BloomReads

Privacy Policy — BloomReads

Effective date: 12 September 2026
Last updated: 12 September 2026
Replaces: the version of 11 September 2026

BloomReads ("the app") is made by its developer ("we", "us"). This policy explains what the app does with information, and what it does not do.

One policy, two apps. There is a BloomReads for iPhone and a BloomReads for Android. They are the same app and almost everything below is true of both. Where they genuinely differ — and in three places they differ a great deal — this page says which platform it is describing rather than writing one sentence that is only half true. The three are app blocking (section 9), advertising measurement (section 5, which happens on iPhone only) and where the support chat keeps its credential (section 6).

The short version. Your library lives on your phone and we have no server that holds it. We collect anonymous statistics about how the app is used. The app no longer records your screen — it used to during setup and the guided tour, and that stopped in this version (section 3). What we do now count, after setup, is whether you come back and roughly how much you read — as numbers, never as titles (section 4). The app also measures which advertisement brought you to it, and asks your permission before doing so (section 5). If you write to us in the support chat, that message reaches us (section 6). Photographs you take of your own books are saved on your phone and never sent to us (section 8). If you switch on app blocking, the Android app has to learn things the iPhone version never does — which apps you have, and which one is in front while you are reading — and none of it leaves your phone (section 9).

1. What changed in this version

One thing changed on 12 September 2026, on one platform only.

• App blocking arrived on Android, and it is not the same mechanism (section 9). The Android app can now hold back the apps you choose for the length of a reading session — the feature the iPhone has had for some time. What is behind it is different, because Android has nothing resembling Apple's Screen Time: to offer it at all the app has to read the list of apps installed on your phone, see which app comes to the front while a session is running, and draw over it. Section 9 used to say the app never learns which apps you chose or which you have installed. On Android that is not true — the apps you pick are stored by name, on your device. Section 9 now says so, names each of the three permissions and says what each is for. None of it is sent to us or to anyone else. Nothing about the iPhone version changed.

Two things changed on 11 September 2026, and unlike the last few revisions these are changes to the app, not corrections to this page. One collects less than before and one collects more.

• Screen recording has been removed (section 3). The app no longer records the screens you move through, during setup or anywhere else, and the recorder has been taken out of the build. Section 3 is kept, under its old heading and its old link, so that anyone who read the previous version can find out what happened to the thing it described. Recordings made before this date still exist at our analytics provider until they age out or are deleted on request — see sections 13 and 14.
• A small number of statistics now continue after setup (sections 2, 4 and 11). Until this version, measurement stopped when setup and the guided tour ended. It no longer does. Eleven events keep going: that you opened the app and how many days it had been, four one-off markers on day 1, 3, 7 and 14 saying you came back, that a book was added, that a reading session was recorded and how many minutes and pages it was, that you met your daily goal, that your streak grew, and that your Home Screen widget drew itself. Section 2 said your reading sessions never leave your phone, and for these figures that is no longer true — it now says so, and section 4 lists exactly what each one carries. No title, no author, no note and no photograph is in any of them.

Why the second change. The app's subscription screen is the last step of setup, so almost everything we knew about a reader stopped at the moment they were asked to pay. Whether the app is worth opening a week later is the question that decides what gets built next, and it was the one thing we had switched off.

Three things changed on 3 September 2026. All three are corrections to this page rather than changes to the app: nothing about what BloomReads does changed on this date, only what this page says about it.

• Photographs of your own books are now described (sections 2, 8 and 11). The app has always let you photograph the spine, edge or cover of a book you own, or pick a picture for it from your photo library, and keep that image on your shelf. The previous version of this page said, under Camera, that no photo is ever taken or saved. That was wrong. Photographs are taken, they are saved on your device, and they travel inside a backup file if you export one. What has never happened, and still does not, is any of them reaching us.
• The statistics section claimed more than the app collects (sections 4, 8 and 10). It described screens opened, buttons tapped, reading sessions started and finished, the size of your library, barcode scans and reminders opened. Measurement was narrowed to setup and the guided tour before that version was published, and none of those things has left your device since. Claiming more collection than happens is still an inaccurate privacy policy, so the list is now cut back to what the app actually sends.
• Your streak, and a short profile of your installation, are now named (sections 2, 4 and 7). A handful of figures — the length of your current streak, how many days you have opened the app, which session number you are on, when you installed it, whether you finished setup, whether you have a subscription — are kept against your installation's record and reach Amplitude, and most of them Superwall. Section 2 listed the streak among the things that never leave the phone. The number does leave, and it is now described where it belongs.

