Privacy Policy

Last updated: October 30, 2026

Bloomary is operated by DailyMind LTD, a company registered in Cyprus under registration number HE 439959. This policy explains how we handle personal data when you use Bloomary at https://bloomary.life/.

DailyMind LTD is the data controller for personal data processed by Bloomary. Service providers listed below act as processors or independent providers depending on the feature.

1. Data We Collect

Content You Create

Draft posts are saved locally in your browser storage or iOS app storage. When you connect LinkedIn and draft sync is on (the default), the web app also sends draft text, draft images, and their timestamps to the Bloomary API so they are available on your other devices and so scheduled posts can be published. You can turn draft sync off in Settings; drafts you save after that stay on your device, except drafts you choose to schedule, which must be stored on our servers to be published. Deleting a draft or deleting your account data removes the synced copy.

If you use AI assistance, Bloomary sends the draft text you submit directly to Google Gemini API using the Gemini API key you provide. DailyMind LTD does not receive or store the submitted draft text or AI output on its servers for this feature.

AI API Key

If you add a Gemini API key, native apps store it in Keychain and the web app stores it in browser session storage. When you use AI assistance, Bloomary sends the key directly to Google Gemini API to process your request. DailyMind LTD does not receive, store, or log the key.

Google controls whether your Gemini API key works, including quota, billing, regional availability, restrictions, blocked keys, and free or unpaid key limits. Bloomary cannot fix, replace, validate, or guarantee third-party API keys.

LinkedIn Authorization Data

If you choose to connect LinkedIn, Bloomary processes your LinkedIn member ID, name, email address, profile picture URL, OAuth scope, connection time, token expiry time, and per-day LinkedIn posting/request counts used for daily limits and your plan's post count. Native apps store access tokens in device secure storage, including the iOS Keychain. The backend retains the LinkedIn access token to authenticate requests and publish scheduled posts. The web platform uses a Secure, httpOnly session cookie; JavaScript receives profile and session metadata rather than the LinkedIn access token. Browser sessions end when the token expires, you disconnect, or the backend restarts.

If you enable iOS notifications, Bloomary stores your APNs device token and its delivery environment to send scheduled-post status alerts through Apple. Alerts contain the schedule identifier and its status, without your draft text or images. Registrations are removed when disabled, when Apple reports the device token invalid, or when you disconnect or delete your account.

Temporary OAuth state and PKCE verifier values are stored only for completing the authorization flow.

LinkedIn processes the authorization request under LinkedIn's own terms and privacy policy. Bloomary is not affiliated with, endorsed by, or sponsored by LinkedIn.

Feedback

If you send feedback, Bloomary processes the title, message, attached images, and your LinkedIn name, member ID, and email address if you are connected. We use this data to receive your message at info@dailymind.eu and send a confirmation copy to your email address.

Do not include passwords, payment data, client secrets, employer secrets, health data, or other sensitive personal data in feedback messages or screenshots.

Community

If you join the Bloomary Telegram community, Telegram processes your Telegram account data, profile information, messages, reactions, and group activity under Telegram's own terms and privacy policy. Group admins may see your Telegram profile, messages, member status, joins, leaves, moderation events, and other information Telegram makes available to group administrators. Bloomary does not currently use Telegram statistics bots.

Bloomary Connector for AI Apps

On a paid plan or trial you can connect an AI app you use, such as ChatGPT or Claude, to Bloomary through the Bloomary connector (Model Context Protocol). You sign in with LinkedIn and approve the listed permissions on a Bloomary consent page. Bloomary stores the grant (an identifier of the AI app, the permissions you approved, and the time) and a sign-in session record that holds only a hash of the session ID, and issues the AI app an access token that expires after 30 days. With the permissions you approved, the AI app can read and write your drafts. The AI app's provider processes what the app reads or writes under its own terms; you choose that provider, and Bloomary does not control it. To stop access, remove the Bloomary connector in your AI app; a token it already holds stays valid until it expires, unless you ask us to revoke it sooner.

