Privacy Policy

BloomOnCue is a service that helps couples send flowers timed to a partner's menstrual cycle. We take your privacy seriously, especially because cycle data is sensitive personal information. This policy explains what we collect, how we use it, who we share it with, and what control you have over it.

BloomOnCue is operated by BloomOnCue LLC ("BloomOnCue," "we," "us," or "our"). If you have any questions about this policy, contact us at [email protected].

Who uses BloomOnCue

BloomOnCue has two types of users:

• Partner accounts — the person paying for the subscription and arranging flower deliveries.
• Subscriber accounts — the person who logs cycle data and receives flowers. Subscribers create their accounts by accepting an invite link from their partner.

We collect different types of information from each. Both control their own data.

Information we collect from partner accounts

• Account information: Your name, email address, and password (passwords are stored hashed using industry-standard cryptographic techniques — we cannot read your password).
• Phone number (optional): Only if you choose to provide one. Currently not used; reserved for future SMS features that you would opt into separately.
• Payment information: Handled entirely by Stripe, our payment processor. We store a Stripe customer ID and subscription status but never see or store your full credit card number or CVV. Stripe's privacy policy is at stripe.com/privacy.
• Delivery preferences: The address where flowers should be sent, your budget, and your preferred arrangement style.
• Communication and support: If you email us or contact us through the app, we keep a record of that correspondence.

Information we collect from subscriber accounts

Subscriber data is sensitive. We treat it accordingly.

• Account information: Your name, email address, and password (hashed).
• Phone number (optional): Only if you choose to provide one. Currently not used; reserved for future cycle reminder SMS that you would opt into separately.
• Menstrual cycle data: Your most recent period start date, average cycle length, and average period length. You enter this directly.
• Cycle history: Each period start date you log over time, used to refine prediction accuracy.
• Symptom and check-in logs: If you choose to use the daily check-in feature, we store your mood, energy level, ratings for symptoms (cramps, bloating, headaches, fatigue), and any free-text notes you write.
• Privacy preferences: Your setting for whether to share full phase details with your partner, or only support tips without specifics.

Information generated automatically

Some information is created by the BloomOnCue service rather than collected from you directly:

• Cycle predictions: Calculated from the cycle data the subscriber provides. These power phase identification, ovulation estimates, and flower delivery scheduling.
• Order history: Records of when flowers were scheduled, delivered, skipped, or failed. Visible in the partner's dashboard. Subscribers can see this history if their partner shares it.
• Server logs: Standard web server logs (IP addresses, user-agent strings, timestamps, requested URLs). Used for security monitoring and debugging. Retained for up to 30 days.

What we don't collect

• We do not use Google Analytics, Facebook Pixel, or any third-party advertising or behavioral tracking on our site.
• We do not sell your data to anyone, ever. This includes anonymized or aggregated data.
• We do not share your data with advertisers or marketing platforms.
• We do not use your cycle data to train artificial intelligence or machine learning models.
• We do not track your location beyond the delivery address you provide.
• We do not read or store your text messages, email, contacts, or any data outside the BloomOnCue app.

How we use your information

We use the information we collect strictly to operate BloomOnCue:

• To provide cycle predictions and schedule flower deliveries
• To process payments and manage subscriptions
• To send service-related emails (order notifications, account updates, security notices)
• To respond to support requests
• To improve the accuracy of our predictions over time (using only your own data, not pooled across users)
• To detect fraud, abuse, or technical problems
• To comply with legal obligations

Who we share information with

We only share information with third parties when necessary to operate the service:

• Stripe (payments) — sees the partner account email, name, and payment details. Never sees subscriber cycle data.
• Resend (transactional email) — sees email addresses and the content of the emails we send (order notifications, account confirmations).
• Google (only if you sign in with Google) — Google authenticates you and shares your email address and name with us. They do not receive any cycle or subscription data from us.
• Florists and flower delivery services (during fulfillment) — receive the recipient's name and delivery address only. They never see cycle data, payment information, or any other personal details.
• Hosting and infrastructure providers (Railway, Cloudflare) — process service requests but do not have access to your stored data beyond what is required to deliver web pages and protect against attacks.
• Health and wearable platforms (future): If you choose to connect a third-party device or service in the future (such as Oura Ring, Apple Health, Whoop, or similar), we will read cycle-related data from that service through their official API, with your explicit consent each time. You can disconnect at any time. We will never write data back to these services unless you explicitly ask us to.

We do not sell or rent your information to anyone for any reason.

How partners and subscribers see each other's data

BloomOnCue is designed so that the subscriber controls how much of her cycle data the partner sees:

• By default, when a subscriber and partner are linked, the partner sees the subscriber's current phase, predicted next period, ovulation estimate, and supportive guidance.
• The subscriber can switch to a private mode at any time. In private mode, the partner only sees general support tips with no specifics about phase, dates, or symptoms.
• The subscriber can revoke the partner's access entirely at any time from her dashboard. The link is severed, no further data flows to the partner, and any pending flower orders are cancelled.
• Symptom logs and daily check-ins are never shared with the partner, regardless of privacy mode.

Data retention

We keep your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are legally required to retain certain records (for example, financial records for tax purposes are typically kept for 7 years). Anonymized order records may be retained for fulfillment audit purposes.

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated data
• Export your data in a portable format
• Withdraw consent for any optional data use at any time
• Lodge a complaint with a data protection authority if you believe we've violated your rights

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

California residents have additional rights under the CCPA, including the right to know what personal information has been collected, to request deletion, and to opt out of any "sale" or "sharing" of personal information (we do neither, but the right exists). Contact us using the email above to exercise these rights.

Cycle data and reproductive health

We are aware that menstrual cycle data is increasingly sensitive in the United States. We want to be explicit:

• We will never voluntarily disclose cycle data to law enforcement, government agencies, or any third party in response to anything other than a valid, legally binding subpoena or court order.
• If we receive any such legal request, we will, where legally permitted, notify the affected user before disclosure so they have the opportunity to respond.
• We will challenge overly broad requests where we believe doing so is appropriate.
• You have the right to delete your cycle data at any time, and we will honor deletion requests promptly.

Security

We protect your data using industry-standard security practices: encrypted connections (HTTPS) for all traffic, hashed passwords, secure session cookies, CSRF protection, rate limiting on authentication endpoints, and database access controls. No system is perfectly secure, but we work hard to protect your information and we will notify you in the event of a data breach affecting your account, as required by law.

Children

BloomOnCue is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a minor, we will delete it promptly.

International users

BloomOnCue currently serves only U.S. customers. Our servers are located in the United States. If you access the service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different privacy laws than your country.

Changes to this policy

We may update this policy from time to time as the service evolves. When we make material changes, we will notify users by email and update the "Last updated" date at the top of this page. Continued use of BloomOnCue after the changes take effect means you accept the updated policy.

Contact us

Questions, concerns, or requests about your data? Reach out anytime:

BloomOnCue LLC
[email protected]