Privacy policy

Moellenbeck-Digital UG (haftungsbeschränkt)

Luisenstraße 59
45892 Gelsenkirchen
Deutschland

E-Mail: admin@moellenbeck-digital.io

BloomMD processes account data such as email address, login and session data where required for registration, login and the free trial account.

Markdown files are processed locally by the local-first core. Data is transmitted to BloomMD only when an optional sync or cloud service is actively used.

The free trial account offers no paid plans, collects no payment data and provides no checkout. Payment providers become relevant only if BloomMD explicitly offers paid features later.

BloomMD may use Resend for account email such as email verification, password resets and important product notices. Markdown content is not sent to Resend as email content.

Sentry may be used for error monitoring. Plausible loads when it is configured for the deployment and the page is served from bloommd.io; script and events go through our own domain and are configured without cookies or persistent identifiers. The optional PostHog integration is consent-gated separately. Autocapture, session recording and pageleave capture are disabled. Only page paths and allowlisted events are collected; Markdown content, file names, node titles, search terms, complete URLs and document paths are excluded.

Realtime sync is initially optional and may be operated as a beta feature. Without sync enabled, Markdown files remain local. With sync enabled, the document structures required for collaboration are transmitted through the sync service.

Local files. The app edits Markdown files and drawings (SVG) either in its own folder on the device or in a folder you pick (iOS: Files app, Android: folder picker), such as your Obsidian vault in iCloud Drive. These files are not transmitted to us. Whether and where a folder is synced (e.g. iCloud Drive) is decided by the respective storage provider, whose privacy policy applies – for iCloud, Apple's. To reopen the chosen folder after a restart, the app stores a reference to it on the device. On Android, the operating system's backup may save the app's own folder with your notes to your Google account; the sign-in token is excluded from it.

No analytics, no tracking. The app contains no analytics, advertising or crash-reporting services and does not track you across apps and websites owned by other companies.

Optional sign-in with a BloomMD account. Only when you actively sign in with your BloomMD account does the app transmit data to our servers: the content of the maps you open and edit in your cloud workspaces and the data needed to sign in (email address, display name, access token and a device name such as "iPad" so you can recognise and revoke the access in your account). Signing in happens in the browser on our website; you never enter your password in the app. While editing together, other members of the workspace see your name and which node you have selected. Data is transmitted encrypted. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). The access token is stored encrypted in the keychain (iOS) or the Android Keystore and is valid for one year; signing out revokes it on the server and deletes it on the device. If you sign in to a self-hosted BloomMD server, its operator is responsible. Content is kept until you delete it or your account; you can delete your account at https://bloommd.app/account (also reachable in the app under "Manage or delete account").

Content from the internet. If a note contains an image or a preview from another website, the app loads it directly from there. The provider of that website receives your IP address.

Sharing. The share sheet hands a map as Markdown, OPML, PDF, PNG or SVG to an app of your choice; what happens there is governed by that app.

Links into the app. Links like bloommd://open open a note in the folder that is already open. For links like https://bloommd.io/open, the system opens the app if it is installed; otherwise your browser loads a page of our website with the download and the web app, without any content of the note. The app itself transmits no data when opening a link.

In the web app you can create a link that lets people without a BloomMD account read a map. The link shows titles, visible text and task and decision details of the nodes. Frontmatter, Markdown comments and embedded files such as drawings are not shown. A link can expire (1 to 365 days) and can be revoked at any time. Anyone who knows the link can read the map.

Workspace agents (e.g. OpenClaw) run on a computer of your choice, not on our servers. An agent only receives tasks assigned to it in the workspace, and for a node task only that node. Its results are proposals that a workspace member has to accept. Which services the agent itself uses (such as a language model) is up to you when you set it up. The mobile app contains no agent features.

BloomMD uses technically necessary session cookies so signed-in users can be recognised and protected areas can work.

Only if a consent-required analytics service is enabled, the marketing app stores that choice in the browser under `bloommd:analytics-consent:v1`. Plausible itself does not require this choice because it is configured without cookies or persistent identifiers.

The free trial account is valid for 30 days from email confirmation. Before it ends, we send you a reminder email after 15 days and another after 23 days. Purpose: to remind you that the trial period is ending. After it ends, your account is read-only and export remains possible.

Processed data: your email address, the time of your email confirmation, from which the sending times follow, the language of your signup (for the language of the email) and the time each reminder was sent (so that each one is sent only once). For existing accounts, the trial period ends on December 15, 2026 (counted from November 15, 2026); the reminders are then sent on November 30, 2026 and December 8, 2026. The emails are sent through our email provider (see transactional email). Legal basis: Art. 6(1)(b) GDPR, performance of the user relationship for the account.