Payments

If you subscribe, Paddle (on the web) or Apple (in the iOS app) processes the payment as merchant of record or seller under its own terms; Bloomary does not receive your card details. To give you access, Bloomary stores the subscription and customer identifiers Paddle sends, or the Apple transaction identifiers, product, app account token and status, together with your Bloomary member ID and the date your access runs until.

Product Metrics

When a post is published through Bloomary, Bloomary records your member ID and the time, to count published posts and active members in internal reports. These records are deleted when you ask us to delete your account data by email.

Technical Data

The website is served through Cloudflare. Cloudflare may process standard technical logs such as IP address, user agent, request URL, timestamps, and security events for delivery, security, and performance.

Bloomary does not currently load website or web platform analytics.

The iOS app may use Sentry for crash, app hang, watchdog termination, and performance diagnostics. Product analytics, if enabled, must not include your name, email address, LinkedIn member ID, post content, feedback text, attached images, or client material.

2. How We Use Data

• To let you write, preview, save, reopen, and copy LinkedIn-ready drafts in your browser.
• To send a draft to Google Gemini API for AI-assisted editing when you request it.
• To start and complete a LinkedIn OAuth authorization flow if you choose to connect LinkedIn.
• To show your connected LinkedIn identity in the app and send feedback confirmations to your email address.
• To receive and respond to feedback, bug reports, screenshots, and product ideas.
• To operate and moderate the Bloomary community when you choose to join it.
• To let an AI app you connect through the Bloomary connector work with your drafts within the permissions you approved.
• To detect crashes, app hangs, watchdog terminations, performance problems, and reliability issues.
• To keep the site available, secure, and performant.

3. Legal Basis

• Contract performance — to provide the writing tool you choose to use.
• Consent — when you choose to start LinkedIn authorization or provide information voluntarily.
• Legitimate interest — for security, debugging, abuse prevention, and service reliability.
• Legal obligation — where we must keep or disclose information to comply with law.

4. Sharing

We do not sell personal data and do not use personal data for ad monetization. We share data only when necessary with:

• Cloudflare for hosting, CDN, security, and storage of synced draft images (Cloudflare R2).
• Hetzner Online for hosting the Bloomary API server and its database in the EU (Finland), including LinkedIn connection data, synced drafts, and scheduled posts.
• Google reCAPTCHA on the bloomary.life support form, to block spam. It loads only after you start using the form and processes device and browser data under Google's privacy policy.
• Google Gemini API when you use AI assistance with your user-provided Gemini API key.
• LinkedIn when you initiate LinkedIn authorization.
• Resend for sending feedback emails and confirmation emails.
• Paddle (merchant of record for web purchases) and Apple (in-app purchases) to sell and manage subscriptions.
• Sentry, if enabled, for iOS crash, hang, watchdog, performance, and reliability diagnostics.
• Telegram when you choose to join the Bloomary Telegram community.
• AI apps you connect through the Bloomary connector, at your direction and within the permissions you approved; their providers process that data under their own terms.
• Authorities or professional advisers if required for legal compliance, security, or dispute handling.

We do not use Bloomary data to track you across apps or websites owned by other companies for advertising, advertising measurement, or data broker purposes.

Where a service provider processes personal data for us, we rely on appropriate data processing terms, contractual safeguards, and provider security commitments. If personal data is transferred outside the EEA, we use legally available transfer mechanisms such as standard contractual clauses where required.

LinkedIn account connection data is required only if you choose to connect LinkedIn. Feedback contact data is required only if you choose to send feedback and want us to respond or send a confirmation.

Google processes AI requests under Google's Gemini API terms and privacy terms. If you use unpaid Gemini API quota, Google may use submitted content and generated responses to improve Google products and services, and human reviewers may process API input and output. Do not use AI assistance for sensitive, confidential, client, employer, regulated, or third-party material unless you are allowed to send that material to Google.

