Privacy policy

• We do not store your photos. A photo passes through our server’s memory, a few megabytes at a time, while it is copied from Google Photos into your Google Drive. It is never saved to a disk or to our database.
• We only see the photos you choose yourself in Google’s own photo picker. We cannot browse your library.
• We do not sell your data, show ads, use your data to train AI models, or do face recognition.
• You can disconnect an account, or delete everything, at any time in Settings.

• Your sign-in: your name, your email address, and the country your request comes from (to show rupees or dollars). We need these to run your account.
• Each Google account you connect: its email address, Google’s own id for it, how much storage it uses and has, when we last checked, and an encrypted access key (a “refresh token”). We need these to show your storage and to move photos without asking you to sign in every time.
• Your transfers: for each photo you move, its file name, type, size, the date it was taken, Google’s ids for the original and the copy, and the result (with the reason if it failed). Not the photo itself. We need these to check every copy, show progress, and make your delete checklist.
• Your plan and payments: your plan, its status and renewal date, the currency and amount, and the ids our payment provider gives us. We never see your card or bank details: they go straight to Razorpay (India) or Dodo Payments (elsewhere).
• Technical data: error reports (through Sentry) that describe what went wrong, without any photo content, and your network address, held briefly in memory only to slow down abuse. It is not saved.

When you sign in, we ask only for your name and email address. When you connect a storage account, Google’s screen asks for these permissions:

• Google Photos Picker (read only): to see only the photos you pick in Google’s picker.
• Google Drive, files created by this app: to save the copies in a “Spacebloom Transfers” folder in the Drive you chose, to check that each copy arrived complete, and to read how much storage the account uses and has. It lets us see only the files Spacebloom itself created, nothing else in your Drive.

Spacebloom’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In line with that policy, we use information from Google only to provide the features described here. We do not transfer it to others except to run the service, follow the law, or with your permission. We do not use it for ads, and nobody on our team reads it unless you ask us for help or the law or security requires it.

• Supabase: our database and sign-in.
• Vercel: hosting.
• Sentry: error reports.
• Razorpay (India) and Dodo Payments (elsewhere): payments.
• Google: the services you connect.

We do not share your data with anyone else, unless the law requires it. Our providers may process data in other countries; they are bound by their own privacy and security commitments.

We use only the cookies the app needs to work: one that keeps you signed in, one that remembers whether you chose rupees or dollars, and a short-lived one while you connect an account. There are no advertising or tracking cookies.

• We keep your data while your account exists.
• Disconnect an account (Accounts or Settings): we cancel our access at Google and delete the key and the transfer history of that account.
• Delete your account (Settings): we stop your paid plan at the payment provider, cancel our access at Google for every connected account, and erase your profile, connected accounts, plan and transfer history. We do this at once; the law gives us up to 60 days. Copies in our database provider’s backups are overwritten within 60 days.
• We keep a small record that the deletion happened (a random id and dates, no name or email), and the payment records that tax law requires (amounts, dates and provider ids). After deletion, nothing in them points to you.
• Photos you already copied stay in your own Google accounts. Deleting them there is your choice.
• You can also remove our access yourself at any time at myaccount.google.com/permissions.

• Everything travels over encrypted connections (HTTPS).
• Refresh tokens are encrypted (AES-256-GCM) and tied to your account. Your browser never receives them.
• Database rules make sure each person can only read their own rows.
• We never ask for your Google password: you sign in on Google’s own pages.

You can ask to see, correct or delete your data, and to withdraw your consent, at any time. Deleting is self-service in Settings; for anything else, write to us. If you think we handled your data wrongly, you can also complain to your local data protection authority (in India, the Data Protection Board).

Spacebloom is for people aged 18 or over. It is not meant for children.

If we change this page in a way that matters, we will say so in the app and update the date at the top.

Write to us at support@spacebloom.in, from the email address you sign in with.