Bloom peerPrivacy notice
Effective 24 October 2026
Bloom peer is operated by BG-dev, an independent developer. Contact support@bloompeer.com for privacy requests, support or reports. Our account and signaling service is hosted by Timeweb in Amsterdam, Netherlands.
Data and purposes
| Data | Purpose and storage | Retention |
|---|---|---|
| Account ID (chosen username, email address or phone number), display name, password hash and authentication-token hash | Create, authenticate and protect your account in the service database. On iOS the bearer token is stored in device-only Keychain storage, available after the first unlock for incoming calls; the server keeps its hash. Other platforms use their local session store. | Until you delete the account. Passwords are not stored as plain text. |
| Contacts, contact requests, blocks, invitations and presence visibility | Connect accepted contacts, apply your safety choices and arrange communication. Kept in the service database, with local copies where needed. | While needed for your account, until the relevant relationship is removed or the account is deleted. Invitation codes expire after 24 hours; expired records are removed during cleanup or account deletion. |
| Connection signals, session IDs and network addresses | Route signaling and establish WebRTC connections. Connection state is processed temporarily in memory. Devices and STUN/TURN services process network addresses; your contact may learn your IP address. | During connection/session processing and its expiry. We do not retain production application or HTTP access logs. |
| Messages, drafts, contacts, local profile and device preferences | Show conversations and remember your choices on your device. Messages prefer WebRTC; temporary undelivered copies may reach the separate server mailbox described below. Call media travels over WebRTC and is not recorded by the service. | Local history/drafts remain until cleared, account deletion on this device, uninstall or storage eviction. Signing out keeps history. Device settings may remain. Content-free deleted-message keys prevent retried messages from reappearing until account/app data is removed. |
| Push routing tokens and browser push subscriptions | Route incoming calls through Apple and optional content-free connection invitations through Apple APNs, Google FCM or your browser push service. Invitations contain no message text, message IDs or previews. | Until replaced, removed on sign-out where reachable, or account deletion. |
| Connection intent, invitation references and notification limits | Help the two participant devices become reachable together. The server holds account/contact identifiers, expiring references and bounded notification counters, with no message content or receipt history. | Connection intent expires after seven days without renewal; references after five minutes. Latest alert/window timestamps and bounded counters remain until account deletion. Blocking or removing a contact clears relevant intent; reachable sign-out clears owned intent. |
| Support emails and evidence you choose to share | Handle help, privacy and abuse reports in the support mailbox. Reports do not automatically include chat history; you choose whether to include a message excerpt. | No longer than three months from receipt; earlier when no longer necessary. |
Text safety
A local text filter blocks common abusive English and Russian phrases before sending and hides matching incoming text until you choose to reveal it. Filtered previews do not show that text. The filter is limited, can miss abuse, and does not analyze live audio or video. Use blocking and reporting for unwanted contact. Message text and filter results are not uploaded for classification.
Permissions and optional diagnostics
Camera and microphone access is requested for calls when those features are used. You can refuse or change permissions in your device settings. Customer builds do not automatically upload diagnostic logs. Debug mode is off by default; if enabled, it shows technical call statistics and keeps a bounded temporary log on your device. The normal app does not upload that log. We use no advertising or analytics trackers and do not sell personal data.
Production logs and backups
BG-dev does not retain production server application/access logs and does not create server backups. The live account database remains persistent so you can sign in and keep contacts. Account deletion removes account-related records from that live database. We do not provide cloud message backup or synchronization. Your operating system or browser may separately back up, cache or evict device data under your own settings.
Service providers and other participants
Timeweb processes the account service and temporary delivery mailbox on the same server in Amsterdam. Apple processes incoming-call and optional connection-push routing. Google FCM and browser push providers process optional content-free connection invitations. Google's public STUN service helps discover network connectivity; when our TURN relay is used, encrypted traffic passes through that relay. Your chosen contacts receive your messages/media and can keep their own copies. Devices/providers may be in different countries, so communication can involve international data transfers. We do not promise that deletion removes a contact's copies or independent provider records.
Choices, rights and deletion
Account and connection processing provides the service you request; safety controls protect participants. You can set Invisible to hide availability, remove/block contacts, clear local messages, sign out, or delete the account from Me. Account deletion from this device removes its session, local contacts/messages/drafts and account-specific profile preferences. Other participants' devices remain outside our control.
Contact support@bloompeer.com to request access, correction, deletion or other rights available where you live. We may need to verify account ownership without asking for a password or bearer token. You may contact your local data-protection authority where applicable. Our initial support response target is three business days; safety reports are prioritized.
Age and updates
You must be at least 13, or the higher minimum required where you live, to use Bloom peer. We do not offer under-13 or parent-managed accounts. Registration asks you to acknowledge eligibility and the Terms; it does not collect a birth date or verify your identity/age. Report a suspected underage account through Support. Material changes will be published here with a new effective date.
Temporary server delivery
Messages normally travel directly over encrypted WebRTC. When temporary server delivery is enabled, undelivered message text, reply references and delivery/read receipts may be held in a server mailbox over HTTPS. The service can read queued content; this mailbox is not end-to-end encrypted. Call media is not stored in the mailbox.
Each accepted copy is held for the configured period, normally up to one day, and removed sooner after the recipient confirms successful local processing. Fetching alone does not remove it. A mailbox or host restart loses queued copies. The sender keeps pending messages locally and may upload a fresh copy after expiry or loss, starting a new retention period. One day is a limit per accepted copy, not across every retry of a message. “Sent to server” does not mean delivered or read.
This is not a history backup or synchronization service. Clearing local history cannot recall uploaded server copies or erase another person's copies. Account deletion revokes mailbox access; remaining copies expire under the same retention policy. Message content is excluded from server logs and backups. Push providers receive neither message text nor message IDs.