Privacy

Who runs Bloom

Bloom is an independent project operated from Belgium. Reach us at privacy@bloom.game for anything in this document.

We are the data controller for everything described below. Where required, this notice serves under the EU General Data Protection Regulation (GDPR).

What we collect

Bloom is designed to be playable without an account. We split data into two tiers depending on whether you sign in.

Anonymous play

• Device ID. A random UUID generated the first time you visit, stored in your browser's localStorage. Used to attribute your daily blooms to one device. Clearing your browser storage gives you a fresh ID; we do not fingerprint your device.
• Handle & colour. The 3–15 character name and palette swatch you pick. Stored in localStorage + on our server when you play a bloom.
• IP hash. When you connect, the server hashes your IP address with a salt that rotates daily and stores only the hash. We never store your raw IP. Used purely for anti-cheat and ban enforcement.
• Gameplay data. The stats from each bloom you join: final rank, kills, peak mass, time survived. Tied to your device ID and (after sign-in) account ID.

If you sign in

• Email address. Required for the magic-link flow. If you sign in with Google or Discord, we receive your email and a provider account ID, nothing else.
• Account ID. A UUID minted by our auth provider (Supabase). Used to link your historical anonymous blooms to your account.
• Auth session token. A short-lived JWT stored in your browser so you stay signed in across reloads.

What we don't collect

• No advertising cookies, no third-party trackers, no pixels.
• No browser fingerprinting.
• No real names, no phone numbers, no addresses.
• No payment data — Bloom is currently free.

Why we process this data

• Run the game. Stats need to be persisted so the leaderboard, profile and Hall of Bloom work. Legal basis: contract (you joined to play).
• Keep it fair. IP hashes + handle bans stop repeat bad actors. Legal basis: legitimate interest.
• Sign you in. Email is needed to deliver magic links and identify you on return. Legal basis: contract.

Who we share it with

We use a small number of processors under contract:

• Supabase (EU region) — database, authentication, realtime broadcast.
• Fly.io — game server hosting.
• Cloudflare Pages — static asset delivery (the website itself).
• Google & Discord — only if you sign in with them; we receive only what they send back.
• Email provider (Resend or similar) — only the address + magic-link payload, only when you request a sign-in email.

We do not sell your data. We do not share it with anyone for advertising. Aggregate, non-identifiable stats (e.g. "1,847 blobs played the bloom of 2026-05-09") may be published.

How long we keep it

• Anonymous device IDs & gameplay rows: kept indefinitely so historical leaderboards stay accurate. Wipe your local storage to detach your device from any future activity.
• Account email + ID: kept until you delete your account.
• IP hashes: kept up to 30 days for anti-cheat.
• Bans: kept indefinitely.

Your rights

Under GDPR you can:

• Access your data — your profile page already shows everything we have on you.
• Rectify your handle anytime from the account widget.
• Delete your account & all linked data.
• Export your data in a machine-readable format.
• Object to any processing.
• Lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

For deletion or export, email privacy@bloom.game from the address tied to your account. We respond within 30 days.

Children

Bloom is not directed at children under 13. If you believe we have data on a child under 13, contact us and we'll delete it.

Changes

When this policy changes materially, we'll update the date at the top and surface a notice on the home page before the change takes effect.