Privacy Policy — Bloombooard

🔒 Short version: Bloombooard is a local-first macOS app. Your tasks, boards, notes, and settings are stored only on your device. We do not sell your data. We do not track you. Optional cloud features (email integration, AI) require your explicit consent.

1 Who We Are

BloomBoard ("we", "us", "our") is an independent macOS productivity application built and operated from the United Arab Emirates. Designed for professionals, freelancers, and growing teams, BloomBoard brings task management, goal tracking, AI assistance, and connected productivity tools into a single focused workspace. You can contact us at support@mybloomboard.app.

This Privacy Policy explains how we handle information when you use the Bloombooard desktop app and its associated website at mybloomboard.app.

2 Data Stored Locally on Your Device

By default, all of your app data is stored locally in a file on your Mac. This includes:

Tasks, subtasks, notes, deadlines, and priorities
Project boards and board content
KPI goals and performance data
Streak and badge records
Reminders, meetings, and calendar entries
App settings and preferences
Team member data (if using the Team workspace)

This data never leaves your device unless you explicitly enable a feature that requires it.

3 Google Account Integration (Gmail & Calendar)

BloomBoard offers an optional Google integration. If you choose to connect your Google account:

What we access: Your Gmail inbox (read), individual email content (read), the ability to send emails on your behalf — only when you explicitly trigger the send action — and your Google Calendar events (read-only) to display upcoming meetings inside the app.

What we do NOT do: We never store your emails or calendar events on any server. We never read data in the background. We never share your Google data with third parties. We never use it for advertising or profiling.

Where tokens are stored: OAuth access tokens are stored locally on your device only. They are never uploaded to our servers.

The Google integration uses OAuth 2.0. The scopes we request are:

gmail.readonly — to read your inbox and email content
gmail.send — to send emails you compose inside the app
calendar.readonly — to display your upcoming calendar events and meetings

You can disconnect your Google account at any time from Settings → Connected Apps inside the app. This immediately revokes our access and deletes your stored tokens.

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

4 Microsoft Integration (Outlook & Calendar)

BloomBoard offers an optional Microsoft integration for Outlook email and Calendar. If you choose to connect your Microsoft account:

We request read access to your Outlook inbox and the ability to send emails on your behalf — only when you explicitly trigger the send action
We request read-only access to your Microsoft Calendar to display upcoming meetings inside the app
We never store your emails or calendar events on any server
OAuth tokens are stored locally on your device only and never uploaded

You can disconnect your Microsoft account at any time from Settings → Connected Apps inside the app.

5 AI Features

BloomBoard includes AI-powered features (Bloom AI, email writing, daily planning, meeting notes) powered by two AI services:

Claude AI (Anthropic) — used for text-based AI features. The text you input is sent to Anthropic's API to generate a response. Anthropic may retain API inputs per their own Privacy Policy.
OpenAI Whisper — used as a fallback for voice-to-text transcription when native speech recognition is unavailable. Audio is sent to OpenAI's API for transcription only and is not stored by us. OpenAI may retain inputs per their own Privacy Policy.

We do not store the content of your AI conversations or voice inputs on our servers. AI features are only triggered when you explicitly open them and submit a request.

6 Authentication (Supabase)

BloomBoard uses Supabase for secure user authentication (account login, password reset, and magic-link sign-in). When you create an account or sign in:

Your email address is stored securely with Supabase to identify your account
Supabase handles password storage using industry-standard encryption — we never see your raw password
Authentication tokens are stored locally on your device
Supabase may process your data per their own Privacy Policy

7 License Verification

If you purchase a paid plan, we verify your license using a secure key. This process involves:

Sending your license key to our licensing server to verify validity
Recording device activation count to enforce license limits
No personal browsing or app usage data is sent during this process

8 Website Analytics

Our website at mybloomboard.app may use basic analytics to understand page traffic. We do not use advertising trackers, third-party cookies, or fingerprinting. If analytics are enabled, they collect only anonymised page view data.

9 Data We Do NOT Collect

To be explicit, we do not collect or have access to:

Your tasks, notes, or board content
Your email content (beyond what's needed for Gmail/Outlook features in-session)
Your calendar events (beyond displaying them in-app)
Your location
Your contacts
Any data from your device beyond what's described above

10 Data Sharing

We do not sell, trade, or rent your personal data to any third party. We do not share your data with advertisers. The only third-party services that may receive data are:

Google — if you use Gmail or Calendar integration (OAuth tokens and in-session data only)
Microsoft — if you use Outlook or Calendar integration (OAuth tokens and in-session data only)
Anthropic — if you use Claude AI features (your AI prompt text only)
OpenAI — if voice transcription fallback is triggered (audio data only, not stored by us)
Supabase — for secure authentication (your email address and encrypted credentials)
Polar.sh — for payment processing if you subscribe to a paid plan

11 Children's Privacy

BloomBoard is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12 Your Rights

You have the right to:

Access any personal data we hold about you
Request deletion of your data
Revoke Google account access at any time via the app or at myaccount.google.com/permissions
Revoke Microsoft account access at any time via account.microsoft.com/permissions
Export or delete your local app data at any time

To exercise any of these rights, contact us at support@mybloomboard.app.

13 Security

We take reasonable measures to protect any data that passes through our systems. OAuth tokens are stored locally and encrypted by the operating system's secure storage. We use HTTPS for all API communications.

14 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

15 Contact

Questions about this Privacy Policy? Reach us at:

📧 support@mybloomboard.app
🌐 mybloomboard.app