Bloom privacy

Last updated 25 October 2026

Bloom is a voice assistant that remembers, reminds and answers for you. This page says what it keeps, who can read it, and how to delete it.

Encrypted with a key only your devices have

Everything Bloom keeps about you is encrypted: your notes, people, plans, money, the things you've said, the photos you send with them and Bloom's replies, your calendar's copy and your Google connection. The key is made on your iPhone and stays in your iCloud Keychain, with 24 recovery words only you hold. If you pair an Apple Watch, it keeps a key made from that one, so it can send what you say on its own; that key unlocks your Bloom data but can't be turned back into your recovery words. Apart from what's listed under "What stays readable", Bloom's database, its backups and its logs hold nothing readable, including for Bloom's operators.

To answer you, your iPhone lends the key to Bloom's server for that one request. The server uses it in memory while it works and never stores it. If you lose every device and your recovery words, your data can't be recovered by anyone, Bloom included.

What stays readable

• The email address of the account you sign in with (for Sign in with Apple, usually Apple's private relay address).
• When things were created and changed (timestamps), and ids that link records together.
• Your IP address in rate limits, for at most 2 days.
• Your device's push token, so Bloom can notify you.
• A key your iPhone makes to prove it's running the real Bloom app (Apple's App Attest), with Apple's note of how the app was installed.
• Your settings that aren't about you: time zone, currency and how the app behaves.
• Facts about each ask that aren't what you said or what Bloom replied: when it was made, whether it worked, how long it took, how many photos came with it and how large they are, which of Bloom's tools it used, and how much work it took (which is how Bloom counts your daily usage).
• How asks went, never what was in them: the reason you picked after undoing one ("misheard", "wrong time" and the like), and whether an ask was corrected, answered with a question, or changed in the app soon after.

Bloom started encrypting everything on 18 October 2026, and nothing stored before then is left in its database. Backups and logs from before that date are kept only for as long as our database provider keeps them, and then they're gone.

Who processes what you say

• Deepgram turns your recordings into text, listening out for the names of your people and a few distinctive words from your upcoming events, your recent asks and what you've told Bloom about yourself, so it spells them right. Bloom doesn't store recordings, and opts out of Deepgram's model improvement program, so Deepgram doesn't keep them to train its models.
• Anthropic (Claude) fixes words the transcription got wrong, checking spellings against your people and lists, your upcoming event titles, your last few asks and what you've told Bloom about yourself, then understands what you asked (and any photos you sent with it) and decides what to do, reading the parts of your data it needs. Anthropic doesn't train on this data, and deletes it from its systems within 30 days.
• TypeSafe (Jev) judges which of a few email senders, subjects and previews match what you asked, before Claude reads any of them. It sees only those few lines, not whole emails, and how long TypeSafe keeps them is set by TypeSafe's own terms.

Calendar, contacts and Gmail

• Calendar (if you connect it): your iPhone shares your events' titles, times, places and which calendar they're in, so Bloom can answer schedule questions and add or move events for you. Not their notes, links or the names of people invited.
• Contacts (only those you choose to import): names and how you know them.
• Gmail (if you connect it): read-only. Bloom doesn't sync, index or store your mailbox. It searches your mail only when you ask about it and reads only the few messages that match. The text of emails it opens to answer you stays, encrypted with your key, in that ask's working conversation for up to 24 hours (longer while Bloom waits for your answer to a question it asked), and Bloom's reply keeps whatever it quotes. The access Google gives Bloom is kept encrypted with your key, and you can disconnect at any time.

Bloom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting

Delete all data (Bloom › Settings › Account) deletes your account and everything it holds. Because it's encrypted with your key, any copy left in a backup is unreadable. Disconnecting Gmail or your calendar removes Bloom's access and its copy.

If you join the waitlist on Bloom's website, Bloom keeps your email address only to tell you when Bloom opens. To be taken off it, email hey@michaelren.dev.

Contact

Questions: hey@michaelren.dev