Privacy policy

Overview

The app is local first. There is no account, and your check-ins and reflections are never synced to the cloud. The app does not use your check-ins or reflections for advertising. Profile details, assessment answers and results, check-ins, reflections, card activity, and settings are stored on the device with SwiftData. Subscription purchases and entitlement checks are handled by Apple and RevenueCat using an anonymous app user ID.

The app does send first-party product analytics to help improve it: bounded usage events, time spent, broad profile groups, and how the user heard about the app, with no check-in or reflection text, tied to an anonymous device id. It is on by default and can be turned off from Settings under privacy and legal, Product analytics. See "Product analytics" below.

The app also has an optional contact form. A user chooses a topic and sends a reply email address and message to contact@cloudforge.fr. The message travels through the app's AWS service and Amazon SES in Europe (Ireland). It is used only to answer the inquiry, provide support, handle feedback, or respond to a privacy request.

AI reflections are optional. Before the first check-in is saved, the app explains what will be sent, identifies AWS and Anthropic, and asks for explicit permission. A declined check-in is not saved or sent.

Information stored on the device

• An optional display name. If it is blank, the app uses friend.
• Relationship context.
• The 36 assessment answers, anxiety and avoidance scores, and broad attachment pattern.
• Check-in mood and its intensity, selected patterns, what happened, what would help, optional context, and free-text note.
• Generated reflections and their status.
• Card likes and other app activity.
• The local ritual baseline and whether the subscription gate has activated.
• AI sharing permission, policy version, and permission update date.
• App Attest credentials in the Apple Keychain.
• RevenueCat's cached anonymous customer and entitlement information.

The display name stays on the device and is not included in AI requests.

Information sent for an AI reflection

After permission is granted, a reflection request sends:

• The current check-in mood and its intensity, selected patterns, what happened, what would help, optional context, and note.
• Relationship context.
• The attachment pattern and anxiety and avoidance percentages.
• Your gender and age range from your profile.
• Summaries of your check-ins from the last seven days, including date, mood, patterns, and a short note excerpt, plus a short rolling summary of older check-ins.
• A request content hash and an App Attest device credential used for security, quota enforcement, and duplicate-request handling.
• Operational request details such as status, latency, token counts, safety result, and technical diagnostics.

The request travels over HTTPS to the app's AWS service. That service sends the reflection prompt to Anthropic's API and returns the generated reflection to the device.

Information used for subscriptions

The app uses RevenueCat to load products, check trial eligibility, process purchases, restore purchases, and verify the full_access entitlement. RevenueCat receives an anonymous app user ID, App Store product and transaction information, purchase records, entitlement status, and technical diagnostics needed to provide and measure the subscription service.

The app does not send profile details, assessment answers, check-ins, reflections, or card content to RevenueCat. RevenueCat purchase records are used for app functionality and subscription analytics, not advertising or tracking.

Information sent through the contact form

The optional in-app contact form sends:

• The selected topic: app issue, question, feedback, or privacy request.
• A required reply email address.
• The message the user writes.
• A random request ID used to avoid duplicate delivery after a retry.
• App version, build number, iOS version, and UTC offset for support context.
• The App Attest session credential used to verify the app install and enforce a five-message daily limit.

The app never adds the user's profile, assessment, check-ins, reflections, card activity, or product analytics to a contact request. The AWS contact Lambda sends the message through Amazon SES in Europe (Ireland) to contact@cloudforge.fr and sets the user's email address as the Reply-To address.

The contact message and email address are not written to DynamoDB or CloudWatch logs. DynamoDB keeps a content-free duplicate marker for about 24 hours and a content-free daily-limit counter for about 48 hours. CloudWatch logs keep only the topic, field lengths, delivery outcome, SES message ID, environment, and a hashed device credential. The delivered inquiry remains in the contact@cloudforge.fr mailbox as long as needed to answer it, handle a privacy or legal request, prevent abuse, and keep necessary business records. It is deleted when it is no longer needed.

How the information is used

Information is used only to:

• Generate the requested reflection.
• Protect the service with Apple App Attest.
• Enforce a per-device usage limit.
• Avoid charging twice for the same retried request.
• Monitor reliability, performance, safety outcomes, and abuse.
• Understand how the app is used so it can be improved (product analytics, below).

The app does not use your check-ins, reflections, or product analytics for advertising, data broker activity, or building an advertising profile.

