Your data. Locked down, spelled out.
No badges, no jargon — just plain-English promises about what Blooom can and can't do with your money and your data, and the technical detail underneath if you want it.
The work is automatic. The decisions stay yours.
It can't move your money
Blooom is read-only. There are no payment rails in the app — nothing here can send, spend or move a penny. It only shows you the numbers you choose to add. There's no access to your money for anyone to steal.
We keep the numbers, never the documents
Scan a payslip and it's read in memory to pull out the figures you approve, then dropped — never stored. Everywhere else you type your balances in yourself. We never ask for your online-banking password and we can't log into your accounts. The keys to your money never come near us. We keep the numbers you approve — never the document.
Nothing about you is sold
Blooom earns from subscriptions and clearly-labelled referrals — never from selling or renting your data, and never from ads pointed at you. If we ever add privacy-friendly analytics, we'll name exactly what and who, here first. Your money numbers are never sent anywhere to be sold.
Delete everything, whenever
Change your mind any day. You can erase your whole account yourself: every figure is gone from Blooom immediately, with no support ticket, and is purged from our encrypted backups within the backup retention period. A quick confirm just stops it happening by accident. You can also export a full copy of your data whenever you like.
The technical detail
For anyone who wants to see under the bonnet. Everything here is a promise the build keeps — no badges, no jargon.
Your data is encrypted in transit and at rest. Connections to Blooom use TLS, so your numbers are scrambled on the way to and from our servers.
At rest, the database is encrypted with AES-256 on Supabase, the managed platform that hosts it. The encryption keys are held and managed by the hosting provider, not left lying beside the data.
Blooom runs on established managed cloud platforms: Supabase for the database and authentication, and Vercel for the application itself.
Your database sits in Ireland (the eu-west-1 region), so the numbers you type in are stored in Europe rather than shipped overseas by default.
Some processing may happen outside the UK, including in the United States. Where data is transferred outside the UK, we rely on the safeguards recognised under UK data-protection law — such as the UK Addendum to the EU Standard Contractual Clauses. The full detail is in our Privacy notice.
You sign in with an email and password, or with Google. Supabase Auth handles sign-in and stores your password only as a bcrypt hash — we never see or store the password itself.
Two-factor authentication is available: you can switch on an authenticator-app code as a second step at sign-in, with one-time backup codes in case you lose your device. To turn it on, go to Settings, then Security, then Two-factor authentication, and scan the code with any authenticator app. Keep the backup codes somewhere other than your phone.
Signed-in sessions are held in secure, browser-guarded cookies, refreshed automatically and cleared the moment you sign out.
When you scan a document like a payslip, the image is processed in memory only, for that single request. It is never written to storage, never uploaded to a bucket, and never logged.
Only the specific figures you approve are saved, from a fixed allowlist of fields — the document itself, and anything off that allowlist, is discarded the instant the figures come back. A “What we kept” record shows you exactly which fields were saved.
No third-party text-recognition provider is wired in today, so scanning simply falls back to letting you type the figures in. If we ever add one, it must be zero-retention and must not train on your data — the promise outranks the convenience.
Every row in the database carries the id of the person it belongs to, and the database itself refuses to return a row whose id does not match whoever is asking. This is called row-level security. It is not a check the app performs and could forget: the rule lives in the database, so a bug in our code cannot talk it into handing over someone else's rows.
There is one deliberate exception, and it is ours: a server-only service key can read across accounts, because scheduled jobs like the reminder emails have to. It never reaches your browser. Access to it is limited to the few people who need it, and use of it is logged.
The services that process data on our behalf are a short, named list: Supabase (database and authentication), Vercel (hosting), Resend (email) and Anthropic, which powers the AI coach and is sent only the minimum needed to answer. Each is covered by a data-processing agreement; the full sub-processor list lives in our Privacy notice.
Every change runs through an automated test suite before it ships. That suite includes checks that guard the promises on this page — including a linter that holds this page back from going live until every claim on it is a verified fact rather than a placeholder.
Found a security issue? Email security@blooom.money. Our responsible-disclosure policy is published at /.well-known/security.txt — please tell us before disclosing publicly, and we'll work with you on a fix.
If a breach ever put your data at risk, we would report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly without undue delay when the risk to you is high. We would tell you what happened, what it means for you, and what we had done about it.
Under UK GDPR you can see, correct, export or delete your data. The big two you can do yourself, right now: export a full copy of your account, or delete everything permanently, from your settings — no request needed.
For anything else — access, correction, or a complaint — email tom@blooom.money. You also have the right to complain to the Information Commissioner’s Office (ICO) at any time.
More on how we work: How we make money · Privacy