Privacy Policy

• ReVloom — an iOS app for businesses. It helps business owners and their authorized staff draft replies to customer reviews, with AI assistance. It has accounts, runs on servers we operate, and connects to services described below.
• Squintly — an Android app for individuals. It analyzes facial movement on your device to help you notice sustained facial tension. It has no account and sends nothing to us.
• revloomapp.com — this website, including the pages that publish these documents and the newsletter signup.

Contact: for ReVloom and this website, hello@revloomapp.com. For Squintly, hello.revloom@gmail.com. Either address reaches us.

• To ReVloom, you provide your email address, basic account and business profile information, any review screenshots you choose to import, and anything you write to support.
• To Squintly, you provide nothing. The app has no account and no sign-in. The only way you send us information from Squintly is by choosing to email us (section 8).
• To this website, you provide your email address if you subscribe to the newsletter, and anything you write to support.

Account information. When you create an account we collect your email address and the basic account and business profile information you provide. Depending on how you sign in, we use a one-time email code (OTP) and/or a password. Authentication is handled by Supabase; passwords are stored only in hashed form — Revloom does not receive or store your plaintext password. You can optionally enable two-factor authentication using an authenticator app, in which case we store the factor enrollment, not your codes.

Business profile data. If you connect a Google Business Profile account, ReVloom requests the business.manage authorization and accesses the business and location information, customer reviews, and reply data needed for the connected features. When you search for your business during setup, the search query is sent to Google’s Places API to find it. Your Google refresh token is stored encrypted on our servers, and is revoked when you disconnect or delete your account.

Review screenshots. If you use the screenshot import feature, you intentionally submit an image of review content. The image is transmitted to our AI provider to extract the review text. See “Retention and deletion” (section 9) for what happens to it afterwards.

AI processing. Reply drafting, reply transformation, and screenshot text extraction are performed by OpenAI’s API on our instruction. What we send is the review content and the context needed to draft a reply — for example the review text, rating, reviewer name as it appears publicly, your business context, and your tone, language and custom-instruction settings. We do not use your customer review content to train models of our own, and we operate no model training of any kind. Our AI provider states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in. We do not control, and make no promises about, how long that provider retains data submitted to it for processing; that is governed by its own policies.

Usage and quota data. We record which features you use and reply, transformation and import counts per billing period, to operate the service, enforce plan limits, and prevent abuse. We also keep technical records of each generation — the model used, a prompt fingerprint, token counts, language, tone and an opaque reference to the review — for reliability and quality work. These records do not contain your review text or reply text.

Notifications and email. If you enable notifications, we store the push token issued by your device so we can send you alerts; delivery is performed by Expo’s push service. We may send you an alert when a one-star review arrives and a weekly performance digest, delivered by Resend. These emails contain your business name and aggregate figures such as review counts and average ratings — they do not contain review text.

Diagnostics. ReVloom uses Sentry for crash and error diagnostics. This processes limited technical information when a crash or error occurs — such as device type, operating system, app version, and technical error context. Before an event is sent, we delete the email address and username from it, remove the IP address, truncate long free-text error messages, and redact a defined set of sensitive fields including names, reviewer names, review text, reply text, tokens, passwords, one-time codes, phone numbers and addresses. It is used for stability and debugging only; it is not advertising or behavioral analytics.

Product analytics. ReVloom contains an integration for PostHog product analytics, but it is not enabled in the released app: no analytics key is configured for the production build, so the current release transmits no product-analytics events. If we enable it, we will update this policy before doing so, and it would be limited to explicitly defined product events — the integration is built without autocapture, session replay, or screen recording.

Security records. We keep security and abuse-prevention records associated with your account — for example quota, authentication, integration and payment event types, severity, and the action taken — so we can rate-limit, investigate, and protect accounts.

Device and diagnostic data. We and our infrastructure providers collect standard technical information — such as device type, operating system, app version, IP address, and server request metadata — to operate the service, secure it, and diagnose errors.

Subscriptions. See section 7.

ReVloom is designed for business use — our users are businesses, business owners, and their authorized staff, including restaurants and other small and medium-sized businesses, not consumers.

Everything in this section is about the Squintly app. It is not a statement about ReVloom or about this website, both of which use servers, analytics and network services as described in sections 3 and 5.

Squintly analyzes facial movement on your device. It does not require an account, and Revloom operates no server that receives your Squintly information. Squintly does not request Android’s internet permission: camera images and the facial landmarks derived from them are processed on your device and are not transmitted to Revloom.

Camera. When you use calibration, Face Check, or monitoring, Squintly uses your device’s front camera. Each frame is analyzed in the moment, on your device, to estimate the position of facial features.

• Squintly does not record video.
• Squintly does not save photographs of you.
• Camera frames are held in memory only for the moment they are analyzed, and are not written to storage.
• Neither camera images nor the facial landmarks derived from them are uploaded to Revloom or transmitted off your device by the app.
• Raw facial landmarks are not kept; only the derived measurements described below are stored.

