Privacy Policy
Last updated: 2 November 2026
Bloomara is a journal and emotional companion for pregnancy. You write very personal things in it, so we want this page to be plain and exact. It describes what the Bloomara app (iOS and Android) and this website actually collect.
1. Who is responsible
The data controller is SIAFY TEKNOLOJİ DANIŞMANLIK SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Yavuztürk Mah. Çiçek Dağı Sk. No: 5/1, Üsküdar, İstanbul, Türkiye. Contact: info@siafy.co.
2. No account: how your identity works
- Bloomara does not ask for an email address, phone number or password.
- When you first open the app, it creates a random device ID. Your data on our server is linked to that ID.
- The app gives you a recovery code. With it you can restore your story on a new phone. Your personal data is deliberately excluded from iCloud and Android backups, so without the recovery code we cannot move your data to a new device.
- We do not use the advertising identifier (IDFA / AAID) and do not track you across other apps or websites.
3. What we collect
| Category | What | Why | Kept for |
|---|---|---|---|
| Device and settings | A random device ID, platform, app version, time zone, language, notification settings, push token, role (mother or partner), journey status and premium status | Running the app, delivering notifications at the right local time | Until you delete your data |
| Profile | Your first name, your baby’s nickname, due date or starting week, your intentions, and the baby’s birth date if you add it | Personalising the app and the weekly chapters | Until you delete your data |
| Moods | Your daily mood and an optional short note | Empathetic replies, your weekly summary, and (only if you allow it) a mood emoji for your partner | 12 months, then reduced to anonymous counts |
| Journal | Journal entries and the daily question they answer | Your own journal and documentary | Until you delete them |
| Letters | Letters to your baby, their opening date and whether you shared them with your partner | Your time capsule and documentary | Until you delete them |
| Photos | Bump photos you add, their week and caption | Your bump timeline, bump video and documentary | Until you delete them |
| Voice notes | Audio you record (voice notes, affirmations in your own voice) and their length | Playing them back to you | Until you delete them |
| Mira reflections | Weekly reflections written by Mira (AI) from your own entries | Showing them to you and adding them to your documentary | Until you delete them |
| Saved items and progress | Saved affirmations, completed missions, chapters read, milestones shown | Your progress in the app | Until you delete your data |
| Partner link | The link between your two devices, your partner’s first name, notes, partner missions, partner letters, shared lists (hospital bag, baby names and votes) | Partner mode | Until either of you deletes it or disconnects |
| Partner gifts | Gift type, optional note, store transaction ID and status | Delivering the gift and keeping accounting records | Transaction record 10 years (tax law); the personal note is deleted with your data |
| Consent records | Which consent you gave or withdrew, version and date | Proving consent as the law requires | Until you delete your data, or longer where the law requires |
| Purchases | Subscription status and purchase history, via RevenueCat and the App Store or Google Play | Unlocking Premium and restoring purchases | As long as needed for the subscription and tax law |
| Notification log | Which notification was sent and when | Avoiding repeats | 90 days |
| Mira usage | Type, date and token count of Mira requests (no text) | Fair-use limits and cost control | 13 months |
| Usage analytics (optional) | App events such as “screen opened” or “letter sealed”, without the content you write and without mood values or other pregnancy data | Understanding which parts of the app help | At most 14 months (Firebase retention setting) |
| Crash reports (always sent) | Sent automatically when the app crashes or hits an unexpected error: the technical error and stack trace, app version, operating system version, device model, free memory and disk space, time of the crash and a random Crashlytics installation ID. They never contain your name, journal entries, letters, notes, photos, voice notes, moods or pregnancy dates | Finding and fixing bugs | Up to 90 days in Crashlytics |
What we do not collect
- Weight, symptoms, contractions, appointments, medical history or previous losses. Bloomara has no medical tools.
- Your location, contacts or browsing history.
- Your email address or phone number (unless you email us yourself).
- Advertising identifiers. There are no ads and no Meta (Facebook) SDK in Bloomara, and we never sell data.
4. Pregnancy data is sensitive
Your due date, your moods and what you write about your pregnancy can count as health data under the GDPR (art. 9) and as special category data under Turkey’s KVKK (art. 6). We process it only with your explicit consent, which you give on the consent screen when you start. You can withdraw it at any time by deleting your data in the app.
5. Legal bases
- Explicit consent (GDPR art. 9(2)(a) and 6(1)(a); KVKK art. 6 and 5(1)): storing your pregnancy-related content.
- Consent (GDPR art. 6(1)(a)): Mira’s personal features and usage analytics. Both are optional and off unless you turn them on.
- Contract (GDPR art. 6(1)(b)): providing the app, partner mode, subscriptions and gifts you buy.
- Legal obligation (GDPR art. 6(1)(c)): keeping transaction records for tax and accounting.
- Legitimate interest (GDPR art. 6(1)(f)): keeping the service secure and preventing abuse (for example rate limits), and crash reports, which are always sent so we can find and fix bugs. They contain no content you write (see the table in section 3).
6. Mira (AI)
- Mira is an AI voice. Everything she produces is labelled as AI in the app.
