Privacy Policy

Last updated: March 14, 2026

This Privacy Policy describes how micro-bloom ("we", "our", "the App") collects, uses, stores and protects your personal data when you use our iOS mobile application and our website microbloom.app.

micro-bloom is published by Cyril BESLAY, an independent developer based in France. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and applicable French data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

Cyril BESLAY
Email: contact@microbloom.app
Country: France

2. Data We Collect

2.1 Data you provide

Data	Purpose	Legal basis (GDPR)
Email address	Account creation, service communications, waitlist	Performance of contract (Art. 6.1.b)
First name (optional)	Personalizing the experience	Consent (Art. 6.1.a)
Wellness preferences (available time, energy state)	Personalizing suggested activities	Performance of contract (Art. 6.1.b)
Journaling entries	App functionality, stored locally on your device	Performance of contract (Art. 6.1.b)

2.2 Data collected automatically

Data	Purpose	Legal basis (GDPR)
Usage data (completed activities, duration, frequency)	Improving activity matching, tracking micro-accomplishments	Legitimate interest (Art. 6.1.f)
Technical data (device model, iOS version, app version)	Technical diagnostics, compatibility	Legitimate interest (Art. 6.1.f)
Anonymous identifier	Aggregated usage analytics	Legitimate interest (Art. 6.1.f)

2.3 Data we do NOT collect

Health data as defined by the GDPR (special category, Art. 9)
Geolocation data
Contacts or address book
Photos, videos or files from your device
Advertising identifiers (IDFA) — we do not display ads
Cross-app tracking data (App Tracking Transparency)

3. Data Hosting and Location

All your data is hosted in Europe.

We use Supabase as our database infrastructure, configured on servers located within the European Union (EU region). Your personal data is not transferred outside the European Economic Area (EEA).

Journaling entries are stored exclusively on your device (local storage) and are never transmitted to our servers, unless you explicitly enable synchronization.

4. How We Use Your Data

We use your data exclusively to:

Provide and improve the micro-bloom service
Personalize activities based on your available time and energy state
Track your micro-accomplishments and progress
Send you service-related communications (updates, account security)
Analyze usage in an aggregated and anonymized manner to improve the app

We never sell your personal data. We do not use your data for advertising purposes.

5. Data Sharing

Your personal data may be shared with the following technical service providers, solely for the operation of the service:

Provider	Purpose	Location
Supabase	Database and authentication	EU (Frankfurt)
Brevo (formerly Sendinblue)	Transactional email delivery	France / EU
Apple (App Store / StoreKit)	In-app purchase and subscription management	International (Apple policy)
Vercel	Website hosting	EU / International

Each of these providers is bound by a GDPR-compliant Data Processing Agreement (DPA). We do not share your data with any other third party.

6. Data Retention

Account data: retained as long as your account is active, then deleted within 30 days of a deletion request
Usage data: anonymized after 24 months of inactivity
Waitlist: emails deleted within 6 months of launch if not converted to an account
Local journaling: stored on your device only, deleted when you uninstall the app

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Right of access (Art. 15) — obtain a copy of your personal data
Right to rectification (Art. 16) — correct inaccurate data
Right to erasure (Art. 17) — request deletion of your data
Right to data portability (Art. 20) — receive your data in a structured format
Right to object (Art. 21) — object to processing based on legitimate interest
Right to restriction (Art. 18) — restrict the processing of your data
Right to withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise these rights, contact us at contact@microbloom.app. We will respond within a maximum of 30 days.

8. Account Deletion

You can delete your account and all associated data directly from the app (Settings → Delete my account). This action is irreversible and results in the deletion of all your personal data from our servers within 30 days.

In compliance with Apple requirements, this feature is accessible from within the app.

9. Security

We implement appropriate technical and organizational measures to protect your data:

Encryption in transit (TLS 1.2+) and at rest
Secure authentication via Supabase Auth
Data access restricted on a need-to-know basis
Hosting on certified infrastructure (SOC 2 Type II)

10. Children

micro-bloom is not intended for children under 16 years of age, and we do not knowingly collect personal data from minors. If you become aware that a child has provided us with personal data, please contact us so we can proceed with its deletion.

11. In-App Purchases and Subscriptions

Premium subscriptions are managed through Apple StoreKit. Payment data (credit card, billing information) is processed exclusively by Apple and is never transmitted to us. We only receive confirmation of your subscription status.

12. Changes to This Policy

We reserve the right to modify this Privacy Policy. In the event of a material change, you will be notified via the app or by email at least 15 days before the changes take effect.

13. Complaints

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority:

www.cnil.fr

If you are located outside France, you may also contact your local data protection authority.

14. Contact

For any questions regarding this Privacy Policy or your personal data:

Email: contact@microbloom.app