Privacy
Last updated: 13 November 2026
UnderBloom is a free website for sending secret message cards. It was built to know as little about you as possible.
Who is responsible
UnderBloom is run by an independent developer based in Ukraine. For anything about your data, write to [email protected].
Your message is never uploaded
The card is created in your browser. Its text, picture and theme are packed into the part of the link after the # sign. Browsers never send that part to a server, so UnderBloom has no database of messages and cannot read, store or delete them.
Please note: the message inside the link is lightly scrambled, not strongly encrypted. Anyone who has the link can open the card. Treat the link like the card itself, and don't put passwords, card numbers or other sensitive data in it.
No accounts, no cookies, no ads
You don't sign up and we don't set cookies. The only thing kept in your browser is your language choice (in local storage), so the site opens in the right language next time.
Anonymous statistics
To understand whether the site is useful and what to improve, we count visits and a few actions — for example “a card was created”, “a card was scratched open”, the chosen theme or picture. We use two cookie-free tools:
- Cloudflare Web Analytics — page visits, country, device type.
- Umami Cloud (data stored in the EU) — the anonymous action counts above, kept for up to 6 months.
Neither tool receives the message text or the part of the link after #, neither uses cookies, and neither builds a profile of you. We only see totals.
Hosting and technical data
The site is delivered by Cloudflare. To show pages and protect the site from attacks, Cloudflare processes technical data such as your IP address and browser type, and may do so on servers outside your country, including in the USA. See Cloudflare's privacy policy.
Why we may do this
Hosting, security and anonymous statistics rely on our legitimate interest in running a working, safe website and improving it (Article 6(1)(f) GDPR). We don't sell data, show ads or make automated decisions about you.
Donations
If you choose to support us, the payment happens on Ko-fi and PayPal, under their own privacy policies. We only see what Ko-fi shows creators, such as the name and message you choose to leave.
Your rights
You can ask what data about you we hold, ask us to correct or delete it, or object to its use — write to [email protected]. Because we don't keep messages or identifying data, in most cases there will simply be nothing linked to you. If you're in the EU, you can also complain to your national data protection authority.
Changes
If this policy changes, the new version will appear on this page with a new date.