Privacy Policy

Last updated: October 12, 2026

Bloomary is operated by DailyMind LTD, a company registered in Cyprus under registration number HE 439959. This policy explains how we handle personal data when you use Bloomary at https://bloomary.life/.

DailyMind LTD is the data controller for personal data processed by Bloomary. Service providers listed below act as processors or independent providers depending on the feature.

1. Data We Collect

Content You Create

Draft posts are saved locally in your browser storage or iOS app storage. When you connect LinkedIn and draft sync is on (the default), the web app also sends draft text, draft images, and their timestamps to the Bloomary API so they are available on your other devices and so scheduled posts can be published. You can turn draft sync off in Settings; drafts you save after that stay on your device, except drafts you choose to schedule, which must be stored on our servers to be published. Deleting a draft or deleting your account data removes the synced copy.

If you use AI assistance, Bloomary sends the draft text you submit directly to Google Gemini API using the Gemini API key you provide. DailyMind LTD does not receive or store the submitted draft text or AI output on its servers for this feature.

AI API Key

If you add a Gemini API key, native apps store it in Keychain and the web app stores it in browser session storage. When you use AI assistance, Bloomary sends the key directly to Google Gemini API to process your request. DailyMind LTD does not receive, store, or log the key.

Google controls whether your Gemini API key works, including quota, billing, regional availability, restrictions, blocked keys, and free or unpaid key limits. Bloomary cannot fix, replace, validate, or guarantee third-party API keys.

LinkedIn Authorization Data

If you choose to connect LinkedIn, Bloomary processes your LinkedIn member ID, name, email address, profile picture URL, OAuth scope, connection time, token expiry time, and per-day LinkedIn posting/request counts used for daily limits and your plan's post count. Native apps store access tokens in device secure storage, including the iOS Keychain. The backend retains the LinkedIn access token to authenticate requests and publish scheduled posts. The web platform uses a Secure, httpOnly session cookie; JavaScript receives profile and session metadata rather than the LinkedIn access token. Browser sessions end when the token expires, you disconnect, or the backend restarts.

If you enable iOS notifications, Bloomary stores your APNs device token and its delivery environment to send scheduled-post status alerts through Apple. Alerts contain the schedule identifier and its status, without your draft text or images. Registrations are removed when disabled, when Apple reports the device token invalid, or when you disconnect or delete your account.

Temporary OAuth state and PKCE verifier values are stored only for completing the authorization flow.

LinkedIn processes the authorization request under LinkedIn's own terms and privacy policy. Bloomary is not affiliated with, endorsed by, or sponsored by LinkedIn.

Feedback

If you send feedback, Bloomary processes the title, message, attached images, and your LinkedIn name, member ID, and email address if you are connected. We use this data to receive your message at info@dailymind.eu and send a confirmation copy to your email address.

Do not include passwords, payment data, client secrets, employer secrets, health data, or other sensitive personal data in feedback messages or screenshots.

Community

If you join the Bloomary Telegram community, Telegram processes your Telegram account data, profile information, messages, reactions, and group activity under Telegram's own terms and privacy policy. Group admins may see your Telegram profile, messages, member status, joins, leaves, moderation events, and other information Telegram makes available to group administrators. Bloomary does not currently use Telegram statistics bots.

Technical Data

The website is served through Cloudflare. Cloudflare may process standard technical logs such as IP address, user agent, request URL, timestamps, and security events for delivery, security, and performance.

Bloomary does not currently load website or web platform analytics.

The iOS app may use Sentry for crash, app hang, watchdog termination, and performance diagnostics. Product analytics, if enabled, must not include your name, email address, LinkedIn member ID, post content, feedback text, attached images, or client material.

2. How We Use Data

• To let you write, preview, save, reopen, and copy LinkedIn-ready drafts in your browser.
• To send a draft to Google Gemini API for AI-assisted editing when you request it.
• To start and complete a LinkedIn OAuth authorization flow if you choose to connect LinkedIn.
• To show your connected LinkedIn identity in the app and send feedback confirmations to your email address.
• To receive and respond to feedback, bug reports, screenshots, and product ideas.
• To operate and moderate the Bloomary community when you choose to join it.
• To detect crashes, app hangs, watchdog terminations, performance problems, and reliability issues.
• To keep the site available, secure, and performant.

3. Legal Basis

• Contract performance — to provide the writing tool you choose to use.
• Consent — when you choose to start LinkedIn authorization or provide information voluntarily.
• Legitimate interest — for security, debugging, abuse prevention, and service reliability.
• Legal obligation — where we must keep or disclose information to comply with law.

