Privacy Policy

1. The short version

BloomQuest: Celebrate holds some of the most personal words you will ever write: memories, inside jokes, and messages meant for one person. We treat them that way. We collect only what the service needs, we never sell your data.

2. What we collect from creators

When you create an account and build quests, we store:

• Account details: your email address, display name, and sign in credentials, managed through our authentication provider.
• Quest content: the briefs you write, the scenes generated from them, your edits, the photos and voice notes you attach, and any content report you choose to send us.
• Microphone and voice notes: the app uses your microphone only while you are recording a voice note, and only after you allow microphone access. You can upload an audio file instead. Each voice note is converted on our servers to a standard audio format, and details embedded in an uploaded file, such as its title or location tags, are removed. Voice notes become part of your quest, so anyone with the quest link can play them.
• Collaboration data: if you start or join a collaboration quest, we store the private invite, joined contributors, chosen display names, submitted contributions (including a voice note if a contributor adds one), and the organizer’s review decisions so the gift can be assembled and published.
• Purchase records: your subscription or unlock status, provided by the App Store or Google Play through our billing partner. We never see your card number.
• Location data: precise coordinates are used only when you explicitly choose your current location for a finale place. You can always search for or enter a place instead.
• Notification data: when you opt in, we store an app installation identifier and push token so notifications can reach that device.
• Marketing email data: after a verified signup, we store your email preference, language, timezone, lifecycle branch, delivery status, and an opaque in-app destination so we can send occasional product and occasion emails. We do not place quest names, recipient names, memories, responses, or private quest content in the marketing provider.
• Device and usage data: app version, device type, crash reports, and privacy-conscious analytics about which features are used, so we can fix bugs and improve the app. Our app-session recordings mask all rendered text and form inputs; we do not send private quest content, recipient details, or message text to analytics.

2b. What we collect on the marketing website

On bloomquest-app.com we use Google Analytics 4 and product analytics/session replay (currently PostHog) to understand how visitors use the public site: pages viewed, buttons clicked, approximate device and browser info, and a recording of the session interaction so we can improve layout and messaging.

Website session replays mask form inputs (including email and password fields). The marketing site does not host private quest content. You can block analytics with common browser privacy tools; we also route analytics through our own domain when possible to keep delivery reliable without changing what is collected.

If you open a creator-partner recommendation link, we store a pseudonymous referral click and an opaque handoff so the app can remember that recommendation after you sign in. The creator can see only aggregate performance and never your name, email address, account ID, or purchase receipt. Private creator dashboards are excluded from website analytics and session replay.

3. What we collect from recipients

Recipients never need an account. When someone opens a shared quest, we create a random session identifier and record opens, progress, completion, selected answers from journey choices, and any finale response they choose to send back. We also keep a pseudonymized network signal for abuse prevention and any report a recipient chooses to submit. We do not ask recipients for a name or email and do not use recipient activity to build advertising profiles.

4. How generation works

Quest scenes are generated with the help of an automated writing service. Your brief is sent to that service to produce the scenes for your quest, and the result is stored with your project. Your briefs, quests, and recipient responses are not used to train any generation models, ours or anyone else's.

5. Who we share data with

We share data only with the service providers that run BloomQuest: Celebrate, and only what each one needs. We require providers to protect the data consistently with this policy and applicable privacy requirements:

• Supabase and Google Cloud, which provide authentication, database, hosting, and operational infrastructure.
• OpenAI, which receives the brief needed to generate a quest and screen unsafe generated content.
• Apple and Google, which process store purchases, and RevenueCat, which validates those purchases across platforms.
• Sentry and PostHog, which receive technical diagnostics and privacy-masked product interactions, not the private contents of your quests.
• Firebase Cloud Messaging, which delivers notifications only after you opt in.
• BloomQuest's own invitation-recovery service, which stores only a hashed, short-lived installation handoff. It never shares the underlying invitation key, contributor name, quest content, account identifier, or recipient details with a deferred-link provider.
• Resend, which delivers product and occasion emails and reports delivery, bounce, complaint, and unsubscribe events. Resend does not receive private quest content.

6. Notifications

If you allow push notifications, we send you moments that matter: when your quest is opened, when the recipient makes progress, and when they select answers or send a finale response. You can change notification permissions anytime in the app or in your device settings.

6b. Product and occasion email

When you create and verify an account, BloomQuest may send occasional product and relevant occasion emails—up to weekly, with two in the first week. Before each message, we use account-level signals such as plan type, whether a quest is at the draft, preview, published, or completed stage, and whether you recently received another BloomQuest message. We do not use the private words inside a quest to personalize marketing.

Marketing email is separate from security messages and purchase receipts. You can turn it off at any time from Profile, then Notifications, or from an unsubscribe link in any marketing email. Unsubscribing does not change your account, purchases, security email, or billing receipts.

7. Retention and deletion

We keep your data while your account is active. From Profile, then Privacy and data, you can export your data or delete your account. Deletion removes your account, your quests, and their published links from our systems, except for records we are legally required to keep, such as purchase history.

For collaboration contributors, deletion removes editable drafts and account linkage. A contributor’s accepted material may remain in an organizer’s already-published immutable quest, together with the display-name snapshot they approved, so that the published gift does not change unexpectedly.

8. Security

Quest links are unlisted and protected by a hidden key, so nobody can browse or search their way into a quest. Data is encrypted in transit, access to production systems is restricted, and we review what we store so we hold no more than the service needs.

9. Children

BloomQuest: Celebrate is designed for people of all ages and is rated Everyone on Google Play. Younger children should use the app with a parent or guardian's guidance. We handle account creation and personal data according to the age-of-consent and child-privacy requirements that apply in the user's country.

10. Changes to this policy

If we change this policy in a meaningful way, we will tell you in the app or by email before the change takes effect, and this page will always show the current version with its date.