ReBloom Privacy Policy

Effective date: October 5, 2026

ReBloom is an independent Android companion app for xBloom Studio. It is not affiliated with or endorsed by xBloom. This policy explains what information ReBloom keeps on your device, when information is sent to optional services, and how you can control it.

Information stored on your device

• Brew history: Completed and stopped brews, data used for history and graphs, and the score, taste, and coffee you add to a brew are stored locally in a SQLite database.
• Recipes and settings: Recipes and app preferences are stored locally in Android SharedPreferences.
• Optional account credentials: If you connect the Visualizer service, its email address and password are kept in encrypted Android storage for Basic Authentication. If you sign in to xBloom, your member ID and session token are kept in encrypted Android storage; ReBloom does not save your xBloom password. If you connect BeanBox, its API key and address are kept in encrypted Android storage.
• Crash report and usage statistics choice: Your choice to share or not share crash reports and usage statistics is stored locally on your device.

ReBloom's Demo mode keeps its data in memory only; Demo data is not saved as local brew history.

Optional services and device features

You can use ReBloom without connecting optional accounts. When you choose to use the following features, the information needed for the request is sent to the relevant service or device:

• xBloom account: Signing in exchanges account information with xBloom and uses the resulting member ID and session token for authenticated requests. If you opt in to syncing or publishing your own recipes, those recipes are sent to xBloom; published recipes may be visible to others according to xBloom's service. Importing a public share link sends a request for that shared recipe. Product-code NFC lookup sends the product code for a lookup, not the card's UID or raw card data.
• Visualizer: If you connect Visualizer and choose to upload completed brews, ReBloom sends the relevant brew data, including TDS or extraction-yield (EY) values when available, your score for the brew, the coffee's details (such as roaster, name, roast date, country, process, and variety), and links to the coffee and the brew in BeanBox if you use it, using your Visualizer credentials. If you turn on automatic re-upload, a brew you edit is uploaded again.
• BeanBox: BeanBox is a coffee-shelf service you run or use with your own account. If you connect it with your BeanBox API key, ReBloom reads your coffee bags and, when you ask, suggested recipes, and loads coffee photos from the addresses BeanBox gives. When you send a brew (or, if you turn it on, automatically), ReBloom sends to your BeanBox address the brew with its chosen coffee: recipe name and steps, dose, cup weight, water, grind, duration, brew time, TDS, your score and taste, and the water, cup weight, and flow curves. Changing a brew's coffee, score, or measurements in History updates it in BeanBox; choosing no coffee or unlinking removes it there or stops the link. BeanBox's handling of this information is governed by that service.
• Camera: ReBloom asks for camera access only when you tap Scan QR code to connect BeanBox. The QR code is read on your device with Google ML Kit; ReBloom does not store or upload camera images. Google ML Kit may send anonymous usage and performance metrics to Google.
• DiFluid R2: If you use this optional accessory, ReBloom communicates with it over Bluetooth to read measurements. On Android 11 and earlier, Android may require location permission to scan for Bluetooth devices; ReBloom uses that permission for Bluetooth scanning, not to collect your location.
• Backup and restore: In Settings → Backup and restore, you can export the parts you choose (recipes with their sources and card matches, favorites, brew history including measurement samples, and xBloom sync exclusions) to a JSON file at a location you pick with Android's file picker, such as phone storage or Google Drive, and restore chosen parts from such a file. ReBloom does not upload backups anywhere itself; the file is stored wherever you save it and is governed by that storage provider. Backups never contain account credentials, session tokens, or your crash report and usage statistics choice. Restoring a backup never contacts the machine.
• Diagnostics: Diagnostic information is shared only when you explicitly choose to share it. Review what you are sharing, as diagnostics may include app or device details relevant to troubleshooting.

Requests to xBloom, Visualizer, BeanBox, and the addresses of coffee photos may also expose ordinary connection metadata, such as your IP address and request time, to those services. Their handling of information you send is governed by their own privacy policies. ReBloom does not control their storage, visibility, or deletion practices.