- Without your consent, Mira only plays general audio that contains no personal data.
- If you turn on Mira’s personal features: (a) your first name and your baby’s nickname are used to create short personal audio clips, which we cache on our storage; (b) when you ask for a weekly reflection or letter help, the entries you wrote that week are sent to Google’s Gemini API to write the text. We use the paid Gemini API tier, under which Google does not use your entries to train or improve its models; Google may keep requests for a limited time only to detect abuse. Reflections are saved so you can keep them; letter drafts are not stored.
- Mira does not chat, does not give medical advice and never shares your entries with your partner.
- You can turn the personal features off at any time in Privacy & Data. Cached personal clips are then deleted, and you can choose to delete past reflections too.
7. What your partner can see
| Data | Visible to your partner? |
|---|---|
| Your first name, week, baby card and weekly story | Yes, while you are connected |
| Mood (last 7 days, emoji only) | Only if you turn it on |
| Mood notes, journal entries, voice notes, Mira reflections | Never |
| Hard-day alert | On by default; you can turn it off |
| Milestones, and the fact that you wrote a letter | Yes by default; you can turn it off |
| Letter content | Only letters you choose to share |
| Bump photos | Only if you turn it on |
| Whether you have Premium | Only “has Premium” |
| Shared lists (hospital bag, baby names) | Yes, they are shared by design |
Either of you can disconnect at any time.
8. Where your data is stored
Our API, database and media storage run on servers rented from Hetzner Online GmbH in data centres in Germany and Finland (European Union). Mira’s voice is generated on our own server in the same environment.
9. Service providers (subprocessors)
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Servers, database, media storage, backups | All app data described above | Germany, Finland (EU) |
| RevenueCat, Inc. | Subscription and purchase status | Device ID, purchase history | USA |
| Apple and Google | App Store / Google Play purchases, push notification delivery | Purchases, push token, notification text | USA / global |
| Expo (650 Industries, Inc.) | Push notification relay | Push token, notification text | USA |
| Google Firebase Analytics and Crashlytics | Usage analytics (only with your consent) and crash reports (always sent) | App events without content or pregnancy data; crash diagnostics without any content you write | USA |
| Google LLC (Gemini API, paid tier) | Writing Mira reflections and letter drafts, only with your consent. Not used to train Google’s models | The entries needed for that one request, your first name and your baby’s nickname | USA / global |
Where a provider is outside the EU/EEA, transfers rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework (and the UK equivalents). For transfers from Turkey we follow KVKK art. 9. We never share your data with advertisers or data brokers.
10. Security
Data travels between the app and our servers over encrypted connections (HTTPS/TLS). Access to the servers is restricted to the people who run Bloomara. To be honest about it: your content is not end-to-end encrypted. It is stored on our servers so that partner sharing, restoring with a recovery code and the documentary can work.
11. Retention
We keep your data until you delete it, with the exceptions in the table above (moods 12 months, notification log 90 days, Mira usage counts 13 months, gift transaction records 10 years). After you delete your data, it disappears from our backups within 30 days.
12. Export and deletion
- Export: Profile → Privacy & Data → Export. You get a ZIP with your journal, letters, moods, photos, voice notes and reflections. Free on every plan.
- Delete: Profile → Privacy & data → Delete all my data. This permanently removes your data from our servers, including your RevenueCat customer record. See also bloomara.app/delete.
- If you no longer have the app, email info@siafy.co with your recovery code and we will delete your data.
- Deleting the app from your phone does not delete data on our server. Please use the in-app option first.
- Store subscriptions are managed by Apple or Google. Cancel them in your store settings.
13. Your rights
Wherever you live, you can ask us to:
- give you a copy of your data (access and portability),
- correct it, delete it or restrict how we use it,
- stop processing based on legitimate interest (objection),
- withdraw consent at any time, without affecting earlier processing.
These rights come from the GDPR (EU), the UK GDPR and, for Turkey, KVKK art. 11 (see our KVKK notice in Turkish). Most of them you can use directly in the app. Otherwise email info@siafy.co; we answer within 30 days. Because there are no accounts, we may ask for your recovery code to confirm the data is yours.
You can also complain to a data protection authority: in the EU, the authority of the country you live in; in the UK, the Information Commissioner’s Office (ICO); in Turkey, the Personal Data Protection Authority (KVKK).
14. Children
Bloomara is meant for adults. It is not directed at children, and we do not knowingly collect data from anyone under 16. Your baby’s nickname and birth date are data you choose to add about your own child.
15. This website
bloomara.app is hosted by Vercel Inc. (USA). It uses Vercel Web Analytics, which counts page views without cookies and without identifying you. The website sets no advertising or tracking cookies. Vercel processes technical data such as your IP address to deliver the pages.
16. Changes
If we change this policy in a way that affects how your data is used, the app will tell you and, where the change needs your consent, ask again for only that change.
17. Contact
SIAFY TEKNOLOJİ DANIŞMANLIK SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Yavuztürk Mah. Çiçek Dağı Sk. No: 5/1, Üsküdar, İstanbul, Türkiye · info@siafy.co