Last updated: 16 September 2026 · Operator: Schill Labs (Mike Schillereff)
This policy describes how BloomDoc (“the app”) handles information when you identify plants, save a collection, subscribe, view ads on the free plan, or contact us. We do not sell your personal information. We do not use BloomDoc account or plant data to track you across other companies’ apps.
Who we are
BloomDoc is operated by Schill Labs (Mike Schillereff). Contact: mikeschillereff@hotmail.com. We process data in the United States.
Information we collect
- Plant photos you choose to scan or save. A photo is sent to our backend so we can identify species, estimate health, and (if you save the plant) keep a record in My Plants.
- Account data. The app creates a guest account when needed so scans can be stored. If you add an email and password, or use Sign in with Apple, we store that login so you can sign in on another device. Apple may provide a Hide My Email relay address instead of your real inbox. The account ID is also used to keep RevenueCat subscription entitlement and history attached to the same BloomDoc account.
- Name. Sign in with Apple may send your name the first time you authorize the app. We store it as a display name if you provide it.
- Scan results, care plans, plant names, and chat with Leafy. Stored with your account so you can reopen them. Care journal entries, progress reports, guided-project progress, room-checkup observations, and room and pot details you provide are also saved. When you ask Leafy about a saved plant, relevant recent history and notes are included in the AI request.
- Subscription status (purchase history). Apple, Google, and RevenueCat process the payment. We receive whether Premium is active, the product identifier, and the period end — not your card number.
- Usage counts. Daily and monthly free-tier scan, care-plan generation, and chat counts are stored so limits can be enforced.
- BloomDoc product interaction events. Named events such as scan started, plant saved, paywall shown, subscribe, and whether an ad slot was filled. These app events use your BloomDoc account ID when available, not a device advertising identifier. They are used to operate and improve the app and are not sold. Google's separate SDK processing is described below.
- Ads and Google's SDK. The free plan supports Google AdMob banners and occasional full-screen ads after leaving a successful scan result, when configured and permitted. When a network ad is unavailable, BloomDoc may show its own Premium promotion instead. We request non-personalized ads. This does not mean that no information is collected: Google's SDK may process your IP address (including an estimate of general location), app- or device-related identifiers, ad views and interactions, and crash or performance diagnostics for advertising, analytics, and fraud prevention. Android's advertising-ID permission is removed, but other identifiers, such as app-set or app-bounded IDs, may still be processed. Premium removes visible ads; it does not remove the SDK from the app or promise to erase information already processed by Google. Plant photos, chat, and care notes are not sent to AdMob.
- Limited diagnostic events. If the app catches an error, it may store the affected app boundary and error type with the current account so we can diagnose reliability problems. It does not send the stack trace, photo, private plant note, chat text, password, or sign-in token in that event.
- Scan guesses and optional corrections. We store the model’s species guess (and, if you tap Yes / Not this, your correction plus that photo) so we can measure accuracy and improve identification. This is not used for ads.
- AI safety reports you choose to send. An in-app report includes its category, an optional note, a bounded excerpt of the selected scan result, care plan, or Leafy response, and a cryptographic hash of the complete response. It does not include the plant photo. We use reports to investigate unsafe, misleading, or inappropriate output.
How we use plant photos and AI
When you scan, the photo is uploaded to our Supabase backend. A server-side function (ai-proxy) sends the image and a prompt to OpenAI’s API so we can return a species guess, health notes, a care plan, or a Leafy reply. We use the photo only to provide that feature.
You may optionally provide symptom timing, affected growth, soil observations, and up to two extra views of the same plant. These are sent for that analysis. The app keeps your first photo when you save the plant; it does not add the extra views to your saved photo history. The observations are stored with the saved analysis. If a photo appears to contain multiple plants, BloomDoc may ask you to retake a single-plant view rather than assigning one result to every plant. Weekly garden reviews summarize recorded care and upcoming reminders without sending a new AI request.
OpenAI processes the request under its API terms. We do not use your plant photos to train a public advertising profile. We do not use the consumer ChatGPT product to run BloomDoc.
Each displayed AI scan result, care plan, and Leafy response includes an in-app reporting action. Sending a report is optional. Reports go to BloomDoc's private safety-review queue and are linked to the reporting account so we can prevent abuse, investigate the selected output, and remove the report when that account is deleted. Reports are not sent through email or posted publicly.
Saved plant photos use private Cloudflare R2 storage behind BloomDoc's authenticated photo service. Supabase manages the account, photo references, access checks, and deletion status; older photo records may also require cleanup from private Supabase Storage. The app can create time-limited signed links to display photos. Anyone who obtains a valid signed link may view that image while the link and the account's access remain valid. Account deletion also revokes access through BloomDoc's photo service. Avoid including people, documents, or other sensitive information in plant photos. Scanning without saving a plant does not normally keep the photo in our photo storage, but an optional species correction may store its photo as described above.
Growth cards and progress movies are generated on your device from the photos you select. They are not posted publicly by BloomDoc. If you choose to share, the image or movie and accompanying text are passed to the destination you select in the device share sheet. That destination's privacy practices apply. Shared media includes the chosen plant name and photo dates, but not private journal notes or room details.
Care rounds, projects, and room checkups
Guided care rounds keep their current position and unsent observations on this phone until you explicitly submit them. Submitted care actions use your account's care history. Plant projects and settling-in records may store the selected plant, project steps, dates, notes, and photos you deliberately add. A project or observation is not a diagnosis or a claim that care was completed unless you explicitly record the action.
