Privacy Policy

Effective November 6, 2026

This policy explains what information Bloom Cinema ("Bloom") collects, how it is used and shared, how long it is kept, and the choices and rights you have. It applies to the Bloom app for iPhone, iPad and Apple TV, the optional Bloom account service, and the website bloomcinema.app (together, the "Services").

Bloom is made by Maddox Martinez, an individual developer based in California, USA ("we", "us", "our"). We are the party responsible for (the "controller" of) the personal information described here. Contact: support@bloomcinema.app.

By using the Services you acknowledge this policy. Please also read our Terms of Use.

1. The short version

• Bloom works without an account with us. Using Bloom with your own Jellyfin server sends us nothing. Bloom has no analytics, no advertising, no tracking and no third-party SDKs that collect data.
• A Bloom account is optional. It saves your servers so they're set up when you sign in on your other devices, runs households and email invites, and sends marketing email only if you opt in. If you use one, we keep your email address, an account ID, the name and addresses of each server you connect to while signed in (and your Jellyfin username there), the Jellyfin usernames of people in households you share, and the email addresses of people invited to it (until they accept or the invite expires).
• We never receive your Jellyfin password or server sign-in, what you watch, browse or search, your watch history, your media files, your contacts, your location or your payment details.
• We don't sell or share your personal information for advertising, and we don't track you across other companies' apps or websites.
• You can delete your Bloom account in the app at any time (You › Bloom Account › Delete Account (on Apple TV, Settings › Bloom Account)).

2. Information we collect

We collect only what is described below, and only when you use the feature that needs it.

2.1 Bloom account (optional)

When you create or use a Bloom account (with your email and a password, confirmed by a code we email you; you can also sign in or reset your password with an emailed code, or use Sign in with Apple):

• Your email address, used as your sign-in and to match invites sent to you.
• With Sign in with Apple: the email address Apple shares with us (which can be a private relay address that forwards to you, if you choose Hide My Email) and an identifier Apple assigns for Bloom. We don't ask Apple for your name.
• Your password, stored only as a one-way hash by our account service. We can't read it, and it is never the password for your Jellyfin server.
• An account identifier (a random ID our account service assigns to you).
• Sign-in and session records, such as when the account was created, when you last signed in, sign-in tokens, and the IP address and device or browser type (user agent) recorded by our account service when you sign in or use it.

2.1a Marketing emails (only if you opt in)

Creating a Bloom account has an optional box, off unless you turn it on, for Bloom news, tips and offers by email. You can turn it on or off at any time in Bloom Account, and every marketing email has an unsubscribe link. If you opt in, we keep a record of your choice: your email address, whether you said yes or no, the exact wording you were shown, where you made the choice (sign-up or Bloom Account) and when. Saying no, or never answering, changes nothing else about your account. Account emails (confirmation, sign-in and password-reset codes, and invites) are not marketing and are sent whatever you choose.

2.2 Your servers and households

When you connect to a Jellyfin server while signed in to your Bloom account, Bloom saves that server to your account, so signing in on another device sets it up there and you only type your Jellyfin password. The same details are kept if you share your server as a household, or join one:

• Server details: the server's name (for example "Home Server"), its Jellyfin server ID, and up to four addresses it can be reached at (for example https://media.example.com or http://192.168.1.20:8096).
• Membership: which servers and households you belong to, your role (admin or member), the Jellyfin username shown for you (on a server you saved, your own username there), and when it was added.

2.3 Email invites

If a household admin invites someone by email:

• The invitee's email address and the Jellyfin username the admin chose for them.
• Who sent the invite, and when it was sent and expires.
• A short record of each invite email sent (sender, recipient address and time), used only to limit how many invites can be sent and stop abuse.
• The invite email itself, which our email provider sends and briefly logs (recipient, subject, content and delivery status). The email contains the server's name, the person's username, a one-time invite code and a link to the App Store. It never contains a server address or a password.
• The invite code. The invite code joins whoever enters it to that household, on any Bloom account, so the email can reach a different or private relay address. We store only a one-way hash of it, which goes when the invite does. If you have no subscription, Bloom first asks our service whether the code you typed is valid, before you make an account; that check keeps nothing. Wrong codes are counted per account to stop guessing, and that count is cleared once a day old, the next time anyone enters a code, or with your account.