The version of 28 August 2026 made two corrections:

• Approximate location is now named (section 4). It was always happening and was never described. Our analytics provider works out a country, region and city from the internet address your device connects from. The app does not use your iPhone's location services and has never asked for location permission — but a country worked out this way is still information about you, so it belongs on this page under its own name.
• The app no longer asks for your first name (sections 3, 4 and 11). The field was removed from setup, and nothing sends a name anywhere. The previous version of this page still described it as an optional question. Those passages are gone rather than reworded, because the question itself is gone.

And the version of 25 August 2026 made four. All of them are kept here so the record of what changed is not lost:

• Advertising measurement was added (section 5). The previous policy said this app does not track you and does not ask for tracking permission. That is no longer true. The app now asks for permission through Apple's App Tracking Transparency prompt, and — only if you allow it — reads Apple's advertising identifier so we can tell which advertisement brought you here. The previous wording is corrected rather than quietly deleted, because it said the opposite of what the app now does.
• The support chat is described (section 6). It existed before and was not mentioned. What you type into it reaches us.
• Screen recording is narrower than we said (section 3). The previous policy said every session is recorded. That is no longer the case: recording now runs only during setup and the guided tour, and stops when they end. The rest of your time in the app is not recorded.
• Two more processors are named (section 7): Singular, which handles the advertising measurement, and Supabase, which hosts the support chat.

2. What stays on your device

All of the following is stored only on your phone. There is no account, no sign-in, and no server of ours that holds any of it:

• The books in your library — titles, authors, covers, page counts, ISBNs
• Photographs you take of a book you own — its spine, its edge or its cover — and any picture you choose from your photo library for a book (see section 8)
• Your reading sessions, including dates, durations and pages read
• Your notes, ratings and collections
• Your daily goal, reading challenge and reminder times
• The name you give your library, and how you have decorated the shelf
• Your theme, app icon and other settings
• The apps you chose for app blocking — as sealed tokens on iPhone, by name on Android (see section 9)

Two exceptions, so the list above is not misleading.

• The length of your current streak leaves your device as a number, on your installation's record — see section 4.
• Since 11 September 2026, when you record a reading session we are sent its length in minutes, how many pages it covered, the book's total page count, whether you logged it by hand and whether it finished the book. The same applies when a book is added: we are sent its page count, whether a cover was found and how it was added. Which book it was, we are not sent — each book carries a random identifier the app made up for itself, and no title, author, ISBN, note, rating or photograph goes with it. Your library still cannot be reconstructed from anything we hold. Section 4 lists every one of these.

The only way the rest of this leaves your device as data — your books, your sessions, your notes and the photographs you took of your own copies — is if you export a backup file and share it yourself. We never receive that file. (Until 11 September 2026 a screen recording could show some of it; that is covered in the next section.)

If you import your library from Goodreads, you choose the export file yourself and it is read on your device only. The file is not uploaded, and we never see it or anything in it.

The Home Screen widget reads a small snapshot file that the app writes on your device. The widget makes no network connections of any kind.

If you delete the app, all of it is deleted with it. You can also erase your library, sessions, collections and reminders at any time from Profile → Erase all data.

3. Screen recording — removed

The app does not record your screen. As of 11 September 2026 it records nothing, anywhere in the app, and the recorder is no longer in the build.

This section is kept, with its old number and its old link, because the previous version of this page described screen recording at length and anyone who read it deserves to find out what became of it. What follows is the record of a thing that stopped, not a description of something the app does.

