. The app does not currently offer an analytics opt-out switch. Contact us about applicable objection, consent, or deletion rights.

On the website: we use Fastlane, a third-party website analytics service, to measure visits. When a page loads, its script records a page view with the page address, referring page, screen size, browser language, and any campaign tags in the address. When you leave or hide a page, it records how far you scrolled and how long the page was open. The script keeps a random visitor identifier, a session identifier, and a session start time in your browser's local storage. The visitor identifier remains until you clear this site's data, and a new session identifier is created after 30 minutes. These identifiers are not connected to your email, Bloom account, or app analytics. You can clear or block this storage in your browser's site-data settings or with a content blocker; the site works without it.

Optional Google Analytics: GA4 is off by default everywhere. We load Google's analytics script and allow analytics cookies only after you choose Allow analytics. Reject analytics leaves that script blocked. Reopen Analytics choices on any public page to change your decision. This choice applies only to Google Analytics: the existing Fastlane script described above and Cloudflare's hosting/performance measurement continue without this opt-in. Rejecting Google Analytics does not disable those separate services. Your choice is stored in this browser for up to 180 days; if storage is unavailable, it applies only while the page remains open. Withdrawing consent stops future Google collection after the page reloads; it does not erase events already received or automatically remove existing cookies. You can clear cookies and site data in your browser.

When enabled, GA4 measures page views and eligible app-store link clicks. We send public canonical paths, known page titles and fixed campaign labels; we strip arbitrary query strings and fragments and reduce incoming referrers to their website origin. Automatic form, site-search, outbound-link and history-change measurement are disabled in our web stream; minimized pageview and store-click events replace them. We do not send waitlist emails, form contents, typed queries, Bloom account IDs or a website-to-app identity link. GA4 analytics cookies are configured for up to 180 days without automatic extension. Google signals, advertising storage, advertising user data and advertising personalization remain disabled; no Google Ads or other product link is configured. The website works if you reject GA4 or block its requests, and Android email signup consent is separate.

Our hosting provider, Cloudflare, also provides aggregate performance measurements through its Insights beacon. Cloudflare describes Web Analytics as operating without analytics cookies or local-storage visitor identifiers. This hosting measurement is separate from the optional GA4 choice.

The website does not include an advertising pixel, and we do not set advertising cookies. Optional GA4 uses analytics cookies only with your permission. Our hosting provider processes requests to deliver and secure the site. When you arrive through our YouTube-tagged link, we also keep the fixed source label “youtube” and its expiry time in session storage for up to 30 minutes in that tab. This preserves the source as you browse our site; it does not identify you. App Store download links include fixed campaign labels identifying the website page or the YouTube source. For a YouTube-tagged visit, the source label takes precedence over the page label. These labels do not contain your email, account ID, or a unique visitor identifier. Apple uses these links to provide aggregate campaign reporting, subject to its reporting thresholds. Following an App Store link takes you to Apple's service, which has its own privacy practices. We also use Google Search Console to review aggregate search performance. We do not use these reports to identify an individual visitor’s search keywords. Future changes will be evaluated and reflected here before use, with consent or opt-out mechanisms where required.

The website does not change its behavior in response to a browser's Do Not Track signal. We do not sell or share data for cross-context advertising regardless of that signal, and do not use website data to track you across unrelated services for advertising.

You can adjust care-reminder preferences and time slots in Bloom, and control notification permission in iPhone Settings → Notifications → Bloom or, on Android, in your device's notification settings for Bloom (usually Settings → Apps → Bloom → Notifications). On Android, push notifications are delivered through Google's Firebase Cloud Messaging, and Bloom stores your device's push token to send them. Push notifications may mention a plant's name and may also tell you when an identification is ready. Reminders can also tell you when a treatment step or check-up is due. A trial-ending reminder may be scheduled locally on your phone if notifications are allowed; delivery is not guaranteed.

The iPhone and Android apps attempt to deregister their push token on sign-out. The service removes tokens that have not been seen for 90 days. Camera and photo access are used when you choose those features; you can manage system permissions in iPhone Settings or Android Settings. On Android, Bloom uses the system photo picker, so it receives only the photos you choose.

Android waitlist: we retain your entry while evaluating Android demand and providing the updates you requested. You can leave the waitlist, withdraw consent, or request deletion by emailing hello@bloomsprout.app from the address you signed up with. Waitlist removal is separate from deleting a Bloom app account. Temporary coded network identifiers are valid for a ten-minute rate-limit window and become eligible for removal when it ends; expired entries are removed during subsequent signup attempts or administrative cleanup. Hosting security logs and database backups may persist separately under our provider's retention settings.

We retain account and plant information while needed to provide your account and the features you use. Deleting an individual plant removes it from your collection, but some related records and stored photos remain until account deletion.