The camera is used only while a feature that needs it is active. While monitoring runs, Squintly runs a camera foreground service and shows a persistent notification for as long as it is active. You can stop monitoring at any time from the app, from that notification, from the home-screen widget, or from the Quick Settings tile.

Information stored on your device. So that Squintly can show your calibration, statistics and progress, it stores locally: calibration values (numeric statistics describing your relaxed and expressive face); monitoring history (session times and durations, and per-event timestamps, categories and intensity measurements); progress and achievements; settings such as sensitivity, nudge delay, haptics and language; and whether a Squintly Pro subscription is currently active. This information stays on your device. Revloom does not receive it.

Backups. Squintly disables Android’s cloud backup and device-transfer backup for its own private app data, so the information above is not copied to your Google account and is not carried to a new device by Android’s backup system.

Deleting it. “Reset all local data” in Settings deletes the locally stored Squintly information. Uninstalling the app also removes it.

Notifications. Squintly’s notifications — the monitoring notification and the gentle nudges — are created on your device from information already on it. Their content is not sent anywhere.

Payments. See section 7.

No advertising, no analytics in this app. The Squintly app contains no third-party advertising SDK and no analytics or crash-reporting SDK. It does not use an advertising identifier and does not build a profile of you.

Permissions. Camera — required for facial analysis, used only while calibration, Face Check or monitoring is active. Notifications — used for the monitoring notification and the gentle nudges; if you decline, monitoring still works and Android simply does not display the notification. Squintly does not request microphone, location, contacts, photo and media, or storage permissions.

Hosting and server logs. This website is hosted by Vercel. As with any website, our hosting provider processes standard server request information — including IP address, the request made, and technical metadata — to deliver pages, keep the site available, and protect it from abuse. This is separate from the analytics described next.

Web analytics. This website uses Vercel Web Analytics to understand how the site is used. It applies to every page on the site, including this one. It processes aggregated and anonymized information about a visit, which may include the page or route viewed, the referring source, coarse geographic information such as country, browser, operating system, and device type. It is measurement, not advertising: it is not used to serve or target ads, it does not follow you to other websites, and it does not build an advertising profile of you. Vercel Web Analytics does not use cookies, and we set no cookies of our own on this website. The fonts used here are served from our own site rather than fetched from a third party when you visit.

Newsletter. If you subscribe, we store your email address, the signup source, the version of the consent wording you agreed to and when you agreed to it, your language, the status of your subscription, timestamps, and a hashed form of the confirmation link token. We never store the raw token. Revloom stores newsletter subscription records in hosted database infrastructure used to operate revloomapp.com. Newsletter email is delivered by Resend, which holds your address as a contact so that unsubscribes stay in sync. To limit abuse of the signup form we keep short-lived counters keyed by a one-way HMAC of a hashed IP address or email address — raw IP addresses and raw email addresses are never stored for this purpose. You can unsubscribe at any time from the link in any newsletter email, or by writing to hello@revloomapp.com.

The providers below process information under their own terms and privacy practices and, where applicable, under agreements with or instructions from Revloom. Each maintains its own privacy policy, and we encourage you to review them.

• SupabaseAuthentication, database, backend functionsUsed by: ReVloom
• OpenAIAI reply generation and transformation; vision extraction of review text from screenshotsUsed by: ReVloom
• Google (Business Profile API, Places API)Reading authorized business reviews, submitting replies at your direction, finding your business during setupUsed by: ReVloom, when you connect it
• SentryCrash and error diagnosticsUsed by: ReVloom
• PostHogProduct analytics — integration present, not enabled in the released appUsed by: ReVloom (inactive)
• ExpoPush notification deliveryUsed by: ReVloom
• ResendTransactional and newsletter email deliveryUsed by: ReVloom, this website
• Apple App Store, RevenueCatPurchase processing and subscription entitlementsUsed by: ReVloom, if and when in-app purchases are offered (see section 7)
• Google PlayPurchase processing and subscription entitlementsUsed by: Squintly
• VercelWebsite hosting and website analyticsUsed by: revloomapp.com
• Hosted database infrastructureNewsletter subscription recordsUsed by: revloomapp.com

Except for Google Play for subscription billing as described in section 7, the Squintly app does not use the other third-party providers listed above. Squintly does not send your facial analysis, camera information, or monitoring history to Google Play, to Revloom, or to anyone else — what it exchanges with Google Play is limited to the subscription entitlement information described in section 7.

ReVloom. The released version of ReVloom does not currently offer in-app purchases, and no purchase can be made through it today. If we offer paid ReVloom subscriptions, purchases will be processed by the applicable app store (Apple’s App Store), with entitlements managed through RevenueCat, and we will receive confirmation of your subscription status and plan tier. We do not, and will not, receive or store your full payment-card details.