What used to happen. Between 25 August and 11 September 2026, the app recorded the screens you moved through during two stretches — setting the app up for the first time, and the guided tour that followed — and sent those recordings to our analytics provider, Amplitude, so we could see where people got stuck. Every run of those two stretches was recorded; there was no sampling. Passwords, email addresses, card numbers, telephone numbers and any text you typed into a field during setup were masked and never appeared. Everything else on screen during those two stretches did appear, including book covers and titles shown during the tour and a photograph of your own copy if the shelf was showing one. Before 25 August, recording ran through the whole app rather than those two stretches. Nothing outside this app was ever recorded, at any point.

What happens to the recordings already made. They still exist at Amplitude, tied to the same random installation identifier as our other statistics (section 4) and to no name or Apple Account, until they age out under section 13. If you want the recordings from your installation deleted before then, write to us at the address in section 18 with roughly when you used the app, and we will delete what we can identify. That is the same right as before and it has not narrowed.

If screen recording is ever reintroduced, it will be described here in full and this page will be dated and changed before the build that does it ships.

4. The statistics we collect

We collect anonymous usage events. They fall into two groups, and the second one is new in this version:

• Product interaction, during setup and the guided tour — how far you get through setup, which step you left on, whether you added a first book, whether you set reminders, and the same for the guided tour that follows.
• Eleven events afterwards, and only these eleven — added on 11 September 2026, because whether the app is worth opening a week later is the question that decides what we build next. In full, with everything each one carries:
  • You opened the app — how many days since you installed it, which session number this is, how many separate days you have opened it, and whether this is the first time today.
  • You came back — four one-off markers, on day 1, 3, 7 and 14, each recording which day you actually returned on.
  • You came back after a long gap — how many days you were away.
  • A book was added — how it was added, its page count, whether a cover was found, what status you gave it, and how long the whole thing took.
  • A reading session was recorded — its length in minutes, the pages it covered, the book's total page count, whether you logged it by hand or timed it, and whether it finished the book.
  • You met your daily goal — the minutes you read, the goal you had set, and your streak length.
  • Your streak grew — its new length, its previous length, and your goal.
  • Your Home Screen widget drew itself — its size and appearance settings, and how many books fitted on it.
  Two of these mention a book. Neither says which book. Each carries a random identifier the app generated for that book on your device, and no title, author, ISBN, cover, note, rating or photograph travels with it.
• Everything else you do still goes nowhere. Which screens you open, which tabs you touch, what you search for, how you arrange your shelves, what you decorate them with, the notes and ratings you write — all of it is measured inside the app for its own use and none of it leaves your phone.
• Diagnostics — when an operation fails during those same two stretches, and why. An error that happens later is dealt with on your phone and reported nowhere
• Subscription events — whether a subscription screen appeared, whether a purchase, trial or restore succeeded, which plan was bought, and its price and currency
• Device and app context — app version, build, iOS or Android version, device model, language, time zone
• Approximate location — the country, region and city that our analytics provider works out from the internet address your device connects from. This is not read from your phone: the app does not use location services and never asks for location permission. It is worked out from the connection itself, the way it is for any website you visit. We use it to know which countries our readers are in, and which countries an advertisement actually reached. It is not a street address, cannot locate you within a city, and is never used to build a profile of you or shown to anyone else.

This data is attached to a random identifier generated by the app on first launch and stored on your device. It identifies an installation, not a person. It is a value the app makes up for itself, and deliberately none of the identifiers either platform hands out: not Apple's Identifier for Vendors (IDFV) or Identifier for Advertisers (IDFA), and on Android not the Google advertising ID and not ANDROID_ID. Those are the identifiers that can follow you between apps, which is exactly why none of them is used here. The separate question of the advertising identifier is dealt with in section 5.

These events carry no content. Where a statistic needs to know whether you typed something, the app records how long what you typed was, or simply that a field was filled in — never the characters themselves. A search sends us the length of your query and how many results came back; it does not send the query.

