Privacy Policy

Effective date: October 6, 2026.

This Privacy Policy explains how Make Up Bloom handles information, based on how the site is actually set up on the date above. We have tried to keep it plain and accurate, and to say so where something is unknown. It should be read together with the Terms of Use and the Disclosure page.

Who this policy covers and its scope

This policy applies to the website at makeupbloom.com, referred to as the site, to the contact form on the Contact page and to email sent to hello@makeupbloom.com. The site is operated by its owners and operators. The site does not currently publish a legal entity name, postal address or jurisdiction for the operator, and we will update this page if that changes. The site is a static website for adult readers in the United States who want practical beauty information. It has no user accounts, no comments, no newsletter and no social media accounts. It runs no analytics or tracking scripts and shows no advertising. The site depends on outside providers, mainly Cloudflare for hosting, DNS, Turnstile spam protection and email delivery for the contact inbox, plus a private mailbox provider that receives contact messages. Those providers handle information under their own terms and privacy policies, which we do not control and which this policy does not replace. This policy does not cover other websites that the site links to.

Information we handle and how

The site handles very little information. There are four categories.

Information you provide to us. The only information you provide directly is what you submit through the contact form or email to hello@makeupbloom.com. The form fields include your name, your email address and your message, and an email can include anything you write or attach. Form submissions are processed by the site’s hosting Worker on Cloudflare and delivered by email to the contact inbox through Cloudflare email services. We also see the date and time of a message and the content of any reply. Please do not send sensitive medical, financial or other personal details.

Information processed automatically. When you load a page, hosting infrastructure may process technical information about the request, such as your IP address, the page requested, the date and time, the type of browser or device and other request metadata. This happens so pages can be delivered, the service can be kept running and abuse can be blocked. When you use the contact page, Cloudflare Turnstile runs a check that the submission comes from a person and may process technical and browser signals under Cloudflare’s own terms and privacy policy. The exact data Turnstile uses is controlled by Cloudflare, and we cannot describe it in more detail. We have not installed analytics or tracking tools on the site, and we have not set up any tool to use this information to build visitor profiles or for advertising. How long hosting infrastructure keeps this information is not known to us, as explained under retention below.

Information received from others. We do not intentionally collect information about you from data brokers, social networks or other sources. If a person writes to us about someone else, or forwards a message that includes another person’s details, we will receive that information too. Our email providers also process message data as part of delivering and storing email.

Cookies and local storage. The site does not set cookies of its own. The site stores one small item, named theme, in your browser’s localStorage so it can remember whether you chose a light or dark display. This item stays on your own device, is not sent to the site’s servers and is not used to identify or track you. You can clear it at any time through your browser’s site data settings, and the site will then use its default display. Cloudflare Turnstile and hosting providers may use technical mechanisms needed for spam protection or abuse prevention, and we do not control their details.

Legal and operational bases for handling information

The site is directed to readers in the United States, and we do not claim that any specific privacy statute, such as the European Union’s General Data Protection Regulation, applies to the site. We have not set up any consent banner because the site has no optional tracking, advertising or analytics for which consent would be requested. If you send us a message, we handle it because you chose to send it and so that we can read, answer or consider it. The hosting and spam-protection providers handle technical request data because it is needed to deliver the site, keep it secure and tell people from automated submissions. We do not claim a contract with you for these purposes, and we do not rely on any consent that you have not actually given. If we later add features that require consent or a different basis, we will update this policy and, where required, ask for consent before the feature is used.

How we use information

We use the limited information we receive for the following purposes:

To read, answer and keep track of messages sent through the contact form or to hello@makeupbloom.com, if we choose to respond.
To correct errors, update pages and consider topic or product suggestions that readers send.
To keep the site and the contact form available, secure and free from abuse, through our providers’ protections.
To investigate and handle technical problems, abuse, misuse or violations of the terms.
To comply with law, respond to lawful requests and protect our rights, the rights of others and the safety of visitors.

We do not use your information to send marketing email, to add you to a mailing list, to build advertising profiles, to make automated decisions about you or to sell it. If we want to use information for a materially different purpose, we will update this policy first and, where the law requires, ask for your permission.

