Your privacy.

Blostma, established in Ottawa, Ontario, Canada, is the data controller for everything described here. For any question or request about your data, write to privacy@blostma.com.

Your account — email address and password. We need these to let you in and to send you account emails. The password is hashed by our authentication provider; we never see it. We also keep the fact that you confirmed you are a woman aged 18 or older, and which version of the terms you accepted. If you joined through a friend’s invitation link, we also keep her handle with your account.

Your onboarding answers — your first name, your handle, what you're working toward, the values you chose, how you communicate, and what you can give your circle each week. These exist for one purpose: to match you with four or five women whose answers sit close to yours. Some of this is personal and some of it may be sensitive to you; treat the “dream” field as something other members in your circle may eventually see reflected in how you're matched.

What you write — posts and replies in the community, messages and weekly check-ins in your circle, and your private notes. Posts and replies are visible to signed-in members. Circle messages and check-ins are visible to the members of your circle. Your notes are visible only to you. Your rating and written feedback about a circle are visible only to you and the Blostma moderation team. We also remember where you last read your circle conversation so we can show new messages.

Reports — when you report something, we store what you reported, why, and who you are, so a human can act on it. The person you reported is never told who reported them.

Weekly reminders — if you opt in, we use your email address to send one check-in reminder each week. You can switch reminders off in your circle at any time. With the same setting on, we also email you once if your circle goes a week without a message or a check-in.

How the app is used — when you open the app, which of its screens you visit and when you share an invitation, with your account and the time. We use it only to understand what helps circles work. It stays in our own database, is never shared with an analytics or advertising company, is deleted after 13 months, and goes with your account if you delete it.

Encouragements — when you send a member of your circle a word of encouragement, we store who sent which word to whom. Only the two of you see it.

Your one-month review — after a month in a circle we ask whether you want to stay. Your answer is visible only to you and the Blostma moderation team.

Removed accounts — if we remove an account for breaking the community rules, we keep a record of the removal and the reason, so that account is not matched into a circle again.

Circle message emails — if you opt in, we email you when your circle has new messages, no more than one update for a day of activity. These emails never include message text. You can turn them off in your circle settings at any time.

We do not run advertising trackers, we do not sell anything about you, and we do not profile you for anyone else's benefit.

Only you can read your notes and your goals. Your circle can read your circle messages, weekly check-ins and your weekly commitment — you answered that question about them. Every signed-in member can read your community posts, your replies, your first name and your handle. Nothing on Blostma is public to the open internet.

Your dream is private until you choose to show it. It is collected to match you, not to be published. You can share it with your circle, and hide it again, at any time from your circle page.

Assume anything you post to the community could be screenshotted by another member. We enforce our rules, but we cannot un-see something for someone else.

Our hosting and database provider (Supabase) and our application host store this data on our behalf, under contract, and are not allowed to use it for anything but running Blostma. Because they run on global infrastructure, your data may be stored or processed outside Canada — including in the United States — where it can be subject to the laws of that country.

Your account data stays while your account exists. When you delete your account from your profile page, we erase your profile, posts, replies, hearts, circle messages, check-ins, feedback, email preferences, reading position, goals, notes and onboarding answers, and then the account itself. That deletion is immediate and cannot be undone.

Reports you submitted are deleted with your account. Reports submitted by others about your content may remain as safety records, without a link to your deleted account.

You can ask what we hold about you, correct it, get a copy of it, or have it erased. Deleting your account from the profile page does most of this in one click; for anything else, write to privacy@blostma.com and we will answer within 30 days.

Blostma is operated from Canada and follows PIPEDA, the federal privacy law. If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada.

If you are in the United Kingdom or the European Economic Area, you also have the right to object to or restrict how we use your data, the right to data portability, and the right to complain to your national supervisory authority.

We store one thing in your browser: your login session, so you don't have to sign in on every visit. There are no analytics or advertising cookies, which is why you have not been asked to accept any.

Blostma is for adults. You must be at least 18 to hold an account. If we learn an account belongs to someone younger, we delete it.