Privacy notice

Last updated 9 October 2026

Bloom is a home cooking app for people who love food, used in many countries. This notice explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have. Bloom is owned and run from India by Founderfreedom Ventures LLP, a limited liability partnership registered in India and the data fiduciary for your data, so this notice follows India's Digital Personal Data Protection Act, 2023 (the DPDP Act). If you live elsewhere, see Using Bloom outside India below.

What we collect

Account: your email address, name, city and, if you order a Box, your delivery address and phone number. If you make a password, we keep only a salted scrypt hash of it, never the password itself.
Food preferences and health related settings: your diet, allergies, daily protein target, and the same for people you add to your household. We use these only to choose safe food for you and to show nutrition. We never use them for advertising.
What you do in Bloom: dishes you cook, skip, save or post; your pantry and shopping list; goals and tasks for your kitchen agent; circles, posts, reactions and potlucks.
Recipes and photos you add. Photos are re encoded when uploaded, which removes location and camera data.
Your cook's and other helpers' details (name, language, and optionally phone and email) if you add them. Please add these only with their agreement. We email a cook only after they confirm their address once. Links you send a cook stop working after 7 days or when you switch them off.
Sugar smart settings (diabetes, prediabetes, PCOS or watching sugar) for people at home, only if you turn them on. These are sensitive: they shape suggestions and notes to your cook, admins never see them, and nothing is inferred from what you cook.
Where you cook and drinks: your market, units and, if you switch on cocktails, the time you confirmed you are of legal drinking age. Before you choose a market we guess it from your browser's language or the country our load balancer reports; we don't store that guess.
Payments: handled by Razorpay. We keep the order amount, items and payment status, never card or bank details.
Technical data: sign in sessions with a device description and when each was last used, and security logs. IP addresses are used to stop abuse and are stored only as keyed hashes.
Usage statistics, only if you allow them: which pages of Bloom are visited, see below.

Usage statistics (Google Analytics)

On your first visit Bloom asks whether you will share anonymous usage stats. Only if you tap Allow do we load Google Analytics, which then counts the pages you open, roughly where you are (country and city, worked out by Google from your connection, without storing your IP address), and your kind of device and browser. We use it to see which screens help and which don't.

We never send your name, email, account id, what you cook or your health settings, and page addresses go without anything after the ?, so sign in codes and private links never reach Google. Cooks' links, sign in and password pages and the admin console are never measured.
Google Analytics (Google LLC and its affiliates) is our processor for this. Advertising features are off, and we tell Google's Consent Mode that ad storage, ad user data and ad personalisation are denied, always. Statistics are kept for at most 14 months.
If you say No thanks, or your browser sends Do Not Track or Global Privacy Control, Google Analytics is not loaded at all and we don't ask again.
Change your mind any time in You, Settings, Your data, Anonymous usage stats. Your choice is kept in a cookie on this device for a year.

Why we use it

To run Bloom for you: pick what to cook, keep your pantry and list, brief your cook, run circles and potlucks, deliver your Box, send the notifications you allow, keep the service secure and meet legal obligations such as tax records. You give consent when you finish setting up Bloom; you can withdraw it at any time by deleting your account.

Who we share it with

People you choose: your circles see your posts; your household sees shared settings; your cook receives the briefs you send.
Service providers that process data for us: hosting and database (Google Cloud and Supabase, Singapore region), domain and network security (Cloudflare), email (Resend), payments (Razorpay), translations of recipes, menus and stories, and voice notes for your cook (Google Cloud Translation and Google Cloud Text-to-Speech: they process recipe text, and no personal data beyond the notes your household writes for your helper), AI write ups and reading recipe or fridge photos (Anthropic, only when it is switched on, and only the recipe, menu or photo, not your account details), usage statistics (Google Analytics, only if you allow them, see above), and push notification services of your browser.
Authorities when the law requires it.

We do not sell personal data.

How long we keep it

While your account is open. When you delete your account, we delete your personal data straight away, including your household, helpers and voice notes, except payment records we must keep for accounting (kept against an anonymised account) and public recipes you published, which stay without your name. Some things go sooner on their own: sign in codes after 10 minutes, password reset links after 30 minutes (or once used), sign ins end after 30 days without use (or when you sign out), voice notes after 30 days (they are made again if needed), shares you started while signed out after a day, and abuse prevention counters after 2 days. Security logs are kept for up to a year.

Your rights

Access and portability: download everything from You, Household, Your data.
Correction: edit your details in Household settings, or write to us.
Erasure: delete your account from Household settings. It takes effect immediately.
Withdraw consent: turn off notifications, emails or usage stats in settings, or delete your account.
Nominate someone to exercise these rights if you cannot.
Grievances: write to our Grievance Officer at grievance@thebloomhealth.com. We reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Using Bloom outside India

Wherever you live, your data is processed and stored in Singapore (Google Cloud and Supabase, Singapore region) by the providers listed above, and the rights in this notice apply to you. If the law where you live gives you further rights over your data, write to grievance@thebloomhealth.com and we will help you use them. The monthly Box and its payments are available in India only.

Children

Bloom accounts are for adults. A parent may add a child as a household member (a name, diet and allergies) to keep their food safe; children do not get their own accounts.

Changes

If we change this notice in a way that matters, we will tell you in the app before it takes effect.

Terms