Privacy policy
Bluma is being built. Today this site takes pre-orders for its first year. This policy says what we collect now, and what the product will collect when it launches.
Now: the pre-order
What we collect
- When you pre-order. You pay on Stripe's checkout page. Stripe collects your card details; we never see your full card number. We receive your email address, the name and country you enter, and the payment record.
- When you visit. Vercel Web Analytics counts page views and two clicks: the pre-order button and the example seal. It sets no cookies, and what it records is not tied to you or to your IP address. It tells visits apart with a hash that is discarded after 24 hours, and it records the page, the referring site, your country and region, browser, operating system and device type.
- When you email us. We keep your email and our reply.
What we use it for
To take and refund pre-orders, to tell you about launch and early access, and to count how many people visit and pre-order. We do not sell or share your details, we do not put you on a marketing list, and we do not use your details for advertising.
Who handles it for us
Stripe (payments), Vercel (hosting and analytics) and Resend (our email). Each processes what it handles under its own terms.
How long we keep it
Payment records: as long as Australian tax law requires. Emails: until your pre-order is settled, either refunded or turned into your first year, and then only as long as we need to answer you. If we decide not to launch, we refund everyone and delete what we hold, except the payment records the law requires us to keep.
At launch: the product
Bluma lets you write an email or Slack message now and have it sent later from your own account, with a lock that makes taking it back deliberate.
What the product will collect, and why
- Your account: your email address (to sign you in and send you service messages), time zone, and your settings.
- Messages you seal: the recipients, subject and text of each message you choose to seal, held encrypted on our servers only until the message is sent or withdrawn, then deleted. After that we keep only a count, a length and a checksum, never the text.
- Connected accounts: when you connect Gmail, Outlook or Slack we store the tokens those services give us, encrypted, so we can send on your behalf at the time you chose. For Gmail we request only the permission to send email (
gmail.send). Bluma cannot read your inbox, your drafts or your contacts. - Timing data about your own messages: when you first opened a draft in your mail client (recorded by the browser extension), when you sealed it, and when it went. This is how Bluma shows you how long messages used to sit in drafts. It never includes message content.
- Technical logs: provider error codes and timestamps needed to deliver and audit sends, kept 30 days.
What we will not do
We will not read your messages: no person at Bluma can, because they are encrypted and the sender only decrypts them to send. We will not use message content or metadata for advertising, profiling, training models, or anything other than sending your message and showing you your own statistics. We will not sell or share your data. We will not keep message text after it is sent.
Google user data: Limited Use
Bluma's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use the gmail.send permission only to send the messages you seal, at the time you chose; we do not transfer Google user data to anyone except as needed to send your message (to Google) or as required by law; we do not use it for advertising; and no human reads it except with your explicit permission for support, or as required for security or legal reasons.
Chrome extension: Limited Use
The Bluma extension has one purpose: to seal an email you have drafted in Gmail or Outlook on the web so that Bluma can send it later. It reads the recipients, subject and body of a compose window only when you press Seal, after you have agreed to the disclosure shown before the first capture, and sends that content over HTTPS to Bluma's servers, where it is encrypted. It does not read other emails, your browsing activity or any page other than the compose window you are sealing. Its use of user data adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Where data will live
Supabase (database, Sydney region), Vercel (application), Resend (our own service emails) and Stripe (payments; we never see card numbers). The services you connect (Google, Microsoft, Slack) process your messages under their own terms.
Retention and deletion
Message text: until sent or withdrawn. Message metadata and your vault history: until you delete your account. Connected-account tokens: until you disconnect the account or delete your account. Deleting your account removes everything immediately; there is no soft delete. You can also revoke Bluma's access from your Google, Microsoft or Slack account settings at any time, which stops all future sends.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. The Australian Privacy Principles apply. For people in the EU or UK, the lawful basis is contract (to provide the service) and consent (for connected accounts). Write to hello@usebluma.com; we answer within 30 days.
Children
Bluma is not for people under 18.
Changes
We will email everyone who has pre-ordered or holds an account before any change that affects what we collect or how long we keep it.