Advertising and tracking

The site does not use advertising. No ad network is configured, and no advertising cookies, pixels, fingerprinting or cross-site tracking tools are installed by us. Because nothing is installed for this, the site does not track you across other websites or apps for advertising, and there is no advertising tracking for you to opt out of. Cloudflare Turnstile is used only to check that contact submissions come from people, and we do not use it for advertising. The site has no confirmed affiliate programs, so it also has no affiliate tracking links or cookies. If any of these are added, we will update this policy, the Disclosure page and, where relevant, the site’s cookie and storage description before or when the change takes effect.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is no intention or configuration for either. We may share or disclose information in these limited ways:

With service providers that help us run the site, the contact form or email, such as Cloudflare and the mailbox provider, which process information for us and under their own terms.
When the law requires or permits it, for example in response to a valid subpoena, court order or other lawful request.
To protect the rights, property, safety or security of the site, our visitors or others, or to investigate fraud, abuse or violations of the terms.
In connection with a sale, transfer or reorganization of the site, in which case information we hold, such as messages, may be passed to the new owner, who would be expected to handle it in a manner consistent with this policy.
With your direction or consent, for example if you ask us to forward something.

We do not publish messages you send us, and we do not intend to publish your name or message without your permission, except where the law requires it. In this policy, to share does not mean to sell, and we use these words with their ordinary meaning unless a specific law defines them.

Third-party services and their roles

The following providers are connected to the site.

Cloudflare provides hosting, DNS, Turnstile spam protection and email delivery for the contact inbox. The site is a static site served through a Cloudflare Worker with static assets, over HTTPS. The Worker processes contact form fields and hands them to Cloudflare email services for delivery to the contact inbox. Cloudflare may process request data such as IP addresses to deliver pages and protect against abuse, under its own policies.
GitHub hosts the site’s source code in a private repository. It is not visitor-facing, and we do not use it to collect information about visitors.
A private mailbox provider receives the messages sent to the contact inbox. We have not recorded which provider that is, so we cannot name it here, and the destination address is private and is not published. Messages you send are also handled by your own email provider and any services in between.

No analytics service, advertising network, social media platform, comment system, newsletter service, payment processor or customer relationship management tool is connected to the site. If we add any provider that receives visitor information, we will update this section.

Your choices and rights

Because the site collects so little, most choices are about what you decide to send us and how you use your own browser.

You may choose not to use the contact form or email us, and the site can be read without giving us any information.
You can delete the theme item from your browser’s localStorage at any time through your browser’s site data controls.
You can use your browser’s privacy settings, private browsing mode or a network privacy tool to limit what your browser sends, although hosting infrastructure still needs your IP address to deliver pages and Turnstile may not work if signals are blocked.
You can ask us to tell you what information from your messages we hold, to correct it, or to delete it.

To make a request, use the contact form or email hello@makeupbloom.com with enough detail for us to find your message. We have not defined a formal identity-verification process. We may ask for reasonable information to confirm that the request comes from the person it concerns, and we may decline to release or change information if we cannot reasonably confirm that. Because a reply goes to the address you wrote from, we may use that address to reply. We will consider each request in good faith and respond as the law requires where it applies, though we cannot promise a particular timeline for requests where no law sets one. We can act only on information we hold, and we cannot control copies kept by Cloudflare, mailbox providers or hosting logs, which are governed by those providers. We may keep information we need for legal, security or record-keeping reasons, and we may decline requests that are unreasonable, repetitive or not permitted by law. You will not be penalized for making a request. If you want to complain about how we handled a request, please see the contact section below. You may also have the right to contact a government regulator where you live.

Security

The site is static and is served over HTTPS, which encrypts traffic between your browser and the site while it is in transit. The site has no accounts or login systems that could expose visitor credentials. The contact form is protected by Cloudflare Turnstile spam checks, and the source repository is private. We rely on our providers’ security measures, and we do not control them. The site has not undergone any security audit, penetration test or certification, and we do not claim any. Email is not necessarily encrypted from end to end, so a message you send could be read by others while it moves between providers or while it is stored. No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you use the site and send information to us at your own risk, to the extent permitted by law. If you think you have found a security problem, please let us know through the contact form or at the email address below.

Retention

We have not set a fixed retention period for contact messages or related records, and we do not claim one. If you write to us, we may keep the message and our reply for as long as we reasonably need them to answer you, to consider and make corrections, to keep a record of the matter, to handle disputes or abuse, or to meet legal obligations. We may delete messages sooner, for example when we have no further use for them, and we may keep some for longer, for example where law requires or a dispute is pending. How long our mailbox provider keeps mailbox contents, including deleted items and backups, is unknown to us. How long Cloudflare and our hosting infrastructure keep request, form-processing, email-delivery and security logs is also unknown to us. The theme item stays on your device until you delete it or clear your browser data. If we set specific retention periods later, we will update this section.

