Privacy Policy — Bloom Calendar

Last updated: 2026-10-21

What this app is

This app is published by Bees, Blooms & Bytes LLC.

Bloom Calendar is a bloom and nectar-flow forecasting tool for beekeepers, gardeners, foragers, and land managers, for iPhone, iPad and Android. This policy covers the app and its backend (a Cloudflare Worker at bloom-api.bloomcal.workers.dev).

The backend Worker is also used by two separate sibling apps ("WaggleOps" and "Farm Mileage Tracker"), but each app has its own private database and accounts. WaggleOps can access Bloom Calendar's public calibration data through this Worker's public API. Each app has its own privacy policy — see /waggleops-privacy and /farmmileage-privacy. Everything below describes Bloom Calendar only.

Accounts

Signing in is entirely optional — every feature described below (logging observations, viewing the calendar, community data) works exactly the same without ever signing in, and nothing you log is lost if you skip it. Signing in only adds one thing: your own logged bloom/frost observations sync across your devices.

If you sign in with Google or Apple, we never receive or store your name, email address, or phone number. We only receive and store an opaque, anonymous account identifier (Google's or Apple's own sub claim) — the rest of the sign-in token is discarded immediately upon verification and never logged or stored. That identifier is tied only to whichever bloom/frost observations you've logged under it; it is not linked to the anonymous community submissions described below, which never require signing in at all.

Information you submit

• Bloom observations: ZIP code, city name, county, state, plant name, date, bloom stage, and an optional note (capped at 280 characters). The ZIP code and city are those of the nearest supported city, so a record is only as precise as that city (miles, not your yard). It does not include GPS coordinates.
• Frost observations: the same shape as bloom observations — ZIP code, city name, state, date, frost type, and an optional note.
• Flow-rating reports: plant name, state, suggested flow rating, an optional note, and an optional ZIP code.
• City requests: this stores the latitude/longitude of the requested area rounded to about 1 km (not your exact spot), plus elevation, county, an optional note, and an optional ZIP code. The app asks before sending one. Requests received before 2026-10-21 may hold the unrounded coordinates sent at the time.
• Photos (plant or mushroom reports): stored in Cloudflare R2, alongside the same kind of fields as above (plant/mushroom name, ZIP code, city name, state, date, optional note). Your device strips EXIF location metadata before upload, so no embedded location data reaches our server with the photo.
• Plant identification photos: forwarded to Pl@ntNet, a third-party identification service, and not stored by us — proxied through our server and discarded once Pl@ntNet responds.

All community submissions are reviewed by an admin before they appear publicly or count toward shared regional calibration. If a community observation that is shown should not be, tap Report on it: that opens the Help report form with the observation's details filled in, and it goes to the developer, who removes content that does not belong.

Food plot entries (the food-plot tracker for hunters/land managers) stay on your device only — they're never sent to our server.

Location permission

If you enable "Use my exact location," your device's GPS coordinates are sent directly from your device to three third-party services — OpenStreetMap's Nominatim, Open-Elevation, and Open-Meteo — to find your nearest supported city and calibrate the forecast. These calls bypass our own server entirely.

Your coordinates are also sent through our server (not stored) for two on-demand lookups: soil type (proxied to the USDA's Soil Data Access service) and the nearest weather station's daily data (for real Growing-Degree-Day figures). Neither writes your coordinates to our database.

If you use the map's "Locate me" button or request a new city, your approximate location (rounded to about 1 km) may additionally be sent to our server as described in "City requests" above, only when you choose to send a request.

Third parties

• Pl@ntNet: processes plant-identification photos. See their own privacy policy.
• OpenStreetMap (Nominatim), Open-Elevation, Open-Meteo: receive raw GPS coordinates directly from your device for exact-location features.
• USDA Soil Data Access: receives your coordinates through our server when you view soil info for a location; not stored on our end.
• Weather Underground (via a single personal weather station we read from): we resolve the station nearest your submitted coordinates to show real local weather/GDD data; your coordinates aren't stored for this.
• OpenStreetMap (map images), unpkg.com (the map library's code), Google Fonts (the page's fonts): the map, the code that draws it and the fonts are loaded directly from these services when you open the page or the map. Like any website they receive your device's IP address and the usual details of a request; no observation, account or location data is sent to them by us.
• Esri, USFS, USGS: optional map overlay data (land cover, forest boundaries, rivers/lakes).
• Cloudflare: hosts our backend. Data in transit is over HTTPS.
• GitHub: stores problem reports you choose to send (see above).
• PayPal: handles donations made on the website; we never see payment details. The iPhone, iPad and Android apps do not ask for or take donations.

We do not sell or share data with advertisers or data brokers.

Reporting a problem

Help → Report a problem sends what you type (the description, any steps, and a contact detail only if you choose to add one), the app version, and the device type (for example "iOS (app)") to a small feedback service run by the developer on Cloudflare. It saves each report as an issue in the developer's private issue tracker on GitHub. Your IP address is used only to limit spam, is kept for about two days, and is not included in the report. Reports are not linked to an account and are not removed when you delete your account; email us and we will delete one on request.

Diagnostics you choose to share

The in-app debug panel has a "Copy debug info" button that packages your recent in-app log, self-test results, and basic device info (user agent, current URL) into a text block. This is generated on your device and only leaves it if you actively choose to share, copy, or paste it somewhere yourself — it's never sent to our server automatically.

Data retention / deletion

You can sign out at any time from within the app — this stops sync but does not delete anything already synced.

Delete account: while signed in, choose Delete account next to Sign out in the app. It permanently deletes your account and every observation synced to it. If you no longer have the app, sign in with the same Google account at https://bloom-api.bloomcal.workers.dev/delete-account and type DELETE. (An account made with Sign in with Apple is deleted inside the iPhone or iPad app.) This account is shared with WaggleOps if you use both, so deleting it removes your WaggleOps data too.

To have a specific anonymous community submission removed, contact us with its date, location and plant; those are never linked to an account.

Children's privacy

This app is not directed at children and is not knowingly used to collect data from anyone under 13.

Changes to this policy

If this policy changes in a way that affects what we collect, we'll update the "Last updated" date above.

Contact

For privacy questions, contact Bees, Blooms & Bytes LLC, the publisher of this app, at rdshad@beesbloomsandbytes.com.