So that one person cannot obtain several free trial periods with different spellings of the same mailbox, BloomMD derives a canonical form from your email address and compares it with other accounts. In it, upper case is lowercased, a +tag in the part before the @ is removed (for example name+shop@example.com becomes name@example.com), and for Gmail addresses (gmail.com, googlemail.com) the dots in that part are removed and googlemail.com is read as gmail.com. If another account with the same canonical form has already confirmed its address, no new account is created or, at confirmation, the new account receives no trial period and is not confirmed; nobody is excluded permanently by this, and you can keep using the existing account.

Processed data: the canonical form of your email address. Purpose: protection against abuse of the free trial account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing multiple trial periods for one person). The canonical form is stored only in your account, next to your email address, and is deleted together with the account. For signups, a counter limits attempts per canonical address; it is stored only as a hash and deleted as described under “Retention and deletion”. No further data sources are used.

The waitlist has ended; nobody can join it any more. Anyone who joined earlier and confirmed the address receives a single email inviting them to register. Stored are the email address, the time of the entry, the source page and the status (confirmed, unsubscribed). The legal basis is the consent given when joining (Art. 6(1)(a) GDPR). Unconfirmed entries are not contacted.

All waitlist entries are deleted 90 days after that invitation email. Unsubscribing remains possible through the link in the invitation email and in earlier waitlist messages, without an account or sign-in; this withdraws consent at any time. After unsubscribing, the address is not contacted again and is removed with all other entries. For confirmed entries we also prepare an account that is not active yet, under the same address; the invitation email carries the link to activate it. Nobody can sign in before the person confirms the address, chooses a password and agrees to the privacy policy and the terms through that link. An account that is not activated is deleted 90 days after that email.

These service providers receive data from BloomMD for the purposes named here:

• Email delivery (Resend): for account emails such as email confirmation, password reset and the reminder emails of the trial period, Resend receives the recipient address and the subject and content of the email. Content of your Markdown files is not part of these emails.
• Error monitoring (Sentry): if error monitoring is set up in the deployment, Sentry receives technical error reports. BloomMD does not send personal default data (sendDefaultPii is off) and cleans the events before they are sent.
• Web analytics (Plausible, PostHog): Plausible runs as an instance under the domain plausible.ops.moellenbeck-digital.io, without cookies or persistent identifiers. The browser loads the script from and sends events to our own domain (bloommd.io/_plausible/…); our server forwards them to that instance and passes on only the browser’s IP address and user agent, no cookies. PostHog is optional and only loaded after consent. What is collected is described under “Error monitoring and product analytics”.
• Feedback (GitHub, object storage): if the feedback function is set up, a ticket is created at GitHub from your feedback. It contains your message, your email address and account ID, a contact address if you gave one, the page you were on, and browser and version details. Attachments (screenshot, video) are stored in an object storage and linked from the ticket.
• Members of your workspaces and everyone who knows a share link you created see the content you share there (see “Share links (read-only)”).

Payment service providers become relevant only if BloomMD offers paid features (see “No payments”).

BloomMD deletes the following data after these periods:

• Accounts whose email address was never confirmed: 7 days after registration, together with their one-time tokens.
• One-time tokens (email confirmation, password reset, activation of a prepared waitlist account): 7 days after they expire or are used.
• Sessions (sign-in in the browser): 7 days after they expire or are revoked.
• Access tokens (for example for the mobile app): 30 days after they expire or are revoked.
• Deleted documents: permanently removed 30 days after deletion.
• Security log (audit events with time, type, outcome and affected object, linked to the account that triggered the action): 365 days after the event.
• Counters that limit requests (stored only as a hash): 7 days after their last update.
• Accounts prepared from the waitlist that were never activated, and waitlist entries: 90 days after the invitation email (see “Waitlist (ended)”).

An expired trial account is currently not deleted automatically. It is read-only and export remains possible. The account and its content stay stored until you delete the account.

You can delete your account at any time at https://bloommd.app/account (confirmation with your email address and password), also after the trial period has ended. Deleting removes at once: your account with email address and display name, your sessions, one-time tokens and access tokens, your permissions and workspace memberships, your saved views, the records of the reminder emails sent to you, your personal workspace with all its documents and share links, and the workspace agents and agent tasks you created and the workspace invitations you sent. For team workspaces you own: without other members, the workspace is deleted with all its documents. With other members, one of them becomes the owner (preferably an owner, otherwise an editor, otherwise the longest-standing member) and the workspace with its documents stays available to them. Documents you created in workspaces that remain stay there; your name is removed as their author.

Not removed when you delete your account: security log entries (they lose the link to your account and are deleted 365 days after the event); payment records, if any exist (their raw data is redacted and the link to your account is removed; running subscriptions are cancelled beforehand); messages sent through the feedback function (they lose the link to your account, the email address you entered stays in the entry); and an earlier waitlist entry, which is deleted as described under “Waitlist (ended)”.

Processing is based in particular on contract performance, pre-contractual measures, legal obligations and legitimate interests in secure operation.

Users may request access, rectification, erasure, restriction of processing, data portability and objection where the statutory requirements are met.

4. November 2026