Privacy Policy

1. 1What we collect
2. 2What we do not do
3. 3Cookies and local storage
4. 4Analytics and error reports
5. 5A note about free-text notes
6. 6Why we are allowed to hold it
7. 7Who else sees it
8. 8How long we keep it
9. 9Your rights
10. 10Contact
11. 11Changes

We deliberately collect as little as possible. You can use every calculator without an account, and calculations made that way are never stored.

• Account details: your name, your email address and your password. The password is stored only as a one-way hash, so nobody at Bloom Desktop can read it.
• Your saved calculations: the dates, countries, trips and any notes you type. These are only stored if you are signed in.
• Billing references: if you subscribe, we store your Stripe customer identifier and the card type and last four digits. Your full card details go directly to Stripe and never reach our servers.
• A gift of Pro: if someone gives you Pro, the email address they gave, when they gave it, and a short note they may add for their own reference. If that address already has an account, the gift is linked to it; if not, it waits for an account created with that address.
• Technical logs: our server records IP addresses and requests for security and troubleshooting.

We do not use analytics, advertising or tracking of any kind. There are no third-party scripts on this site. We do not build profiles, we do not make automated decisions about you, and we never sell or rent your data.

This site uses one cookie and one item of local storage, and both are strictly necessary for it to work. Because neither is used for analytics or advertising, no consent banner is required.

• NEXT_LOCALE: remembers which language you chose.
• A sign-in token in your browser's local storage, so you stay signed in. It is removed when you log out.

We use Cloudflare Web Analytics to see which pages get visited and where visitors arrive from. It sets no cookies, stores nothing on your device and builds no profile of you: it cannot follow you to other sites.

We also use Google Search Console, which reports as aggregated figures the searches that bring people here. Neither tool tells us who you are, and neither is used to make any decision about you.

If something breaks, the error goes to Sentry, which keeps the technical details of the failure — the page, the browser and what went wrong — so that it can be fixed. Your name, your email and your trips are not sent with it.

You can attach a note to a trip or an excluded range. That field is yours to use as you like, but please avoid putting sensitive details in it, such as health, religious or political information. It is stored as plain text alongside the rest of your calculation.

• To provide the service you asked for: your account, your saved calculations and your subscription. This is necessary to perform our contract with you.
• To keep the service secure and working: our legitimate interest in preventing abuse and diagnosing faults.
• To meet our legal obligations: tax and accounting rules require records of payments.
• To pass on a gift of Pro that someone has given you: our legitimate interest in delivering it, and yours in receiving it. You can ask us to delete it at any time.

We share your data only with the suppliers that make the service run, and only with what they need:

• Stripe and Link (Stripe's reseller service), for payments and subscriptions. When you subscribe, Link is the seller of the payment: it collects your name, email, billing address and payment details to take the payment, work out the tax due and handle payment support, and it uses them as an independent controller under its own privacy policy. Stripe is based in the United States and transfers are covered by the standard safeguards approved under UK and EU data protection law.
• Our hosting provider, on servers in the United Kingdom, and Resend, which delivers our emails. Both process the data on our instructions.
• Google, only if you choose to sign in with Google: it tells us your name and email address, and nothing about your trips ever goes the other way.
• Cloudflare, which counts page visits without cookies, checks that the sign-up, sign-in and password forms are being used by a person and not a bot (Turnstile, which looks at your IP address and signals from your browser and sets no cookies), and stores our nightly database backups in Europe, encrypted with a key only we hold; and Sentry, which receives the technical details when something breaks.
• Anyone we are legally required to disclose to, such as a court or regulator.

Your account and calculations are kept until you delete them. Deletion from the service is immediate — there is no recycle bin and no grace period. The one exception is our encrypted backups of the database, kept for 30 days in case something goes wrong: a deleted account can remain inside them until they expire. They are used for nothing else, and if we ever had to restore one, we would delete your account again straight away. Payment records held by Stripe and Link are kept under their own legal obligations, typically six years for UK tax purposes, and we cannot delete those on your behalf. Server logs are kept for a short period and then discarded. A gift of Pro that nobody claims is deleted, together with the email address, 3 months after it was given. Once claimed, it becomes part of your account and goes when you delete the account.

Under UK and EU data protection law you can ask for a copy of your data, correct it, have it erased, restrict or object to how we use it, and take it elsewhere. Two of those are built into the app: from your account page you can download everything we hold in a machine-readable file, and delete your account outright. For anything else, contact us.

If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Write to us at [email protected] and we will respond within one month.

If we change this policy we will update the date at the top. If the change is significant, we will tell you by email before it takes effect.

This policy is published in several languages for convenience. If the versions differ, the English version applies.