Your installation's profile. Separately from the events above, a short list of figures is kept against your installation's record and updated when it changes:

• the length of your current reading streak, as a number — never the sessions, books, pages or dates behind it;
• how many days you have opened the app, and which session number you are on;
• the day, week and month you installed it, and how long ago that was;
• whether you finished setup, and whether you currently have a subscription;
• your answer to the tracking prompt in section 5 — iPhone only, because Android has no such prompt;
• the device and app context listed above.

All of it goes to Amplitude. Six of these figures — your streak, the days you have been active, your session number, the week you installed, how long ago that was, and whether you finished setup — also go to Superwall, where they decide which subscription offer you are shown. Both are attached to the same random installation identifier and to nothing else.

Your setup answers. Separately again, the answers you give while setting the app up leave your device and go to our subscription provider, Superwall, which uses them to decide which subscription offer to show you and to write it in your own terms — the name you gave your library in the headline, for example. Those answers are:

• how many books you read a year, and the totals the app works out from that;
• how many hours you say you spend on your phone, and how many minutes a day you want to read;
• the name you gave your library, and the theme, backdrop, material and ornament you chose for it;
• whether you added a first book and what status you gave it — not which book;
• whether you turned reading reminders on.

None of these answers is published, sold, or used to identify you.

5. Advertising measurement, and the permission we ask for

This whole section is about the iPhone app. The Android app carries no advertising measurement at all: no attribution provider, no advertising identifier, no install-referrer tracking, and nothing that asks. If you are reading this on Android, none of what follows happens to you — it is kept here, in full, because the same policy covers both apps and describing only the quieter one would be the kind of omission this page exists not to make.

This section replaces a passage in the previous policy that said the opposite. That version said the app did not read the advertising identifier, did not track you, and did not ask for tracking permission. Since advertising measurement was added, none of those three statements is correct, and the honest thing is to say so plainly rather than edit them out.

What we do. We advertise the app. To know whether an advertisement was worth running, we need to be able to tell that an install, and a later subscription, came from a particular advertisement. Our attribution provider, Singular, does that measurement for us.

The permission. Shortly after you first open the app on an iPhone, iOS shows Apple's App Tracking Transparency prompt, asking whether the app may track you across apps and websites owned by other companies. Your answer decides what follows:

• If you allow it, the app may read Apple's Identifier for Advertisers (IDFA) and pass it to Singular, which uses it to match your install to an advertisement you saw in another app. Under Apple's definition, this is tracking, and it is why the prompt is shown.
• If you decline, no advertising identifier is read and none is sent. iOS additionally blocks the app from contacting Singular's servers, and we have declared Singular's domains to Apple so that this blocking works as intended.

You can change your answer at any time in the iPhone Settings app, under Privacy & Security → Tracking.

What is measured either way. Separately from the prompt, Apple operates its own privacy-preserving measurement system, SKAdNetwork. Apple's servers — not your phone — send our advertising partners an anonymous, aggregated report saying that an install or a purchase happened. It contains no identifier for you and we cannot connect it to a person. This works whether or not you allowed tracking, because Apple designed it to.

What is never sent for advertising. Nothing about your library, your reading, your notes, your goals or your setup answers is sent to Singular or to any advertising partner. What travels is that an install happened, that a subscription or trial began, and the identifiers described above.

We do not sell personal information, and we do not share it with data brokers. Some privacy laws, California's among them, use the word share broadly enough to cover what is described above — handing an advertising identifier to a measurement partner. To be exact rather than reassuring: that is the only sharing that happens, it happens only if you allowed the tracking prompt, and turning this app off under Privacy & Security → Tracking stops it.

6. The support chat

The app has a support chat, reachable from Home and from Profile. It is the one place in the app where words you write leave your phone.