4. Sharing

We do not sell personal data and do not use personal data for ad monetization. We share data only when necessary with:

• Cloudflare for hosting, CDN, security, and storage of synced draft images (Cloudflare R2).
• Hetzner Online for hosting the Bloomary API server and its database in the EU (Finland), including LinkedIn connection data, synced drafts, and scheduled posts.
• Google reCAPTCHA on the bloomary.life support form, to block spam. It loads only after you start using the form and processes device and browser data under Google's privacy policy.
• Google Gemini API when you use AI assistance with your user-provided Gemini API key.
• LinkedIn when you initiate LinkedIn authorization.
• Resend for sending feedback emails and confirmation emails.
• Sentry, if enabled, for iOS crash, hang, watchdog, performance, and reliability diagnostics.
• Telegram when you choose to join the Bloomary Telegram community.
• Authorities or professional advisers if required for legal compliance, security, or dispute handling.

We do not use Bloomary data to track you across apps or websites owned by other companies for advertising, advertising measurement, or data broker purposes.

Where a service provider processes personal data for us, we rely on appropriate data processing terms, contractual safeguards, and provider security commitments. If personal data is transferred outside the EEA, we use legally available transfer mechanisms such as standard contractual clauses where required.

LinkedIn account connection data is required only if you choose to connect LinkedIn. Feedback contact data is required only if you choose to send feedback and want us to respond or send a confirmation.

Google processes AI requests under Google's Gemini API terms and privacy terms. If you use unpaid Gemini API quota, Google may use submitted content and generated responses to improve Google products and services, and human reviewers may process API input and output. Do not use AI assistance for sensitive, confidential, client, employer, regulated, or third-party material unless you are allowed to send that material to Google.

5. Local Storage and Device Storage

Bloomary uses localStorage and sessionStorage in the browser and app storage on native apps. Native apps store LinkedIn token data and Gemini API keys in Keychain. The web app stores Gemini API keys in browser session storage. Essential storage is used for drafts, settings, LinkedIn login, and remembering your cookie choice. The web login uses an essential Secure, httpOnly cookie. You can delete local data by using app controls, disconnecting LinkedIn, clearing site data for platform.bloomary.life in your browser, closing the browser session, or removing the app.

6. Retention

• Drafts remain on your device until you delete them or clear local storage. Synced copies remain on our servers until you delete the draft, delete account data, or ask us to delete them. If your trial or subscription ends, synced drafts are kept read-only and stay available to you for reading and export until you delete your account data.
• To grant the free trial once per person, we keep a pseudonymous trial record: a keyed hash (HMAC-SHA256) of your LinkedIn email address, or of your LinkedIn member ID if no email is available, with the trial start and end dates. This record is kept after account deletion, because deleting it would let the same person start a new trial. Our legal basis is our legitimate interest in preventing trial abuse.
• Gemini API keys remain in native app Keychain until you delete them, delete account data, or remove the app. In the web app, Gemini API keys remain in browser session storage until you clear them, clear site data, or close the browser session. DailyMind LTD does not receive or store Gemini API keys.
• AI request content is not received or stored by DailyMind LTD for the AI assistance feature. Google handles AI request retention under Google's Gemini API terms.
• LinkedIn profile/auth metadata and per-day posting/request counts remain until you disconnect LinkedIn, the token expires, or the data is no longer needed to provide the service.
• When you disconnect LinkedIn, Bloomary deletes the matching backend LinkedIn auth/profile row, deletes backend per-day posting/request counts for that LinkedIn member ID, and clears the local token where the app can do so.
• Feedback messages and attached images are kept for up to 12 months unless a longer period is needed for security, legal, or business record reasons.
• Telegram community messages and group activity are retained according to Telegram settings and admin moderation needs.
• Sentry diagnostic events, if enabled, are retained according to those providers' operational policies and our product reliability needs.
• Cloudflare logs are retained according to Cloudflare's operational policies.

7. Security

We use HTTPS, minimize server-side token storage, store native app access tokens and Gemini API keys in Keychain, and store web Gemini API keys only in browser session storage. Personal data may be accessible only to people who need it to operate, debug, secure, and support Bloomary. Browser storage is controlled by your browser and device. Do not use Bloomary on a shared device if you do not want drafts, tokens, or API keys to remain available in that browser profile or app installation.

If we become aware of a personal data breach, we will investigate, mitigate it, and notify affected users or regulators where required by applicable law.

8. Your Rights

Under GDPR, you may have rights to access, rectify, erase, restrict, port, or object to processing of your personal data. You may also withdraw consent where processing is based on consent.

For data stored only on your device, DailyMind LTD cannot access it directly. You can remove it locally by clearing browser storage for platform.bloomary.life, deleting drafts in the app (while your trial or subscription is active), disconnecting LinkedIn, or removing the iOS app.

You can download all your synced drafts, with their images, as a zip of Markdown files from Settings at any time, including after your trial or subscription ends. You can delete your account and all your data from the app or on the Account Deletion page at any time. You may also request access, correction, deletion, restriction, portability, or objection by contacting us.

You may also have the right to lodge a complaint with a data protection supervisory authority.

9. Children

Bloomary is not directed to children under 16, and we do not knowingly collect personal data from children.

10. Changes

We may update this policy from time to time. The updated date above shows the current version.

11. Contact