Children

The site is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. The site has no accounts or features that ask for age, although the contact form asks for a name and email address. If you are a parent or guardian and believe a child has sent us personal information, please contact us at the address below. We will review the request and will take reasonable steps to delete the information where appropriate. Our content is written for adults, and some of the topics, such as cosmetic procedures, are not appropriate for minors.

Provider locations and international processing

The operator’s location is not stated, and we do not know all of the locations in which our providers process information. Cloudflare operates a global network, so request data, form data and email may be processed in several countries, including countries other than the one in which you live. GitHub and the mailbox provider may also process information in various locations. We have not entered into any special international transfer arrangement, and we do not claim that any particular safeguard applies to such transfers. The site is aimed at readers in the United States, and by using it or contacting us you understand that your information can be processed in the United States and elsewhere under the laws and practices of those places, which may differ from the laws where you live. If we learn more about provider locations, we will update this section.

External websites

The site may link to external sites, such as manufacturer pages, retailer pages, professional organizations and published research. Those sites are operated by others and have their own privacy practices, cookies, trackers and terms. This policy does not apply to them, and we do not control or review their data practices. Clicking a link takes you to that site, which may collect information such as your IP address and the page that referred you. Please read the privacy policy of any site you visit.

California residents

California law gives some California residents rights about their personal information, including rights to know, to delete, to correct, and to limit certain uses, and a right not to be discriminated against for using those rights. These laws apply only to businesses that meet certain legal thresholds, and we have not determined whether any of them applies to the site. We do not make a blanket statement that the site is covered, or that it is not covered. In practice, the site does not sell personal information and does not share it for cross-context behavioral advertising, as those terms are used in California law. We have not offered any financial incentive for personal information. If you are a California resident, you may use the contact form or email hello@makeupbloom.com to ask about the information we hold from your messages, or to ask us to correct or delete it, and we will treat the request as described under your choices and rights above. An authorized agent may make a request for you, and we may ask for reasonable proof of the authorization. California’s Shine the Light law, to the extent it applies, allows requests about disclosure of personal information to third parties for their direct marketing, and we do not make such disclosures. Because we have installed no advertising tracking, the site does not respond differently to browser Do Not Track or similar signals, since there is nothing of ours to turn off.

Other U.S. states and other jurisdictions

Some other U.S. states have privacy laws that give residents rights such as access, correction, deletion and opting out of sale, targeted advertising or profiling. Those laws generally apply only to organizations that meet particular thresholds, and we have not determined whether any of them applies to the site. We do not engage in sale, targeted advertising or profiling, so there is nothing to opt out of. Residents of Nevada may ask us to not sell certain covered information. We do not sell covered information as Nevada law defines it, and we do not intend to, and a request can be sent through the contact form or to hello@makeupbloom.com. If you live in another state or country with laws that give you rights over your personal information, you may contact us to make a request, and we will consider it in good faith under the law that applies to us. The site is directed to readers in the United States, and we do not claim to offer rights or protections that apply only in other jurisdictions. Nothing in this policy limits a right that applicable law gives you and that cannot be waived.

Changes to this policy

We may update this policy when the site, our providers or the law change. The effective date at the top will show the latest revision. If we add analytics, advertising, affiliate tracking, accounts, a newsletter or anything else that changes how information is handled, we intend to update this page before or when the change takes effect. Because the site has no accounts or mailing list, we do not send individual notices, and posting the updated policy here is how we notify you. If the law requires a different kind of notice or consent for a change, we will follow that requirement. An updated policy applies to information handled from its effective date forward, unless the law requires otherwise.

Contact and complaints

If you have a question about this policy, a rights request or a privacy complaint, use the contact form on the Contact page or email hello@makeupbloom.com. The contact form is enabled and is protected by Cloudflare Turnstile. Cloudflare reports that the receiving inbox is verified, mail routing is enabled and forwarding is ready, but the owners have not performed an end-to-end delivery test of the form. We therefore cannot promise that a message is delivered or received, and no response time is promised. If you do not receive a reply, you are welcome to try again. Please do not include sensitive medical or personal details in your message. The site does not currently publish a legal entity name or postal address for its operator. If you are not satisfied with how we have handled your concern, you may have the right to contact a consumer protection or privacy authority where you live.