Privacy Policy

Blossom Gratitude ("we," "us," "our") operates the Blossom Gratitude mobile application (the "App"). This Privacy Policy explains what personal data we collect, why we collect it, how we process and protect it, and your rights regarding that data.

By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the App.

The data controller responsible for your personal data is:

Blossom Gratitude
Email: privacy@blossomgratitude.com

2.1 Account Data

2.2 User-Generated Content

2.3 Practice & Usage Data

2.4 Feedback & Rating Data

If you choose to provide feedback through the in-app rating system, we may collect:

• Star rating (1-5)
• Feedback category (e.g., bug, feature request)
• Free-text feedback
• Email address (only if you voluntarily provide it for follow-up)
• App version, platform, locale
• Session count and streak count at time of feedback

2.5 Subscription & Payment Data

Subscription management is handled by RevenueCat in conjunction with the Apple App Store and Google Play Store. We do not collect, process, or store your payment information (credit card numbers, billing addresses, etc.). RevenueCat receives your anonymous user ID and subscription status. All payment processing is handled entirely by Apple or Google.

2.6 Device & Technical Data

We collect minimal technical data necessary for App functionality:

• Device platform (iOS/Android)
• App version number
• Push notification token (if you grant permission)
• Language/locale settings

We do not collect device identifiers (IDFA/GAID), IP addresses for tracking, location data, contacts, photos, or browsing history.

2.7 Data We Do NOT Collect

• Location or GPS data
• Contacts or address book
• Photos, camera, or photo library data
• Health or fitness data
• Advertising identifiers
• Browsing history or cookies
• Social media profiles
• Biometric data

We process your personal data for the following purposes:

• Providing the Service: Account management, content delivery, practice tracking, journal functionality.
• AI Content Generation: Generating personalized daily gratitude videos, including script writing, image generation, and text-to-speech narration (see Section 4).
• Voice Transcription: Converting voice recordings to text gratitude entries.
• Personalization: Delivering content in your preferred language, avoiding content repetition.
• Subscription Management: Verifying subscription status, managing trial periods.
• Notifications: Sending daily practice reminders and streak notifications (with your consent).
• Service Improvement: Analyzing aggregated, anonymized usage patterns; processing voluntary feedback.

We do not use your data for advertising, profiling, automated decision-making with legal effects, or selling to third parties.

To provide the App's features, we share limited data with the following processors:

Each third-party processor operates under their own privacy policy and data processing terms. We have ensured that adequate data processing agreements are in place where required by applicable law.

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Password security: Passwords are hashed using industry-standard algorithms; we never store plaintext passwords.
• Row-Level Security (RLS): Database policies ensure users can only access their own data.
• JWT Authentication: Secure token-based authentication with automatic refresh.
• Minimal data collection: We collect only what is necessary to provide the service.
• Temporary processing: Voice recordings and video assets are deleted after processing or after 3 days.

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

Depending on your jurisdiction, you may have the following rights:

7.1 Under the GDPR (EU/EEA/UK)

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
• Right to Restriction: Request limitation of processing in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Right to Lodge a Complaint: File a complaint with your local data protection authority.

7.2 Under the CCPA/CPRA (California, USA)

• Right to Know: Request disclosure of data collected, used, and shared.
• Right to Delete: Request deletion of personal information.
• Right to Opt-Out: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

7.3 Exercising Your Rights

To exercise any of these rights, contact us at privacy@blossomgratitude.com. We will respond within 30 days (or sooner if required by applicable law). We may ask you to verify your identity before processing your request.

Your data may be transferred to and processed in countries outside your country of residence, including the United States, where our third-party service providers operate. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all third-party processors
• Compliance with applicable data transfer frameworks

The App is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@blossomgratitude.com, and we will promptly delete such information.

If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to remove that information from our servers.

With your explicit permission, we may send push notifications including:

• Daily practice reminders at a time you choose
• Streak reminders (afternoon and evening) if you haven't completed your daily practice

You can disable notifications at any time through your device settings or the App's settings. We do not use push notifications for marketing or advertising.

The App stores certain preferences locally on your device using AsyncStorage, including:

• Language preference
• Notification settings
• Rating/feedback interaction state
• Authentication session tokens

This data never leaves your device unless you explicitly use a feature that requires server communication. You can clear this data by uninstalling the App.

The App does not use cookies, web beacons, pixel tags, or any form of cross-app or cross-site tracking. We do not participate in any advertising networks. We do not use analytics SDKs that track your behavior across apps or websites.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you through the App or via email for significant changes

Your continued use of the App after changes take effect constitutes acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: privacy@blossomgratitude.com

We aim to resolve all complaints and requests within 30 days.