To request account deletion in the iPhone or Android app, open You → Delete account… and complete the confirmation and any requested reauthentication. If you no longer have the app or can't sign in, you can request deletion by email. Delete your Bloom account explains both ways. Successful deletion removes the sign-in identity and active account records, including saved plants, care records, identification and diagnosis records, treatment plans and check-up answers, and reminder records. It also clears matching shared-catalog photo references. Stored photo removal, including check-up photos, is attempted during deletion; a storage failure may leave an unreferenced file requiring separate cleanup. Contact us if you need help with a deletion request or a remaining photo link.

A limited record of the deleted account ID and deletion time is retained to prevent an old session from recreating the account. It becomes eligible for cleanup after seven days and is removed when the service next performs its deletion cleanup; seven days is not a guaranteed purge deadline. We also keep the deleted account ID with a record of the request to remove your email and name from RevenueCat, so a delayed update can't restore them. It holds no email or name and has no set removal date.

Some records stay with providers after account deletion:

• Server and database logs: logs can include your account ID. We use them for security and to investigate service problems. Fly.io documents 7 days for its log search, and Supabase documents up to 90 days for API and database logs, depending on plan. Audit logs or exported logs stored separately may stay longer.
• Database backups: copies of your data stay in Supabase backups, for security and disaster recovery. Supabase documents up to 30 days for daily backups, depending on plan.
• Sentry: crash and error reports can include your account ID. We use them to fix crashes and investigate security problems. Sentry documents up to 90 days for these events. Copies can last longer in its backups, which it deletes 90 days after creation.
• Anthropic: Anthropic says it normally deletes API inputs and outputs within 30 days. If its safety systems flag content as violating its usage policy, it keeps the inputs and outputs for up to 2 years and safety scores for up to 7 years. It may keep content longer where the law requires it or to combat policy violations.
• RevenueCat: RevenueCat may hold your account ID, your purchase and subscription history, and the email and name Bloom sent it. Account deletion queues removal of the email and name. It does not ask RevenueCat to delete the rest, so that has no fixed end date and stays until we ask. After a deletion request, RevenueCat says it keeps data only as necessary to comply with legal obligations, resolve disputes and enforce agreements.
• Amplitude: Amplitude may hold app events linked to your account ID and analytics device ID. We use these events to understand how the app is used. Account deletion does not send Amplitude a deletion request, and we have not confirmed an automatic deletion date for our Amplitude project, so assume they stay until we ask Amplitude to delete them.
• Apple and Google: Apple and Google may retain purchase records under their own policies and legal obligations.

To have Amplitude, Sentry, or RevenueCat records deleted sooner, email hello@bloomsprout.app from your Bloom email address and we'll ask those providers to delete them. Amplitude says it processes deletion requests within 30 days.

Website analytics: Fastlane retains website visit events under our provider's retention settings. Clearing this site's data in your browser removes the stored visitor and session identifiers and campaign source label but does not erase events already sent. Contact us about applicable deletion requests.

Optional GA4 retention: Google retains received analytics information according to the property’s retention settings. Clearing browser cookies/site data removes local identifiers and your analytics choice, but does not erase provider-held history. Contact us about applicable deletion requests. We do not promise a fixed provider retention period without verifying the account setting.

We restrict retained information to its relevant purpose and handle deletion requests subject to applicable law.

Deleting your account or the app does not cancel a subscription. Manage Bloom Pro separately in your Apple Account subscription settings on iPhone, or in Google Play's Payments & subscriptions on Android.

You can review and update information available in your account and contact hello@bloomsprout.app to request access, a portable copy, correction, or deletion. We may need to verify your identity before acting. Do not send us your password or payment-card details.

Depending on the law that applies to you, you may also have rights to restrict or object to processing, withdraw consent where processing relies on it, appeal a decision, and complain to your local data-protection authority. Withdrawal does not affect processing that was lawful before withdrawal. We will not discriminate against you for exercising applicable privacy rights. An authorized agent can contact us with appropriate proof of authority where the law permits.

We use safeguards such as encrypted transport, access controls, and protected authentication storage. No online service can guarantee absolute security, and publicly accessible photo URLs have the limitations described above.

Bloom operates from the United States. Our service providers may process or store information in the United States and other countries where they operate. Where applicable law requires transfer safeguards, we use appropriate contractual or other lawful safeguards. Contact us for information about safeguards relevant to your request.

Bloom is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action. If your jurisdiction requires an older age or parental permission to use the service, those requirements also apply.

The date at the top of this policy identifies the latest revision. We will post updates here and provide additional notice of material changes, or obtain consent, where required by applicable law.

For privacy questions or requests, contact hello@bloomsprout.app. The data controller is Solac Labs LLC.