Privacy Policy

Bloom Labs, Inc.
Last updated: October 8, 2026

1. Introduction

Bloom Labs, Inc. ("Bloom Labs," "we," "us") respects your privacy. This Privacy Policy describes how we collect, use, and protect your personal information when you use our website (bloom.diy), our mobile applications for iOS and Android, our web application, our Bloom Capture browser extension, and our API, MCP connectors and plugins (collectively, the "Services").

This policy should be read in conjunction with our Terms of Service, which contain additional important details about your use of our Services.

2. Information We Collect

2.1 Account Information

  • Email address
  • Name
  • Payment information (for paid plans)
  • Account preferences and settings

2.2 Usage Data

  • Generated app code and user prompts
  • Interactions with the Services
  • Feature usage
  • Error logs and debugging information

2.3 Automatically Collected Information

  • IP address
  • Browser type and version
  • Device and operating system details
  • Timestamps of access
  • Visited pages

2.4 Connected assistants, API and MCP tools

When you connect an assistant such as ChatGPT, Codex or Claude, Bloom receives the tool requests that the assistant sends to Bloom. Depending on the requested operation, these can include:

  • Your Bloom identity, connection permissions, authorization and credential-related records, and the client name, version and protocol information.
  • Project, branch, page, frame and comment identifiers; frame source code and edit instructions; search queries; comments, chat messages and feedback you submit.
  • Browser interaction commands and text entered into a running frame. A requested screenshot, recording, element inspection or runtime-state inspection may contain visible content, application state or stored values from that frame.
  • Temporary deployment code and the reason for running it, if you explicitly use deployment tools and have the required permissions.

Bloom returns the authorized results to the connected client. Results can include identity and project metadata, source code, comments, execution results, runtime state, screenshots, recordings, errors and links to Bloom content. The client and its model provider can process and retain those results under their own policies. Bloom does not receive your entire assistant conversation merely because you connect it; it receives the requests and context the client sends to Bloom.

We also record connection and tool-use metadata, including the authenticated principal, client information, operation, time, outcome, request identifiers, duration and selected counts or error codes, to operate, secure and diagnose the integration. This operational collection is separate from the optional Bloom Agent improvement setting described below.

2.5 Bloom Capture browser extension

Bloom Capture, including its staging beta, lets you select website content and copy it to your local clipboard for pasting into Bloom as editable source. When you activate capture, the extension processes the selected content, layout, styles and image references on your device. The capture includes the source page's URL (without its query string or fragment), title, capture time, browser user-agent, viewport and selection metadata. Password, hidden and file input fields are omitted; other visible content you choose to capture may contain personal information.

The extension does not access your browser's history database or track browsing in the background. It does not upload captures or send usage telemetry to Bloom or third parties. Captures are copied to your clipboard; their retention and access by other applications depend on your device's clipboard settings, including any clipboard history or synchronization you enable. The extension does not keep its own capture history. It reads Bloom's theme and backdrop preferences on the corresponding Bloom website and stores these appearance preferences locally. Removing the extension removes its extension storage; it does not clear clipboard copies or content you have pasted elsewhere.

If you choose to paste a capture into Bloom or another application, that application processes the pasted content under its privacy policy. For Bloom, the service processing, sharing, retention and data controls described elsewhere in this policy apply. Captured image references may cause the receiving application to request images from their original hosts.

Bloom Capture uses the information it handles only to provide its capture and appearance features. The extension does not sell user data, use it for advertising or credit decisions, or transfer it for unrelated purposes. Bloom Capture's use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. The website analytics described below are not included in the extension. For questions about Bloom Capture, contact support@bloom.diy.

3. Analytics and Tracking

We use third-party analytics tools, including:

  • PostHog: For product analytics, user behavior tracking and session replay of supported application interactions (see PostHog Privacy Policy).
  • Google Analytics: To analyze website traffic and usage. You can opt-out using Google's Opt-out Browser Add-on.

4. Cookies and Similar Technologies

We utilize cookies and tracking technologies to:

  • Manage user sessions
  • Remember user preferences
  • Analyze usage patterns
  • Improve the overall user experience

You can manage cookie preferences in your browser settings.