Product analytics

To improve the app, it sends a stream of first-party usage events to the same AWS backend. What is sent is intentionally small and bounded:

• Bounded event names (for example, that a check-in was created, a screen was viewed, the paywall was shown, or a purchase started) and a few typed properties that are always short tokens or coarse buckets (for example, a card category, a plan name, a low/medium/high attachment band, or a bucketed streak length).
• Foreground and screen durations, capped at one day per event.
• Broad profile categories: age range, gender identity, and relationship context. These use the choices shown in the app, including prefer not to say and unknown, never an exact age or free-form answer.
• The onboarding answer to how the user heard about the app, such as App Store search, TikTok, Instagram, a creator or podcast, or friend or family. This is a closed choice, never free-form text.
• The app version, the operating system version, the device model class (for example, iPhone16,2), and a per-session id.
• The same anonymous App Attest device credential already used for reflections, hashed before it is logged. There is no account, name, email, or advertising id.

What is never sent: the check-in note, the reflection text, the display name, an exact age, raw assessment scores, or any free-form profile content.

Product analytics is on by default and can be turned off at any time in Settings under privacy and legal, Product analytics. The detail page explains what is sent, then the user taps Turn off product analytics and confirms. Turning it off stops collection immediately and deletes the small on-device queue of not-yet-sent events. This is first-party analytics used only to improve the app; it is not advertising, not cross-app tracking, and the data is not shared with data brokers.

Model training

Anthropic states that inputs and outputs from its commercial API are not used to train its generative models unless a customer explicitly opts in. This service does not opt in.

Current Anthropic commercial data guidance: https://privacy.anthropic.com/

Retention

Current service retention is:

AWS logs exclude check-in notes and generated reflection text. Product analytics events contain only the bounded fields described above. The reflection is stored locally on the device after it is returned. Not-yet-sent analytics events are queued on the device and removed once delivered, on opt-out, or on erase.

Deleting app data does not cause immediate deletion of short-lived service records. Those records expire under the schedule above.

Apple and RevenueCat keep purchase and subscription records under their own legal, fraud prevention, and service retention requirements. Erasing local app data does not cancel a subscription or erase App Store purchase records.

Permission and privacy choices

AI sharing can be turned off at any time in Settings under privacy and legal, AI reflections. Turning it off:

• Cancels active reflection work.
• Stops automatic retries.
• Keeps unfinished entries on the device.
• Does not delete completed reflections stored locally.

Turning AI sharing on again does not upload old entries automatically. The user must explicitly ask to generate a reflection for an existing paused entry.

Product analytics can be turned off separately in Settings under privacy and legal. Turning it off stops collection and deletes the on-device queue of unsent events; turning it back on resumes collection with no backfill of the gap.

Settings also offers erase my app data. After two confirmations, this erases the profile, assessment answers and result, check-ins, reflections, card activity, preferences, local subscription milestone, and App Attest Keychain credentials from the device. The first-party card catalog remains so the app can start again. Subscription management and cancellation remain available through the App Store.

Daily reminders are optional and can be turned on or off in Settings under reminders. They are scheduled on the device with the system notification framework. The reminder text is a short, generic nudge, or wording the user typed, and never includes check-in content. Turning reminders on does not send anything to AWS or Anthropic, and the reminder settings are erased with the rest of the local data.

Security

Requests use HTTPS. The AWS service is protected by Apple App Attest, rate limits, a per-device quota, and restricted concurrency. Provider credentials are stored in AWS Systems Manager Parameter Store as encrypted values and are not included in the iOS app.

Website

The public Bloom website is hosted with AWS Amplify Hosting. When someone visits the site, AWS may process standard request information such as the IP address, browser and device details, requested pages, and request timestamps to deliver and protect the site.

The website does not use analytics, advertising trackers, cookies, accounts, or contact forms. The iOS app contact form is described above.

Contact

Questions and privacy requests can be sent to contact@cloudforge.fr.

App Store privacy declarations

Mirror code/MobileApp/PrivacyInfo.xcprivacy in App Store Connect:

Name is excluded because it does not leave the device.

First-party product analytics is covered by the Product Interaction and Other Data Types rows; the last row covers the broad age, gender, and relationship categories plus the onboarding referral source, and those events are first party, bounded, and never shared with data brokers.

The Device ID row covers the App Attest device credential, which is hashed server-side and used to protect the service and join first-party analytics. This version does not include any advertising SDK, collects no advertising identifier, and does not track users across apps or websites, so NSPrivacyTracking is false and the Device ID is not used for advertising.

Reference material

• Apple App Privacy Details: https://developer.apple.com/app-store/app-privacy-details/
• Apple App Review Guidelines: https://developer.apple.com/app-store/review/guidelines/
• Anthropic commercial retention: https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
• RevenueCat privacy: https://www.revenuecat.com/privacy/