Crash reports and usage statistics (optional)

ReBloom can send crash reports and usage statistics to help improve the app. Both are off by default. ReBloom asks once on the Home screen (Not now, Choose, or Share), and you can turn each one on or off separately at any time in Settings → Crash reports and usage.

If you turn them on, this information is sent to Google Firebase (Firebase Crashlytics and Google Analytics for Firebase), which is operated by Google. See Google's Privacy Policy and Firebase privacy information.

• Crash reports: the type of error; the location in the app's code where it happened (stack trace); the first line of the error message, after ReBloom removes on the device any quoted text (such as recipe and account names), email addresses, links, IDs and serial numbers, and long numbers; the app version; and the xBloom Studio firmware version.
• Usage statistics: which screens are opened and counts of feature use, such as connecting a machine, loading a recipe and where it came from (for example starter, own, shared, or NFC), brewing, manual grind, pour, and scale use, NFC card reads, recipe imports, backup export and restore, Visualizer and BeanBox uploads, choosing a coffee, rating a brew (the score and sour, balanced, or bitter), stopped brews, DiFluid R2 measurements, and entering Demo mode. These events contain only fixed category values or numbers.
• Collected by Firebase: Firebase also records the Android version, device model, approximate country (derived from your IP address; Google Analytics does not store IP addresses), and a random app-installation identifier.

ReBloom never sends recipe names or contents, notes, brew data, account details or credentials, machine serial numbers, raw Bluetooth data, a user ID, or the advertising ID (ReBloom removes the advertising-ID permission). This information is not used for advertising; Google signals and ad personalization are turned off. Nothing is sent in Demo mode or in development builds.

ReBloom does not include advertising. It does not sell your personal information.

Retention and your choices

Local brew history, recipes, and settings remain on your device until you uninstall ReBloom or clear its app data. Disconnecting an account clears its locally stored credentials or session information. You can decline optional account connections, recipe sync and publication, brew uploads, Bluetooth access, camera access, and diagnostic sharing. Uninstalling the app clears its local brew history, but does not remove information already sent to xBloom, Visualizer, BeanBox, or another recipient; contact the relevant service about information it retains. Published recipes may remain available under that service's rules. Backup files you export are not removed by uninstalling ReBloom; delete them from the location where you saved them.

Crash reports and usage statistics are optional and off unless you turn them on. Google Analytics event data is retained for 2 months, and Firebase Crashlytics crash data is retained for 90 days. Turning crash reports off deletes reports that have not yet been sent. Turning usage statistics off stops collection and resets the analytics data and identifier on your device. Data already sent cannot be deleted from within the app; to make a request about it, contact us using the address below.

Legal basis and your rights

Data controller: The data controller is the ReBloom developer, who can be contacted at reblooomapp@gmail.com.

Legal basis: Crash reports and usage statistics are processed on the basis of your consent. You can withdraw consent at any time in Settings → Crash reports and usage; withdrawal does not affect processing that took place before. Optional account features (xBloom sign-in, recipe sync and publication, Visualizer uploads, BeanBox connection and brew sending, share-link imports, and NFC catalogue lookup) are processed to perform the request you make. Data kept only on your device is not sent to the developer.

Your rights: If you are in the EU, EEA, or UK, you have the right to access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent, and the right to lodge a complaint with a data protection supervisory authority, for example in your country of residence. The developer does not receive your recipes, brew history, or account data. Crash reports and usage statistics are pseudonymous and contain no user ID, so the developer may be unable to identify a specific person's data; turning the switches off and the retention periods above are the main controls. You can send requests to the contact address above.

International transfers: Google Firebase may process data outside the EEA under Google's safeguards, such as Standard Contractual Clauses.

Children's privacy

ReBloom is not directed to children. If you believe a child has shared personal information through ReBloom, contact us using the address below.

Changes and contact

We may update this policy as ReBloom changes. Updates will be posted on this page with a revised effective date. For privacy questions or requests concerning ReBloom, email reblooomapp@gmail.com. For information held by an optional third-party service, contact that service directly.