Privacy Policy

This policy explains what data is collected when you use this website and Blossom services, how it is used, and what rights you have. We use plain English and avoid legalese to make this policy as clear as possible.

Controller

Blossom Labs, reachable at hello@blossomos.org, is the controller responsible for personal data processing on this website and within Blossom services.

Website Hosting

This website is hosted on Hetzner infrastructure, with servers located in Germany and the European Union. When you access this site, technical connection data (IP address, browser type, requested pages, request timestamps) is processed by our server as a technical necessity to deliver the service.

This data is not stored beyond what is required to handle the individual request and is not used to identify or profile visitors.

Third-Party Services

We use a privacy-first analytics service called PostHog for internal analytics on this website. PostHog is hosted in the EU and does not share data with third parties. No personally identifiable information is collected, and no visitor profiles are built. Please refer to PostHog’s privacy policy for more details on how data is processed. At the time of the writing, their privacy policy also has a neat Summary.

Content Delivery Network

Static assets and downloadable files, including BlossomOS ISO images, are distributed via BunnyCDN. BunnyCDN operates servers across the EU and globally to reduce latency and improve download speeds.

When you download a file or load an asset delivered via BunnyCDN, your IP address and request metadata are processed by BunnyCDN as a technical necessity. Please refer to BunnyCDN’s privacy policy for further details.

Blossom Cloud

If you create a Blossom Cloud account, we store your email address and the files you upload. Files are stored on Cloudflare R2 infrastructure and encrypted with AES-256. All traffic between your device and our servers is secured with TLS.

We do not sell, share, or monetise your data in any way. You can request deletion of your account and all associated data at any time by contacting hello@blossomos.org.

Single Sign-On

Blossom services share a single sign-on system powered by authentik. When you create an account, your username and email address are stored in authentik and used to authenticate you across all Blossom services.

Authentication events such as sign-ins, sign-outs, and failed attempts are logged for security purposes. These logs are retained for a limited period and are not shared with third parties.

Analytics and Tracking

We do not use any analytics, tracking, or advertising tools on this website. No third-party tracking scripts are loaded. No visitor profiles are built. We have no insight into individual visitor behaviour beyond what server logs capture for operational purposes.

Newsletter

When you subscribe to the BlossomOS newsletter, we collect your email address. Subscription uses a confirmed double opt-in: after submitting your address you will receive a confirmation email and must click the link in it before you are added to the mailing list. This process documents your consent and satisfies Art. 6(1)(a) GDPR.

Your email address is transmitted to and stored by Resend, Inc. (USA), our email delivery provider, on the basis of the EU Standard Contractual Clauses. We do not share your address with any other third party.

We use your email address solely to send release announcements and project updates. You can unsubscribe at any time via the link in every newsletter email, at which point your address is removed from our mailing list. To request full erasure of your data, contact us at hello@blossomos.org.

Cookies

This website does not use cookies for advertising or tracking.

Aditionally a session cookie may be set if you sign in to Blossom Cloud or community features, solely to maintain your authenticated session. This cookie is strictly necessary for the service to function and is not shared with any third party. It is removed when you sign out.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Access: you can request a copy of the data we hold about you.
  • Rectification: you can ask us to correct inaccurate data.
  • Erasure: you can request deletion of your data where there is no legal basis to retain it.
  • Restriction: you can ask us to limit how we process your data.
  • Portability: you can receive your data in a machine-readable format.
  • Objection: you can object to processing based on our legitimate interests.

To exercise any of these rights, contact us at hello@blossomos.org. We will respond within 30 days. Contact and Complaints

For any privacy-related questions or to exercise your rights, contact us at hello@blossomos.org.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the supervisory authority in your country of residence. In Germany, the relevant authority is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD).

Changes to This Policy

We may update this policy from time to time as our services evolve or legal requirements change. The date at the top of this page shows when it was last revised.

For significant changes we will make a reasonable effort to notify users. Continued use of our services after a policy update constitutes acceptance of the revised policy.

Last updated: 2026-07-13