Room checkups store the label you choose, the plants you explicitly select, the observation date, your answers about light, window covering or obstruction, heating or cooling, drafts, and an optional note. They do not automatically track a physical room or measure conditions. Historical answers are shown as factual comparisons and are not converted into health or safety scores.
Shared care and plant sitters
Shared care is not available in the current public release. This version does not let people create or accept care invitations, view another person's plants, or exchange sitter reports, notes, or photos.
Plant gifts
Plant gifting is not available in the current public release. This version does not publish gift notes or expose plant introductions through public gift links. Old test links cannot be previewed or accepted.
Referrals
Referral invitations and promotional referral rewards are not available in the current public release. This version does not offer an invite-code or referral-reward flow. Any existing test referral records are account data covered by the deletion process; RevenueCat may retain historical subscription or promotional-entitlement records as described above.
Processors
- Supabase (United States) — authentication, database, file storage, and the edge function that calls the AI provider.
- Cloudflare — private plant-photo storage in R2 and the backend service that stores, retrieves, and deletes those photo objects. Photos are not published in a public bucket.
- OpenAI (United States) — vision and text analysis requested by our edge function. The API key stays on the server.
- RevenueCat — subscription status and restore-purchases for App Store / Google Play products.
- Apple — App Store billing and, if you use Sign in with Apple, identity (and optionally a private relay email).
- Google Play — billing if you subscribe on Android.
- Google AdMob — serves ads to free-plan users and processes SDK information as described above. See Google's iOS data disclosure, Android data disclosure, and Privacy Policy. Premium users are not shown these ads.
Guest accounts
If you skip email, BloomDoc still creates a guest account tied to that install. Adding an email or Sign in with Apple converts the same account so plants stay with you. Signing in to a different existing account does not merge guest plants — the app warns you first.
While signed in as a Guest User, you may create a lost-phone deletion recovery code. The app generates an opaque identifier and independent random secret and shows the complete code only on your phone. Our private backend stores a hash of the secret with the account ID, registration and bounded-attempt state; it does not store the plaintext code, email, name, or device identifier. Replacing the code disables the old one, and saving the Guest User as an email or social account revokes an unused code. The public deletion form sends the identifier and secret only in a no-cache POST body and uses them solely to enqueue or check that account's durable deletion request.
Notifications
Care, project, and room-checkup reminders are local notifications on your device. Each optional reminder family has its own in-app choice, and all can also be disabled in system settings. We do not send server push or marketing notifications. A room-checkup notification contains a neutral prompt and routing identifiers, not plant names or private room notes.
Location
BloomDoc does not request GPS/location permission or read your precise device location. Google’s advertising SDK may use your IP address to estimate your general location. A lack of location permission does not prevent this network-based estimate.
Legal bases (EEA / UK)
If you use the app from the EEA or UK, we process data as needed to provide the service you request (contract) and to keep the service secure and rate-limited (legitimate interests). You may request access, correction, deletion, or a copy of the data we hold, or object to processing that is not required to run the app, by emailing us. We do not currently appoint an EU Article 27 representative. Contact the email above.
Your choices
- Access / correction / export: email mikeschillereff@hotmail.com from the address on the account if possible. We must verify account ownership before sharing data. Do not send passwords, tokens, deletion receipts or recovery codes. We cannot identify a Guest User from a device name or plant description.
- Deletion: Request it from Profile → Delete account. A Guest User who saved a lost-phone recovery code can instead use the account-deletion page after losing the install; a saved account holder can email us from the account address. The request covers plants, scans, care schedules, chat, photos we store, AI safety reports, usage and analytics events we control, and the account. A request is not completed deletion: cloud cleanup, account removal, and this phone's cleanup may finish separately. Keep the receipt or recovery code and contact support if cleanup remains pending. Copies you already shared to another app cannot be recalled. Deleting your account does not cancel a store subscription. Store billing records may be kept by Apple, Google, or RevenueCat as required for tax and fraud prevention. Backups may persist for a short period before they rotate.
- Ads and privacy choices: we request non-personalized AdMob ads and do not send BloomDoc plant or chat data for advertising. Google's consent form may appear before ads are requested. Where Google requires an ongoing privacy-choice control, use the ad privacy option in Profile to reopen that form. Google determines which choices apply to your region and consent status. Subscribe to Premium to remove visible ads. These choices do not delete your BloomDoc account or replace Google's own privacy and deletion controls.
Children
BloomDoc is a general-audience plant-care app. It is not directed at children under 13 and is not in Apple’s Kids category. Do not create an account for a child under 13. We do not knowingly collect personal information from children under 13. If you believe we have, email us and we will delete it.
Retention
Account data, saved photos, scans, care schedules, chat, AI safety reports, usage counts, product events, and limited diagnostic events are kept while the account exists so the app can show your collection, investigate reported output, enforce free-tier limits, and diagnose reliability problems. Deletion work retains a limited record of the request and account identifiers, status, timestamps, retry information, and a hash of the status-only receipt secret to finish cleanup and prevent deleted data from being recreated. Pending requests do not disappear merely because an attempt fails. The phone keeps its private status receipt until cloud and local cleanup are confirmed and you acknowledge completion. Neither the deletion record nor its receipt contains your sign-in token, plant photos, or private notes.
Changes
We may update this policy. The date at the top will change. Material changes will be reflected here before they apply to new data we collect.
Contact
mikeschillereff@hotmail.com · Schill Labs.