Privacy Policy
Last updated: July 2026
Table of Contents
1. Introduction
Welcome to Bloom, provided via FirstSay.app ("we," "our," or "us"). We are committed to protecting the privacy of you and your child. Bloom is an AI-powered learning assistant designed specifically to help parents and caregivers support children with neurodevelopmental conditions such as autism, ADHD, speech delays, and sensory processing disorders.
This Privacy Policy explains how we collect, use, and protect your information. Because we handle highly sensitive information, our default stance is maximizing your privacy through localized data architecture and robust encryption.
2. Information We Collect
Bloom uses secure password-based authentication with encrypted sessions. When you create an account, we collect and store the following information in our secure database:
- Account information: email address, display name, hashed password
- Child profile data: conditions, severity levels, communication styles, sensory preferences, learning milestones
- Behavioral and observation logs recorded within the app
- Progress tracking data across skill areas and milestones
- Speech session recordings analysis (not the audio itself)
- Toilet training event logs and schedules
- Social interaction logs and social stories
- Community posts and comments
- Subscription and payment status (payment details handled by PayPal)
3. How We Use Your Information
We use the collected information exclusively to:
- Personalize the AI-generated strategies, activities, and deep analyses specific to your child's multi-condition profile.
- Provide real-time behavioral guidance and determine effective therapy methodologies.
- Allow you to track your child's developmental progress over time.
- Translate content dynamically into your preferred language.
4. AI Camera & Video Data
Crucial Privacy Notice: We do NOT record, save, or store your camera feed or video streams on our servers.
When using the AI Camera Speech Coaching or observation features, the video stream is processed in real-time by Floot AI models to analyze engagement levels, emotional states, and communication attempts. Once the momentary analysis is complete and a recommendation is generated, the underlying video frames are immediately discarded. No visual recordings of your child are retained by FirstSay.app.
5. Data Storage & Security
We employ rigorous security measures to protect your data. All account data is stored in a secure PostgreSQL database hosted on Floot's infrastructure. We implement multiple layers of security:
- Server-side AES-256-GCM encryption for sensitive child data (names, medical notes)
- Passwords hashed with bcrypt
- JWT-based session authentication
- Database-backed rate limiting on all API endpoints
- HTTPS encryption for all data in transit
6. Children's Privacy
Bloom is designed to be used strictly by parents, guardians, caregivers, and professionals—not directly by children. We rely on the consenting adult to provide observation inputs. We comply fully with global children's privacy laws (such as COPPA and GDPR-K) by ensuring data collection is strictly limited to what is necessary for providing educational support, governed entirely by the adult user.
7. Third-Party Services
We use the following third-party services to provide our features:
- Floot AI (Claude by Anthropic): Used for AI-powered analysis, coaching recommendations, speech session analysis, diagnostic screening, and translation. Child profile context and behavioral data is sent to generate personalized insights. Data is processed per Anthropic's data handling policies and is not used to train AI models.
- PayPal: Used to process subscription payments. We share only the minimum information required for payment processing. We never store your full credit card or bank details. See PayPal's privacy policy.
- Azure Neural TTS (Microsoft): Used to generate text-to-speech audio for educational video narration. Only text content is sent; no personal or child data is transmitted.
- Google Fonts: Web fonts are self-hosted after deployment, so no data is sent to Google when you use the app.
8. Analytics & Usage Tracking
We collect anonymous usage analytics to improve the app experience, including: page views and navigation patterns, feature usage statistics, error reports for debugging. We do NOT use third-party advertising trackers. We do NOT share analytics data with advertisers. Analytics data is stored in our own database and is never sold.
9. Data Sharing
We do not sell your personal data. Your data is never sold to advertisers or third-party data brokers.
We only share data with:
- AI Service Providers: Necessary profile context is securely transmitted to Floot AI solely to generate the insights and educational recommendations you request.
- Legal Compliance: Only if strictly required by valid legal processes.
10. Your Rights
Depending on your jurisdiction, you have the right to access, rectify, download, or permanently delete the personal data we hold.
To delete your account and all associated data: 1) Log into your account, 2) Open the navigation menu, 3) Tap 'Delete Account', 4) Enter your password to confirm, 5) All your data including child profiles, progress logs, behavioral data, speech sessions, and community posts will be permanently and irreversibly deleted. Alternatively, you may request deletion by emailing privacy@firstsay.app.
12. Changes to Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of any significant changes by updating the "Last updated" date at the top of this page and surfacing a notice within the app.
13. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact our privacy team at:
privacy@firstsay.app