If you are an admin, you are responsible for having a good reason to give us someone's email address, such as the person asking to join your household, and you must not invite anyone who hasn't agreed to hear from you.

2.4 Contacting us

If you email us, we receive your email address, the contents of your message and anything you choose to attach (for example screenshots or playback stats).

2.5 Website

bloomcinema.app has no cookies, analytics, advertising or tracking scripts, and loads nothing from other sites. Our hosting provider processes standard request information (such as IP address, requested page, time and browser type) to deliver and protect the site. On the invite page (bloomcinema.app/join), the invite details sit in the part of the link after #, which browsers never send to the website.

2.6 App Review sign-in

Bloom has a sign-in reserved for Apple's App Review team. When it is used, the entered username and password are sent to our account service only to check them; they are not stored. This is not used for, or offered to, other users.

2.7 What we do not collect

We do not collect: Jellyfin passwords, server sign-ins or access tokens; what you watch, browse, search for or download; watch history, progress or favorites; your media files, artwork or subtitles; your contacts or address book; your precise or coarse location; photos; health, financial or payment information; advertising identifiers; or analytics, crash or performance data from our own code. We don't use device fingerprinting.

3. How we use information

We use the information above only to:

• provide the Bloom account: send sign-in codes, sign you in and keep you signed in;
• save your servers and run households and invites: set your saved servers up on your other devices, show members their household's server, fill in their name, let admins invite and manage people, and send invite emails;
• keep the Services secure and working: prevent abuse and fraud (for example rate-limiting sign-in codes), troubleshoot, and protect you, other users and us;
• send marketing emails, only if you opted in: Bloom news, tips and offers, until you opt out;
• respond to you: answer support requests and requests about your data;
• comply with law and enforce our Terms of Use.

We do not use your information for advertising, marketing emails you haven't opted in to, profiling, automated decisions that affect you legally or similarly, or training machine-learning models, and we don't combine it with data from other sources. If we ever want to use it for a new purpose, we will update this policy first and, where the law requires, ask for your consent.

Legal bases (EEA, UK and Switzerland). We process personal data because it is necessary to provide the Services you ask for (performance of a contract); for our legitimate interests in running a secure, working service and, for invitees, in delivering the invite a household admin asked us to send (balanced against your rights); to comply with legal obligations; and, where we ask for it (such as marketing emails), your consent, which you may withdraw at any time without affecting what was done before.

4. How information is shared

We don't sell personal information, and we don't share it for cross-context behavioral advertising (as those terms are defined under California law), and we have not done so in the past 12 months. We share information only as follows:

• Service providers that operate parts of the Services for us, under their contracts or terms and only to provide those services:

  • Supabase (account sign-in and database, hosted in the United States);
  • Resend (sending sign-in codes, invite emails and, if you opted in, marketing emails);
  • Cloudflare (hosting bloomcinema.app and forwarding email sent to our address);
  • Apple (App Store distribution and in-app purchases, Sign in with Apple if you use it, and iCloud Keychain, which you control).

  We choose providers that commit to protecting personal data with safeguards at least as protective as those in this policy, and they may not use it for their own purposes.

• Your saved servers are seen only by you, until you invite someone to one.

• Within your household. Members of a household can see its server name and addresses and the list of members (their roles and Jellyfin usernames, not their email addresses). Admins can see the email addresses and usernames on invites they manage. A person with an open invite can see the server name and addresses for that household and the email address of the person who invited them, and the invite email shows the inviter's email address too, so invitees can tell a real invite from a fake one.

• Legal and safety. We may disclose information if we believe in good faith that it is required by law, subpoena, court order or other legal process, or necessary to protect the rights, property or safety of you, other people or us, to investigate fraud, abuse or security issues, or to enforce our terms. Where the law allows, we will try to tell you first.