5. Local Storage and Device Storage

Bloomary uses localStorage and sessionStorage in the browser and app storage on native apps. Native apps store LinkedIn token data and Gemini API keys in Keychain. The web app stores Gemini API keys in browser session storage. Essential storage is used for drafts, settings, LinkedIn login, and remembering your cookie choice. The web login uses an essential Secure, httpOnly cookie. You can delete local data by using app controls, disconnecting LinkedIn, clearing site data for platform.bloomary.life in your browser, closing the browser session, or removing the app.

6. Retention

• Drafts remain on your device until you delete them or clear local storage. Synced copies remain on our servers until you delete the draft, delete account data, or ask us to delete them. If your trial or subscription ends, synced drafts are kept read-only and stay available to you for reading and export until you delete your account data.
• Records of scheduled posts (draft, time, status, and LinkedIn post ID) remain until you ask us to delete them by email.
• Payment records (the Paddle or Apple identifiers above) are kept after you delete your account data, for as long as tax, accounting, refund and dispute obligations require.
• To grant the free trial once per person, we keep a pseudonymous trial record: a keyed hash (HMAC-SHA256) of your LinkedIn email address, or of your LinkedIn member ID if no email is available, with the trial start and end dates. This record is kept after account deletion, because deleting it would let the same person start a new trial. Our legal basis is our legitimate interest in preventing trial abuse.
• Gemini API keys remain in native app Keychain until you delete them, delete account data, or remove the app. In the web app, Gemini API keys remain in browser session storage until you clear them, clear site data, or close the browser session. DailyMind LTD does not receive or store Gemini API keys.
• AI request content is not received or stored by DailyMind LTD for the AI assistance feature. Google handles AI request retention under Google's Gemini API terms.
• LinkedIn profile/auth metadata and per-day posting/request counts remain until you disconnect LinkedIn, the token expires, or the data is no longer needed to provide the service.
• Disconnecting LinkedIn deletes the same server data as deleting your account data (see the Account Deletion page), and clears the local token where the app can do so.
• Feedback messages and attached images are kept for up to 12 months unless a longer period is needed for security, legal, or business record reasons.
• Telegram community messages and group activity are retained according to Telegram settings and admin moderation needs.
• Connector grants remain until you ask us to delete them (email us); sign-in session records end when they expire (30 days). AI app access tokens expire after 30 days and are not stored by Bloomary.
• Sentry diagnostic events, if enabled, are retained according to those providers' operational policies and our product reliability needs.
• Cloudflare logs are retained according to Cloudflare's operational policies.

7. Security

We use HTTPS, minimize server-side token storage, store native app access tokens and Gemini API keys in Keychain, and store web Gemini API keys only in browser session storage. Personal data may be accessible only to people who need it to operate, debug, secure, and support Bloomary. Browser storage is controlled by your browser and device. Do not use Bloomary on a shared device if you do not want drafts, tokens, or API keys to remain available in that browser profile or app installation.

If we become aware of a personal data breach, we will investigate, mitigate it, and notify affected users or regulators where required by applicable law.

8. Your Rights

Under GDPR, you may have rights to access, rectify, erase, restrict, port, or object to processing of your personal data. You may also withdraw consent where processing is based on consent.

For data stored only on your device, DailyMind LTD cannot access it directly. You can remove it locally by clearing browser storage for platform.bloomary.life, deleting drafts in the app (while your trial or subscription is active), disconnecting LinkedIn, or removing the iOS app.

You can download all your synced drafts, with their images, as a zip of Markdown files from Settings at any time, including after your trial or subscription ends. You can delete your account and your data from the app or on the Account Deletion page at any time; the records kept after that are listed under Retention. You may also request access, correction, deletion, restriction, portability, or objection by contacting us.

You may also have the right to lodge a complaint with a data protection supervisory authority.

9. Children

Bloomary is not directed to children under 16, and we do not knowingly collect personal data from children.

10. Changes

We may update this policy from time to time. The updated date above shows the current version.

11. Contact