• What is sent. The message you type, and — attached to it — your app version, iOS or Android version, device model and language. Nothing about your library travels with it: not a title, not an author, not a note. You choose every word that goes.
• Where it goes. To a database we run on Supabase, and to us. It is not passed to any other processor.
• How a conversation is identified. By a random device identifier and a secret, both created on your phone the first time you write to us. We store only a hash of the secret, so the copy on your phone is the only one that exists — which is what stops anyone else reading your thread. There is no account and no name attached.
• Where that pair is kept, and whether it survives a reinstall. This is one of the places the two apps genuinely differ. On iPhone the pair lives in the Keychain, which normally outlives deleting and reinstalling the app, so somebody who reinstalls to fix the very problem they wrote in about comes back to their conversation rather than to a blank one. On Android there is no equivalent we are willing to use — the mechanisms that would survive an uninstall do so by putting the value in a Google backup, which is a copy of your secret somewhere we cannot see. So on Android the pair is kept in the app's own private storage, deliberately excluded from both of Android's backup mechanisms: it does not travel to a second phone, and uninstalling the app ends the conversation — reinstalling starts a blank one. On both platforms it is used for nothing else and never leaves your device except to name your thread.
• How long it is kept. Until you ask us to delete it, or until we close and clear the conversation. To have a thread deleted, write to the address in section 18 from the app, or tell us roughly when you wrote and what about.

7. Who else receives data

We use a small number of processors. Each receives only what it needs.

How book searches work. The four catalogues are asked at the same time rather than one after another, and whichever answers first is what you see. So a single search sends your search term to all four. Each receives that one term and nothing else: no identifier of yours, no part of your existing library, and no account, because the app has none. Apple's catalogue is additionally told your store region, so that a reader in Spain is offered the Spanish edition. The catalogues are contacted only when you actively search, scan or add a book, and when a cover image is fetched.

8. Camera and photographs

The camera is used for two different things, and the app asks for camera permission the first time you reach either one.

Scanning a barcode. You can add a book by scanning the barcode on its back cover.

• The camera feed is used to read the barcode and nothing else. It is processed live on your device.
• No photo is taken or kept by the scanner. What it produces is a number — the ISBN — which is sent to the book catalogues in section 7 to look the book up.

Photographing your own copy. You can also photograph the spine, the edge or the cover of a book you own, so that the shelf shows your copy rather than a stock jacket. You can choose a picture from your photo library for the same purpose instead.

• A photograph is taken, and it is saved. It is straightened, scaled down to the size the shelf draws it at, and stored on your device alongside the book.
• It is never sent to us. There is no upload and no server of ours holds a copy. It leaves your device only inside a backup file that you export and share yourself — or if it happens to be on screen during setup or the guided tour, which is what section 3 is about.
• When you choose from your photo library, the app uses the system picker — Apple's on iPhone, Android's own on Android — which hands over the one picture you picked. The app cannot see the rest of your photos and never asks for access to them, on either platform.
• You can remove a photograph at any time from the book's own page, and deleting the app deletes every one of them.

Camera permission is optional for both. You can still add books by searching or by typing them in, a book without a photograph simply shows its catalogue cover, and you can withdraw the permission at any time in your phone's Settings app.

9. App blocking

If you turn on app blocking, the app holds back the apps you choose for the length of a reading session you started. How that is done is completely different on the iPhone and on Android, and the difference is one you should be told rather than one we would rather leave unsaid: the Android app learns things the iPhone app is never permitted to learn.

On iPhone

Handled entirely by Apple's own system — Screen Time, which Apple calls Family Controls:

• You pick the apps in Apple's picker, not ours.
• What we receive back are opaque tokens. The app never learns which apps you chose, which apps you have installed, or how long you spend in any of them.
• The selection is stored on your device only. It is never sent to us or to anyone else.
• It is used for one thing: applying a shield while a reading session is running, and lifting it when the session ends.

On Android

Android has no equivalent of Apple's sealed picker, at any layer. To offer the same feature the app needs three permissions, and each one is something the iPhone version does not do:

• The list of apps installed on your phone. There is no other way to draw a picker for you to choose from. The app reads the list to show it to you, and for nothing else.
• Usage access. This is how the app knows which app has come to the front — the only way Android can answer that question. It is read moment to moment while a reading session is running and at no other time, it is never written down, and no history of what you opened is kept anywhere.
• Permission to display over other apps. This draws the cover over an app a session has shut out. It draws nothing at any other time.

