Blumi Privacy Policy

Effective since: November 2, 2026

This policy explains what data Blumi collects, why, who we share it with, and how you control it. It is part of the Terms of Use.

Who is responsible

Blumi is responsible for your data. Contact us about privacy at mvcouto.apps+privacy@gmail.com.

Data we collect

Account and sign-in
What it includes: Name, email, Google account data (name, email, and identifier) when you sign in with Google, the public part of your passkeys, and your recovery code stored in protected form. We do not store passwords.
Purpose: Create and protect your account, let you sign in and recover access.
Profile and goals
What it includes: Sex, date of birth, height, weight, activity level, goal, and calorie and macronutrient targets.
Purpose: Calculate your plan and daily targets and, combined with other people's and without identifying anyone, understand Blumi's audience by age range, sex, goal, and activity level.
Meals and photos
What it includes: Meal photos, foods, portions, estimated calories and macronutrients, meal type and time, and your edits.
Purpose: Analyze the photo, build your history, and total your day.
Reminders and preferences
What it includes: Meal and reminder times, language, units, and theme.
Purpose: Schedule reminders and keep the app set up your way on every device.
App usage
What it includes: Days with logs (streak), screens opened and actions in the app, and the feedback messages you send.
Purpose: Show your progress, understand what works, and improve the app.
Device and security
What it includes: Device model and OS, app version, installation identifier, IP address, approximate location from the IP (city and country, never GPS), time zone, and security logs.
Purpose: Keep your sessions, show where your account is signed in, prevent fraud, limit abuse, and, in combined form without identifying anyone, learn which cities use Blumi most to guide marketing.
Subscription
What it includes: Plan, status, dates, and store of purchase. We never receive your card details.
Purpose: Unlock paid features and handle billing support.
Support requests
What it includes: Message, topic, name (optional), email used in the app (optional), and the contact you chose for our reply: WhatsApp, phone, or email.
Purpose: Reply to your request and, if needed, find your account.
Technical errors
What it includes: Crash reports with the screen, device, and app version, without photos or health data.
Purpose: Find and fix errors.

We collect what the app needs to work, stay secure, and improve. We do not sell your data and do not use it for third-party advertising.

Aggregated or de-identified data. We may turn data into combined statistics that do not identify anyone, such as how many people use the app by age range or city, and use them to understand our audience and guide marketing. We keep it in that form and do not try to re-identify anyone.

Health and sensitive data

Some data you enter is sensitive or consumer health data (profile and goals, meals and photos). You choose to provide it, and we use it to deliver the features you asked for. We ask for your consent where the law requires it, and you can withdraw consent by editing or deleting that data in the app or by deleting your account. We never sell it or use it for advertising.

Residents of Washington and states with similar laws should also read our Consumer Health Data Policy.

How we use your data

To provide the service you asked for: account, sign-in, app features, and subscription.
With your consent: health and sensitive data, as explained above.
To keep the app safe and working: account security, fraud and abuse prevention, fixing errors, and improving the product with usage data.
To comply with the law: when the law requires us to keep or provide data.

Who we share it with

We use service providers that process data on our behalf, under contract and only for these purposes:

Hosting, database, and storage: all app data
AI model providers: the meal photo, the time, the language, and any notes you write, without name, email, or profile
Sign-in providers: account name, email, and identifier
App stores, payments, and subscription management: internal account identifier, email for web purchases, and purchase data
Usage analytics: internal account identifier, screens, actions, device, and the goal chosen at signup, with no screen recording
Error monitoring: internal account identifier and technical error and device data
Internal team tools: internal account identifier and, for support requests, the message, contact, name, and email provided
App update delivery: IP address, device, and app version

The current list of service providers, with where each one operates, is kept on a separate page and changes as our providers change.

We may also share data when required by law or an authority, to protect people's rights and safety, or in a sale or reorganization of the company (with the same protections as this policy).

Photos and uploaded files

Photos and files you upload are stored to show your history and only open while you are signed in to your account. When you delete an item or your account, the file is deleted.

Where data is stored

App data is stored on servers in the United States. If you use the app from outside the United States, you understand that your data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your country.

How long we keep it

We keep personal data for as long as reasonably necessary for the purposes in this policy: while your account exists, and afterward as needed to meet legal obligations, resolve disputes, or keep the service secure.

When you delete your account, your data is removed from the app immediately. Copies in backups are removed as those backups cycle out, ordinarily within 30 days.

Even after deletion, we may keep:

Security logs no longer linked to you, used to prevent fraud;
An anonymous record that an account was deleted (reason, if you gave one, and usage ranges);
Usage metrics already sent to our analytics provider, linked only to an internal identifier, until they expire under that service's retention;
Support requests and their internal alerts, which are kept separate from your account; to erase them, ask through the privacy channels;
Store purchase records, which belong to the store and follow its policy.

No sale of personal information

We do not sell your personal information, do not share it for cross-context behavioral (targeted) advertising, and do not use sensitive data to infer characteristics about you. Because of that, there is nothing to opt out of; we also honor Global Privacy Control signals.

Your privacy rights

Depending on your state (such as California, Colorado, Connecticut, Virginia, Texas, Oregon, or Washington) or country, you may have the right to:

know what personal data we collect and access it;
correct inaccurate data (most of it can be edited in the app);
get a copy of your data in a portable format;
delete your data and account (see how);
withdraw consent for sensitive and health data;
not be discriminated against for exercising these rights.

Send your request through the privacy form or to mvcouto.apps+privacy@gmail.com, including the email linked to your account. We verify your identity before acting and respond within 45 days. If we decline your request, you can appeal by replying to our answer; if you are still not satisfied, you may contact your state attorney general. An authorized agent may submit a request on your behalf with your written permission.

If you are in Brazil

Brazil's General Data Protection Law (LGPD) gives you the rights above and the right to know who we share your data with. Send your request to mvcouto.apps+privacy@gmail.com. You can also complain to the Brazilian data protection authority (ANPD).

If you are in Canada

Canadian privacy laws, such as PIPEDA and Quebec's Law 25, let you access and correct your personal data and withdraw your consent, subject to legal limits. In Quebec, you may also ask for your data in a portable format. Your data is processed in the United States, where authorities may access it under local law. Send your request to mvcouto.apps+privacy@gmail.com. You can also complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.

If you are in Latin America

Laws such as Mexico's federal data protection law, Argentina's Law 25.326, Colombia's Law 1581, and Chile's Law 19.628 may give you the right to access, correct, delete, and object to the use of your personal data. We process it to provide the service, with your consent where the law requires it, and in the United States, as described above. Send your request to mvcouto.apps+privacy@gmail.com. You can also complain to your country's data protection authority.

Security

We use encrypted connections (HTTPS/TLS), sign-in without stored passwords (such as passkeys), and restricted access to our systems. No system is completely secure. If an incident creates a relevant risk to you, we will inform you as the law requires.

Minimum age

Blumi is for people aged 18 and over. We do not knowingly collect personal information from children under 13 (COPPA) or from anyone under 18. If we learn that this happened, we delete the data.

Notifications and reminders

Reminders are scheduled on your own device. You choose the times in the app and can turn them off in the app or in your system settings at any time.

Changes to this policy

We may update this policy at any time. The new version is published on this page, with the date at the top, and takes effect when published. We do not send individual notices for each update, but we give reasonable notice of material changes, such as a message in the app. By continuing to use Blumi after publication, you agree to the new version. If you do not agree, stop using the app and, if you wish, delete your account.

Contact

Privacy: mvcouto.apps+privacy@gmail.com · Support: mvcouto.apps+support@gmail.com

Blumi