Security and your data

Where your data lives

Used on its own without an account, BloomBoard keeps your tasks, boards, notes and settings on your computer only.

When you sign in, your data syncs to our database hosted by Supabase on Amazon Web Services in Tokyo, Japan. Your own tasks sync there so your phone and other computers show the same list and reminders. Team boards, chat and meetings are stored there so everyone on the team sees the same thing.

Files and photos shared in chat are stored with Cloudflare R2 or Supabase Storage.

How it is protected

All traffic between the app and our servers is encrypted with TLS. Data in the database and in file storage is encrypted at rest by our hosting providers.

Access is enforced in the database itself with row-level security, switched on for every table: a person can only read their own data and the data of teams they belong to. Your personal tasks are visible only to you; teammates see a task only when it is assigned to them. Billing and plan records can only be changed by our payment system, never from the app.

Passwords are handled by Supabase Auth and stored as salted hashes. We never see them. Sign-in codes and email confirmation protect new accounts.

Gmail and Outlook connections use the official Google and Microsoft sign-in. Their access tokens stay on your computer, encrypted with your system keychain, and are never sent to our servers.

Reminders are scheduled on your own devices, so they work without sending your schedule anywhere else.

The Mac app is signed and notarised by Apple. The Windows app is distributed through the Microsoft Store.

Calls

Audio and video calls are carried by LiveKit over encrypted connections. We do not record calls. Live captions use Apple's built-in speech recognition.

AI

Bloom AI sends only the text needed for a request to Anthropic's Claude API. Anthropic does not use API data to train its models. AI requests go through our server, which checks your plan; your data is not sold or shared for advertising.

Providers we use

Supabase (database, sign-in, storage), Cloudflare (file storage), LiveKit (calls), Anthropic (AI), Polar (payments, merchant of record), Resend (account and invite emails), and Google or Microsoft only if you connect your email or calendar.

Your control

Export: Settings, then About, then Export my data saves a copy of everything the app keeps for you.

Delete: Settings, then Account, then Delete account permanently removes your account, your synced data, your notifications and your sign-in records. Messages you sent in a team's chat stay with that team, as in any workplace chat. Team owners can remove members at any time.

There is no advertising and no tracking in the app. See our Privacy Policy for details.

For companies

Need a security questionnaire answered, a data processing agreement, or your data kept in a particular country? Write to hello@mybloomboard.app and we will reply within two business days.

Who can see your data: our hosting providers process it on our behalf under their own security programmes (Supabase is SOC 2 Type 2 audited). We look at account data only when you ask us for help, and never to sell or advertise.

Report a security issue to support@mybloomboard.app. We take every report seriously and reply quickly.