• Business transfers. If Bloom, or substantially all of its assets, is sold, merged, transferred or reorganized, information may be transferred as part of that transaction, subject to this policy or one at least as protective.

• With your direction or consent, for example when you ask us to.

We may share information that has been aggregated or de-identified so it can no longer reasonably identify you.

5. Your Jellyfin servers

Bloom connects directly to the Jellyfin servers you add (and, where you use it, any companion server your server admin provides). Those servers receive what they need to work, such as your sign-in, the device name and ID Bloom reports, what you browse and play, your playback progress, your favorites, and a profile photo if you choose one.

Those servers are not ours. They belong to you or to whoever runs them, that person controls the data on them, and their own policies apply. We have no access to them and are not responsible for how they collect, use, secure or share information. If you run a server that other people use, you are responsible for how you handle their information.

If you set up a newly installed Jellyfin server in Bloom, everything you enter (its name, language, your account and remote-access setting) goes only to that server, not to us.

6. On your device and in iCloud

These stay on your device: your settings, profiles and profile photos, parental-control activity reports, downloads, artwork caches, and subtitles Bloom generates from downloaded audio (made on the device; they never leave it).

Sign-ins to your servers and to your Bloom account are kept in the system Keychain on the device and never sync. Parental-control settings, parent codes, profile lock codes, and your servers' IDs, names and addresses can sync to your other Apple devices through iCloud Keychain, which Apple end-to-end encrypts and we cannot read. Settings › Servers › Remember Servers on My Devices turns server syncing off. Deleting the app removes its data from the device; sign out first to remove sign-ins from the Keychain.

Invite links and QR codes. You can invite someone with a link or QR code without a Bloom account. It holds your server's name and addresses and the person's username, never a password. You send it yourself from your own apps; we don't see it. This is separate from the one-time code in an email invite (section 2.3), which does go through us.

7. Device permissions

• Local Network (iPhone and iPad): only to find and connect to servers on your home network.
• Face ID / Touch ID: optional, to open a locked profile or show the parent code. Your device does the check; Bloom only learns whether it succeeded.
• Photos: Bloom doesn't ask for access. The system photo picker gives Bloom only the photo you choose for a profile.
• Notifications: optional, for things like new episodes, finished downloads and Live TV reminders. Their content comes from your server and is prepared on your device.

You can change these at any time in your device's Settings.

8. Purchases

Bloom is free to use, with a subscription for Bloom accounts and household invites, sold through the App Store. Apple processes every purchase, under Apple's terms and privacy policy; we never receive your payment details. Bloom checks with the App Store, on your device, whether your subscription or an earlier purchase applies to your Apple Account. When you send an email invite, Bloom also sends Apple's signed record of the purchase to our invite service, which checks Apple's signature and does not store it. Apple provides us with sales and financial reports, which do not identify you to us by name or email.

9. How long we keep information

We keep personal information only as long as needed for the purposes in this policy, then delete it or de-identify it.

We may keep information longer where the law requires it, or where reasonably needed to resolve disputes, prevent fraud or abuse, or enforce our terms, and then only for that purpose.

10. Deleting your account and your choices

• Delete your account in the app: You › Bloom Account › Delete Account (on Apple TV, Settings › Bloom Account). This immediately deletes your account, the servers saved to it, your memberships in other households, every household you own together with its members list and invites, and any open invites sent to your email address. Members of a household you own lose access to it through Bloom; their own Jellyfin accounts are untouched, because those live on your server. If you use Sign in with Apple, Apple asks you to confirm and we revoke Bloom's Apple sign-in as part of the deletion. The one-time code Apple issues for that passes through our account service to Apple and is not kept. Copies in provider logs and backups expire as in section 9.
• Not covered by deletion: emails already delivered (we can't recall them); invites sent to your email after you deleted your account (they expire within 15 days, or email us to remove them sooner); the 2-day record of invite emails you sent or received; data on Jellyfin servers (use the server's dashboard or ask whoever runs it); and data on your devices and in iCloud Keychain (see section 6).
• Stop without deleting: sign out of your Bloom account. Nothing new is sent.
• Ask us: email support@bloomcinema.app to access, correct, export or delete your information, or to object to or restrict how we use it. You can also delete your account by emailing us from its address.

