Last updated: July 2025

Privacy Policy

This Privacy Policy explains how NoteBloom (“NoteBloom,” “we,” “us,” or “our”) collects, uses, and protects information about you when you use our platform at notebloom.app and related services (the “Service”).

1. Introduction

We are committed to protecting your privacy. By using NoteBloom you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Service.

This Policy applies to all users worldwide. Users in the European Union, United Kingdom, or other jurisdictions may have additional rights described in the relevant sections below.

2. Information We Collect

We collect the following categories of information:

Account & Authentication

• Email address, full name, hashed password
• Account creation timestamp, last login timestamp
• Authentication tokens and session identifiers

Profile & Preferences

• Field of study (e.g., medical, nursing, dental)
• App preferences and settings
• Subscription tier and status

Notes & Uploaded Content

• Uploaded notes text, AI-transformed content, original source content, note titles, themes, and project assignments
• Timestamps for creation and modification
• PDF storage path references (location of stored PDF files in our cloud storage)
• Text extracted from uploaded PDFs and photos (including per-page transcript text)

Uploaded Files

• PDF files stored in Supabase cloud storage (note-pdfs bucket) — accessible only to you
• Dream board images stored in Supabase cloud storage — private to your account
• Text and image data extracted during processing

Flashcards

• AI-generated, manually created, and imported flashcard content
• Spaced repetition data: ease factor, review intervals, due dates, review status, and review counts
• Deck names and section tags

Exams

• Exam questions, your answers, scores, number of attempts, and timestamps

Study Runs & Quizzes

• Quiz questions, your answers, scores, and run metadata
• Section progress tracking, cached questions, and run history

Clinical Practice Sessions

• Session settings, answers, scores, per-topic progress
• History of answered questions (to avoid repeats)

Community Content

• Uploaded public notes, your institution, degree field, and anonymous flag preference
• Quality scores, download counts, upvotes received, points earned, and leaderboard rank

Projects

• Project names, emoji, color, and note assignments

Priming & Motivation

• Study intentions, planned session duration
• AI-generated affirmations, dream board items and images, session history, and streaks

Usage & Analytics

• Features used, blooms performed per month, exam scores over time, study streaks
• Login frequency and session duration
• Usage tracking records for service improvement

Payment Information

• Subscription plan type and billing email
• Payment history (amounts, dates, status)
• Credit card and payment details are stored directly by Stripe, Inc. — NoteBloom never stores raw card data

Technical & Device Information

• IP address, browser type and version, operating system, device type
• Pages visited, referrer URL, session duration
• Error logs and performance data

3. How We Use Your Information

• To provide, operate, maintain, and improve the Service
• To process your uploaded content through AI services to generate bloomed notes, flashcards, quiz questions, exams, and affirmations
• To personalize your study experience (spaced repetition schedules, progress tracking, streaks)
• To manage your subscription and process payments through Stripe
• To enforce our Terms of Service and prevent fraud or abuse
• To send transactional emails (account confirmation, password reset, billing receipts)
• To respond to support requests and communications
• To comply with applicable law, legal process, and governmental requests
• To aggregate and analyze usage data for service improvement (in anonymized or aggregated form where possible)

4. AI Processing Disclosure

NoteBloom uses Anthropic’s Claude APIto power AI features including note blooming, flashcard generation, quiz and exam creation, and motivational affirmations. When you use these features, the relevant content (your uploaded notes, extracted text, or context you provide) is transmitted to Anthropic’s servers for processing.

• What is sent: your note text, extracted PDF/photo text, and any context you provide
• What is NOT sent: community scoring uses metadata only; clinical practice questions are served from a pre-built question bank — your note content is not sent for clinical question generation
• Training: Anthropic does not train its models on data submitted via the API under its standard API terms. Your content is not used to train Claude.
• Accuracy: AI-generated outputs may contain inaccuracies, errors, or omissions. Always review AI-generated content before relying on it.

For information about Anthropic’s data handling practices, please review Anthropic’s Privacy Policy at anthropic.com.

5. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

Service Providers

• Supabase, Inc. — database hosting, cloud storage (Supabase Storage), and authentication infrastructure
• Anthropic, PBC — AI processing via the Claude API (see Section 4)
• Stripe, Inc. — payment processing and subscription management
• Vercel, Inc. — hosting and content delivery

These providers process your data only as necessary to provide their services and are bound by their own privacy policies and data processing agreements.

Community Content

Notes you choose to upload to the NoteBloom community are visible to other users. You may opt to publish anonymously. You may request removal of your community content at any time.

Legal Requirements

We may disclose your information if required to do so by law or in response to a valid court order, subpoena, or governmental request, or to protect the rights, property, or safety of NoteBloom, our users, or the public.

Business Transfers

If NoteBloom is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.

6. Data Storage & Security

• Your data is stored on Supabase infrastructure, which encrypts data at rest and in transit
• Row Level Security (RLS) policies are enforced at the database level — you can only access your own data, even if someone obtains your user ID
• All connections to NoteBloom are encrypted via SSL/TLS
• API keys and server credentials are stored as environment variables and never exposed to client-side code
• File storage (PDFs, images) is restricted by access policies — files are accessible only to the account that uploaded them via time-limited signed URLs

No security system is impenetrable. In the event of a data breach that affects your rights or freedoms, we will notify you as required by applicable law.

7. Community Content

Notes you share with the NoteBloom community become visible to other registered users. You may choose to post anonymously. Community content may be publicly displayed including your institution and degree field unless you select the anonymous option. You may request removal of your community content by contacting us at privacy@notebloom.app. Removal may take up to 30 days and some cached copies may persist in backup systems for up to 90 days.

8. Your Rights

You have the following rights with respect to your personal data:

• Access: you may request a copy of the personal data we hold about you
• Correction: you may update inaccurate data through your account settings or by contacting us
• Deletion: you may permanently delete your account and all associated data at any time from Settings → Delete account. Deletion is immediate and cannot be undone.
• Export: you may request an export of your notes and study data
• Opt-out of communications: you may unsubscribe from non-transactional emails at any time

To exercise any of these rights, contact us at privacy@notebloom.app.

9. Data Retention

• Your data is retained for as long as your account is active
• Account deletion is immediate and permanent — your account and personal data are removed from our active database as soon as you confirm the deletion
• Backup copies, kept for disaster-recovery purposes, are rotated out on our infrastructure provider's standard backup schedule
• Anonymized, aggregated analytics data may be retained indefinitely
• Payment records may be retained as required by applicable financial and tax law

10. FERPA Notice

NoteBloom is a student-facing educational tool. If your institution has contracted with NoteBloom, the Family Educational Rights and Privacy Act (FERPA) may apply. NoteBloom acts as a “school official” with a legitimate educational interest to the extent permitted by applicable regulations. Students retain their rights under FERPA with respect to their own educational records. NoteBloom does not disclose student educational records to third parties except as described in this Policy or as required by law.

11. GDPR — European Users

If you are located in the European Union or European Economic Area, you have rights under the General Data Protection Regulation (GDPR) to the extent applicable, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / right to be forgotten (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object to processing (Article 21)

Our legal bases for processing include: performance of a contract (providing the Service), legitimate interests (service improvement, fraud prevention), and your consent (where we rely on consent, you may withdraw it at any time). For data transfer purposes, we rely on Standard Contractual Clauses or other applicable transfer mechanisms with our service providers. To exercise your GDPR rights, contact privacy@notebloom.app.

12. COPPA & Age Restrictions

NoteBloom is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. Users under 18 must have permission from a parent or legal guardian to use the Service. If you believe we have inadvertently collected information from a child under 13, please contact privacy@notebloom.app and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through the Service. Your continued use of the Service after any change constitutes acceptance of the updated Policy.

14. Contact

For privacy-related questions, data requests, or to report a concern:

Email: privacy@notebloom.app

NoteBloom operates from the State of Florida, United States.