The apps you choose are stored by name, on your device. That is the honest difference from the iPhone, where they are sealed tokens we could not read even if we wanted to. They are kept with the rest of your settings, which means they are included in Android's own backup of the app to your Google account — the same way your theme and your reading goal are, and the reason your choices are still there when you set up a new phone. That backup goes to your Google account, not to us; we have no access to it and never receive it.

None of it is ever sent to us or to anyone else. Not which apps you have installed, not which ones you chose, not which app you had open, not how long you were in it. Our statistics may count how many apps you chose — a number, never a name.

App blocking is optional on both platforms, and everything else in the app works without it. On iPhone you withdraw Screen Time permission in the Settings app. On Android the two permissions are withdrawn separately, each in its own Android Settings screen, and blocking stops the moment either one is gone.

10. Notifications

If you allow notifications, reminders are scheduled on your device by the operating system — iOS or Android. We do not operate a push server and cannot send you anything remotely. Whether you turned reminders on during setup, and the times you picked there, are part of the setup answers in section 4. After setup, nothing about your reminders is sent anywhere at all — not that one was scheduled, not that one was delivered, not that one was opened, and never its contents.

11. What we deliberately do not collect

• Your library, as data. No book title, author, ISBN, note, rating or search query is ever sent to us as an event or a record, and neither is any photograph you took of a book. We hold no copy of your library and could not reconstruct it. Two events since 11 September 2026 say that a book was added or read and how long it was — never which one; see section 4. The screen recordings described in section 3 could show a title on screen, and those stopped being made on the same date.
• Your identity. No email address, phone number, contacts, and no location from your phone — the app does not use location services and has never asked for location permission. (The approximate country and city worked out from your internet address are a different thing, and are described in section 4.) The app does not ask your name. The only things you tell us about yourself are whatever you choose to write in the support chat, and the name you give your library — which is yours to invent. We never receive a photograph either: the pictures you take or choose for your books stay on your device (section 8).
• Your reading, for advertising. Nothing about what or how you read is ever sent to an advertising partner. See section 5.

12. Children

BloomReads is not directed at children under 13, and we do not knowingly collect information from them. There is no account, no profile and no way to communicate with anyone else through the app apart from writing to us. If you believe a child has provided us with information, contact us and we will delete it.

13. How long we keep things

Anonymous usage events, attribution records, and the screen recordings made before 11 September 2026 are retained by our providers for as long as the product needs them, and are deleted on request. Support conversations are kept until deleted, as described in section 6. Everything else lives on your device for as long as you keep the app.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict processing, to opt out of the sale or sharing of personal information, and to lodge a complaint with a supervisory authority.

Because the app has no account, our records are tied to a random installation identifier rather than to you, so in most cases we have no way to connect a request to a specific person. In practice:

• To delete everything on your device: Profile → Erase all data, or delete the app. Note that Erase all data clears your library, sessions, collections and reminders; it does not reach statistics already sent, or recordings sent before 11 September 2026.
• To stop any further data being sent: delete the app. A later reinstall starts a new identifier that is not connected to the old one.
• To stop advertising measurement without deleting the app: turn this app off under iPhone Settings → Privacy & Security → Tracking.
• To have an analytics record, a recording or an attribution record deleted: email us at the address below with whatever you can tell us about the installation and roughly when you used the app, and we will delete what we can identify.
• To have a support conversation deleted: email us, ideally from the same device, and say roughly when you wrote.

Our legal basis for processing under the GDPR is our legitimate interest in understanding how the app is used and in keeping it working, your consent where the App Tracking Transparency prompt has been allowed, and the performance of our contract with you for the subscription itself.

15. Security

Data in transit is encrypted with HTTPS. Data on your device is protected by iOS's own file protection. The support chat's secret is held in the iPhone Keychain and never leaves the device. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. International transfers

Our providers, including Amplitude, Superwall, Singular and Supabase, process data in the United States. Where required, transfers rely on the European Commission's Standard Contractual Clauses.

17. Changes

If we change this policy we will update the date at the top and, for anything significant, tell you in the app.

18. Contact

Questions, requests or complaints:

Email: abeto.studio@gmail.com