11. Your privacy rights

We give everyone the following rights, wherever they live, subject to legal exceptions: to know and access the personal information we hold about you and receive a portable copy; to correct it; to delete it; to object to or restrict our use of it; and to withdraw consent where we rely on it.

How to make a request. Email support@bloomcinema.app from the address on your account where possible. We may need to verify your identity, for example by confirming a code sent to that address, and we won't fulfil a request we can't verify. You can use an authorized agent if you give them signed permission and verify your identity with us. We respond within the time the law requires (generally 30 days in the EEA and UK, 45 days in California), may extend it where the law allows, and will tell you if we do. Requests are free, unless they are manifestly unfounded or excessive. If we decline a request, we'll explain why, and where the law provides it, you can appeal by replying to our decision.

EEA, UK and Switzerland. You may also lodge a complaint with your local data protection authority. We'd appreciate the chance to address your concern first.

California and other US states. California residents have the right to know what personal information we collect, use and disclose; to delete and correct it; and to opt out of its sale or sharing, and to limit the use of sensitive personal information. We don't sell or share personal information and don't use sensitive personal information to infer characteristics about you, so there is nothing to opt out of or limit. In the past 12 months, we collected these categories, from you, from household admins who invite you, and automatically from your use of the Services, for the purposes in section 3, and disclosed them for business purposes only to the service providers in section 4: identifiers (email address, account ID, IP address) and internet or other electronic network activity (sign-in and request logs). We will not discriminate against you for exercising your rights. Residents of other US states with privacy laws have similar rights, and may use the same process.

Do Not Track and Global Privacy Control. We don't track you across websites or apps, so there is nothing for these signals to switch off; we treat them as an opt-out of sale and sharing in any case.

12. Security

We protect information with measures appropriate to its sensitivity, including encryption in transit (HTTPS), row-level access controls in our database so people can reach only their own households and invites, storing sign-ins in the device Keychain, and limiting who can access our systems. Bloom never asks our service for, or stores, your Jellyfin password.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your devices, your email account and your servers secure. Exposing a server to the internet carries risks that are yours to manage. If we learn of a security breach affecting your personal information, we will notify you and the authorities where the law requires.

13. International transfers

We are based in the United States, and our account service is hosted in the United States. If you use the Services from elsewhere, your information will be transferred to, stored and processed in the United States and other countries where our providers operate, whose data protection laws may differ from yours. Where the law requires, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and the UK Addendum offered by our providers.

14. Children

Bloom accounts are for adults: you must be at least 18, or the age of majority where you live, to create one. The Services are not directed to children, and we don't knowingly collect personal information from children under 13 (or under 16 in the EEA and UK, or the equivalent minimum age where you live). Kids profiles and parental controls live on your device and your own server so parents can choose what their children see; they don't need, and don't create, a Bloom account. Admins must not invite children by email; use an invite link or a profile instead. If you believe a child has given us personal information, email support@bloomcinema.app and we will delete it.

Parental controls are tools to help you, not a guarantee: they depend on how titles are rated on your server.

15. Other services and links

Bloom may link to or open services we don't control, such as trailers in the YouTube app or your browser, the App Store, or Jellyfin's website. Their own terms and privacy policies apply, and we aren't responsible for them. If you choose to share analytics with app developers in your device's settings, Apple may share crash reports with us; that is under Apple's privacy policy, and they don't identify you to us.

16. Changes to this policy

We may update this policy from time to time, for example when features or the law change. We'll post the updated policy here with a new effective date. If a change materially affects how we use personal information we already hold, we will give notice in the app or by email before it takes effect, and ask for your consent where the law requires. The App Store privacy details are updated with the version that introduces any change. Continuing to use the Services after a change takes effect means you accept the updated policy; if you don't, stop using the Services and delete your account.

17. Contact

Maddox Martinez, California, USA Email: support@bloomcinema.app

Bloom is an independent app. It isn't affiliated with or endorsed by the Jellyfin project.