Plain-English privacy.

This document describes how Blooming Mirror currently handles your information. It is not a legal certification. If something here is unclear, email support@bloomingmirror.com.

Who we are

Blooming Mirror is the data controller for personal data processed through the Blooming Mirror app at bloomingmirror.com. Contact us at support@bloomingmirror.com for any privacy question.

What we collect and why

• Account data (email, password hash if email sign-in, sign-in timestamps) — to create and secure your account. Legal basis: contract.
• Profile data (display name, avatar image) — to personalize your account. Legal basis: contract.
• Your reflections (check-ins, journal entries, prayer requests, faith-mode preference) — to give you access to your own history and trends. Legal basis: contract.
• Community content (circle membership, posts, reactions, reports) — to operate community features you choose to join. Legal basis: contract.
• Subscription and billing metadata (plan, status, period dates, Paddle customer and subscription IDs) — to provision paid features. Legal basis: contract. Card and payment details are collected and stored by Paddle, not us.
• Product analytics (which features you use, in aggregate, tied to your user id) — to understand usage and improve Blooming Mirror. Legal basis: legitimate interest.
• Technical and security data (IP address, user agent, server logs) — to keep the service secure and debug issues. Legal basis: legitimate interest.

We do not sell your data. We do not show ads. We do not use your journal entries to train AI models.

Who we share data with

• Cloud hosting, database, authentication, and storage provider — stores your account, reflections, and avatar files on our behalf as a processor.
• Paddle.com Market Limited — our Merchant of Record and payments provider. Paddle receives your email, name, country, and purchase details to process payments, manage subscriptions, calculate tax, invoice you, and handle refunds. See Paddle's privacy notice.
• Google — only if you choose Sign in with Google. We receive your email and name; we do not see your Google password.
• Authorities — where we are legally required to disclose data.
• Professional advisers (legal, accounting) where strictly necessary.

International transfers

Our providers may process data outside your country, including in the United States and the EEA. Where required, transfers are protected by standard contractual clauses or equivalent safeguards.

How long we keep it

Your reflections and profile are kept as long as your account is open. Server logs are kept for a short rolling window for security. Subscription and billing records are kept for as long as required by tax and accounting law. When you delete your account, we remove your reflections, profile, and community content within a reasonable period, except where retention is legally required.

Your rights

Subject to local law you may have the right to access, correct, delete, restrict, port, or object to processing of your personal data, and to withdraw consent. To exercise any of these rights email support@bloomingmirror.com from your account email; we respond within one month. You also have the right to complain to your local data protection authority.

Security

We use appropriate technical and organizational measures — encrypted transport, encrypted storage at rest, scoped database access, and least-privilege admin tooling — to protect your data. Avatars are stored in a private bucket and served through short-lived signed links.

Cookies

Blooming Mirror uses only essential cookies and local storage needed to keep you signed in and to remember preferences. We do not set advertising or third-party analytics cookies.

Children

Blooming Mirror is not directed at children. You must be at least 16 to create an account.

Changes

If we change how we handle your data, we'll update this page and the "last updated" date above.

Contact

Privacy questions: support@bloomingmirror.com.