Squintly. Squintly Pro subscriptions are sold and processed by Google Play, not by Revloom. The transaction is handled by Google under Google’s own terms and privacy policy. Squintly receives from the Google Play app on your device only the entitlement information it needs to unlock Squintly Pro — in practice, whether a subscription is currently active and which plan it is. Revloom does not receive your payment card or other payment credentials through Squintly, and the app does not send purchase information to any Revloom server.

Writing to us is optional. If you do email us — hello@revloomapp.com for ReVloom or this website, hello.revloom@gmail.com for Squintly — we receive what you choose to send: your email address, whatever name your mail account shows, and the content of your message, including any attachments.

For Squintly this is separate from the on-device information described in section 4: emailing support does not send us your camera data, your calibration values, or your monitoring history.

Please do not include information you do not want us to have — we do not need photographs of you, health details, or payment details to help you. We keep support messages for as long as reasonably necessary to answer you, keep ordinary business records, prevent abuse, and meet legal obligations. Where the law where you live gives you the right to ask us to delete a support conversation, write to the same address and we will honour it as that law requires.

ReVloom. We retain your account data, review information, and reply history for as long as your account is active. You can delete your account in the app at Profile → Account → Delete Account. Deleting your account revokes our access to your Google Business Profile connection, severs the pseudonymous references in our operational and quality records, and deletes your account together with its associated application data — profile, preferences, locations, reviews, replies, stored Google credentials, usage counters, security records and subscription records. Limited information may be retained where required for legal, security, fraud-prevention, accounting, or transaction-record purposes. Deleting your ReVloom account does not by itself cancel a subscription managed by an app store; see section 7 and our Terms of Service.

For screenshot import, ReVloom does not intentionally retain the raw screenshot image after the review text has been extracted. We do keep a short-lived extraction record: a non-reversible hash of the image together with the text extracted from it, used to avoid re-processing duplicate images, to keep imports reliable, and to help prevent abuse. These records are not tied to a user account, so they are not removed by deleting your account. The implementation marks them with a 30-day expiry: expired records are never used, and they are purged as new imports are processed. Because that purge is not run on a fixed schedule, we do not promise deletion within an exact window. The review text extracted from a screenshot, and the replies you generate, are also stored as part of your own review and reply history, which is deleted with your account.

Squintly. There is nothing for us to delete: the information in section 4 stays on your device. “Reset all local data” in Settings deletes it, and uninstalling the app removes it.

Newsletter. Unsubscribing stops the emails and marks your record unsubscribed; write to hello@revloomapp.com if you want the record erased entirely.

Depending on where you live, applicable law may give you rights over personal information we hold about you — including access, correction, deletion, portability, restriction of processing, and objection to certain uses. You may exercise them by contacting hello@revloomapp.com (ReVloom, website) or hello.revloom@gmail.com (Squintly). We respond to verifiable requests as required by applicable law. If you are in the European Economic Area, the United Kingdom, or California, additional rights may apply under the GDPR, UK GDPR, or CCPA, and you may have the right to complain to your local supervisory or regulatory authority.

For Squintly, the practical answer is narrower: the only personal information Revloom actually holds about a Squintly user is a support conversation, if you have started one. The on-device information in section 4 is not something we can hand over or delete, because we do not have it — you control it directly.

What we do not do, across ReVloom, Squintly and this website:

• We do not sell your personal information.
• We do not use your data to build advertising profiles or serve targeted ads.
• We do not track your precise location; neither app requests location permission.
• We do not store your payment-card details — billing is handled by the app stores.
• We do not use customer review content to train our own AI models, and we run no model training.

ReVloom is a business service. You must be at least 18 years old to use it, and authorized to manage reviews for the businesses you connect. It is not directed to children, and we do not knowingly collect personal data from children through it.

Squintly is not intended for children under 13, and it is not a children’s app. To use it you must be at least 13, or older if the law where you live sets a higher minimum age; if you are under the age of legal majority where you live, you may use Squintly only with a parent or guardian’s permission where the law requires it. Revloom does not knowingly receive personal information from a child through the app.

These are two different rules for two different products. The ReVloom minimum does not apply to Squintly, and the Squintly minimum does not apply to ReVloom.

The newsletter on this website is intended for a business audience and is not directed to children.

Revloom LLC is based in Oregon, in the United States. If you use ReVloom or this website, the information described in sections 3 and 5 is processed on infrastructure operated by us and by the providers in section 6, which may be located in the United States and in other countries. Where the law that applies to you requires a legal basis or particular safeguards for such processing or transfer, we rely on the mechanisms that law permits. Squintly processes your facial analysis on your own device, wherever you are, and does not transfer it anywhere.

Nothing in this policy reduces a right you have under the law that applies where you live.

We may update this policy as our practices or applicable law change. If a change is material, we will provide notice where appropriate, and this page will always show the current effective date. Where applicable law requires your consent to a new use of personal information, we will request that consent.

Revloom LLC

ReVloom and this website: hello@revloomapp.com

Squintly: hello.revloom@gmail.com

Web: https://revloomapp.com