5. How We Use Your Information

Bloom Labs uses your information for the following purposes:

  • Providing and enhancing our Services
  • Authenticating connected clients, enforcing the permissions you grant, executing requested tools and returning their results
  • Storing project content and collaboration history, rendering previews, and running requested code or agent work
  • Improving platform features and functionalities
  • Improving and training Bloom's AI systems unless you opt out through Data controls
  • Processing payments
  • Providing customer support
  • Communicating important service updates
  • Security, fraud prevention, and debugging

6. Data Sharing and Third-party Service Providers

6.1 Recipients and purposes

Data is shared according to the features you use:

  • Connected assistant and MCP client providers: receive the tool results that you request through their clients. Connecting a client can let its assistant read or change the Bloom resources permitted by your authorization. Other authorized members of a shared project can see its content and collaboration activity.
  • Hosting, database, storage, execution and browser infrastructure providers: process the account, project, code and preview data needed to store content, execute requested work and deliver the Services.
  • Package, static-asset, CDN and font providers: receive requests and network metadata when a frame loads their assets. Requests can include values embedded in user-authored asset URLs. The isolated observation browser restricts these requests to approved origins; it does not permit arbitrary external writes.
  • AI model and code-editing providers: process prompts, relevant project context, source and tool results when Bloom invokes them to generate, edit, inspect or reason about your app. A connector request that starts Bloom Agent work can initiate this processing. Providers depend on the model and feature used.
  • Analytics and operational monitoring providers: including PostHog and Axiom, process usage, connection, performance and diagnostic records for product analytics, reliability, security and troubleshooting. Session replay can capture application interactions and displayed content.
  • Payment, authentication, email and support providers: process the account, transaction and communication data needed for billing, sign-in, service messages and support.
  • Authorized Bloom personnel and contractors: may access content for support, maintenance, security and the improvement activities described below. If you publish or share content, it is also available to the audience you choose.

Recipients' retention and processing can differ from Bloom's. Disconnecting a client does not delete copies that it or its provider has already received. Content sent to a service by your generated app's own code is governed by that app's configuration and the recipient's policies.

6.2 Bloom Agent improvement controls

For individual accounts, Bloom Agent improvement sharing is on by default. You can turn off Improve Bloom Agent for everyone at any time. When enabled, prompts, responses, generated code, files, and project context used in agent conversations may be shared with service providers that help us evaluate and improve Bloom's AI systems. Turning the setting off stops new content-bearing improvement traces. If you explicitly submit thumbs-up or thumbs-down feedback, Bloom may still send that feedback as a voluntary improvement signal. The setting does not remove records required to provide the Service, bill for usage, prevent abuse, secure accounts, or diagnose failures.

6.3 Retention and deletion

Bloom retains account and authorization records to provide account access and manage connections; project content and collaboration history to provide your workspace and its editing history; and usage, security, diagnostic, support and transaction records for the purposes described in this policy. There is no single retention period for all of these categories. Retention depends on the continuing use of the account or workspace, editing and recovery history, investigation and support needs, billing records and applicable legal requirements.

Removing a frame from the canvas can leave its source and change history in the project's retained history. Deleting your account revokes its sessions and API credentials and removes its user profile and supported sign-in account records; it does not automatically erase every workspace record, published app, diagnostic record or copy held by another member or provider. Revoking a connector stops further authorized access but does not erase earlier tool results or the Bloom content it created. Turning off Bloom Agent improvement stops new content-bearing improvement traces; it is not a request to erase existing records.

To request access, export or deletion of retained personal information, contact info@bloom.diy. Identify the account and relevant workspace or connection, without sending passwords or access tokens. We consider the scope of the request, rights of other workspace members and records needed for legal, billing and security purposes. Copies held by a connected assistant or another provider must also be addressed through that provider's controls.

7. Your Rights

You have rights to:

  • Access your personal data
  • Request correction or deletion of your data
  • Export your data
  • Opt out of certain data processing activities
  • Withdraw your consent

You may exercise these rights by contacting us at info@bloom.diy. You can also:

  • Review and revoke connected-client permissions or API credentials through Bloom's connection controls.
  • Turn off Improve Bloom Agent for everyone in account settings.
  • Delete your account through account settings, subject to the retention distinctions above.
  • Manage cookies in your browser and conversation retention or model-training preferences in your connected assistant's own settings.

Bloom's improvement preference does not control another provider's independent settings, and disconnecting Bloom does not delete that provider's conversation.

8. Security Measures

Bloom Labs implements industry-standard measures to protect your data:

  • Encrypted data transmission
  • Secure storage practices
  • Strict access controls
  • Regular security assessments and employee training

9. User Content Visibility

Your content, prompts, and generated code are private by default. Content is available to authorized workspace members, the clients you connect and the service providers described above. Authorized employees and contractors may access it for the disclosed service purposes.

If you explicitly make your project public, others can view and remix your content. Private projects remain confidential.

10. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors.

11. International Data Transfers

Bloom Labs may transfer data internationally within our service provider network, adhering to adequate data protection safeguards.

12. Changes to This Policy

We may periodically update this policy. We encourage users to review this page regularly. Continued use of our Services after updates signifies acceptance of these changes.

13. Contact Information

For any questions or concerns regarding your privacy, please contact us:

  • Email: info@bloom.diy
  • Address: Bloom Labs, Inc., 651 N Broad St, Suite 201, Middletown, DE 19709, USA
Privacy Policy | Bloom | Bloom