Privacy Policy

Effective: 2026-06-21Last updated: 2026-06-21

BLUUPILL Inc. (the “Company”) complies with applicable laws, including Korea’s Personal Information Protection Act (PIPA), and uses this policy to transparently explain how it collects, uses, stores, and destroys personal data in operating Buildersgate (the web service and the bggg CLI, the “Service”). The Service is designed to handle the minimum of identifying information and never collects source code, raw prompts, or the real names of your projects. The Korean version of this policy prevails in case of any conflict.

1. Overview

This policy sets out the categories of personal data the Company processes, the purposes of collection and use, retention periods, and the rights of data subjects. The Company processes personal data lawfully and appropriately to protect the freedoms and rights of data subjects.

2. Information We Collect

a. Account information (at sign-up)

Email address
When using social login (GitHub, Google): the account identifier, email, profile name, and profile image (if provided) received from that provider

b. Profile information (optional, entered by the user)

Handle (username), display name, bio, external links, profile image, accent color
Display settings such as visibility

c. CLI usage statistics (collected with consent)

Category	Items
Device	A locally generated random UUID (machine_id, not a hardware identifier); optional device label
Client	CLI version, operating system (darwin/linux/windows), CPU architecture
Activity metrics	Per day/IDE/model: session count, message count, token counts, tool-call counts, estimated active time, hourly distribution
Tool inventory	Names of models/MCP/skills/rules, origin signals (npm/marketplace, etc.), install/usage flags, usage counts
Hashes	Per-user salted one-way hash of project paths/names (project_hash); one-way hash of tool contents (for fork detection)

d. Automatically generated information

Logs generated during use, such as access timestamps, authentication session data, and browser/device information

3. Information We Do Not Collect

The Company does not collect or transmit:

Source code, or raw prompts and responses
Raw file paths, or the real names of projects, companies, or clients
Account passwords, OAuth/authentication tokens, or other credentials
National ID numbers or other unique identifiers, or hardware serials/device identifiers

Project paths and names are processed only as one-way hashes salted per user, so the same project yields different values for different users and cannot be reversed to the original name. The user identifier (user_id) is not included in transmitted data; the server derives it from the authentication token.

4. Purposes of Processing

Identifying and authenticating users, and managing accounts
Aggregating and analyzing AI coding tool usage statistics and providing a personal dashboard
Producing and providing anonymized, aggregated statistics such as tool and model rankings
Publishing builder profiles within the scope chosen by the user
Operating and improving the Service, preventing abuse, and responding to inquiries

5. How We Collect

Information entered or linked during web sign-up and social login
Usage statistics collected by the CLI you install and run. The CLI presents the data to be uploaded (e.g., via bggg preview) and transmits it only with your consent (opt-in).
Logs generated automatically during use of the Service

6. Retention Period

In principle, the Company destroys personal data without delay upon account withdrawal, except where retention is required by applicable law.
Usage statistics are retained within the scope necessary to provide the Service; data linked to a user is destroyed when the user requests deletion or withdraws.
Anonymized, aggregated statistics that cannot identify an individual may be retained regardless of the above.

7. Disclosure to Third Parties

The Company does not, in principle, disclose personal data to outside parties. Disclosure occurs only with the user’s prior consent or where required by law.

8. Processors and International Transfers

The Company entrusts the processing of personal data as follows to provide a reliable service.

Processor	Entrusted work	Country
Supabase, Inc.	Authentication, database, and file (profile image) storage	United States, etc.
Vercel, Inc.	Web service hosting and delivery	United States, etc.

These processors handle personal data only as necessary to provide the Service. The items, timing, and method of transfer correspond to the “Information We Collect” above, transmitted over the network during use. Any change to these arrangements will be announced through this policy.

9. Anonymized & Aggregated Data

Public statistics such as tool/model rankings and trends are produced by anonymizing and aggregating data from many users and are not provided in a form that identifies any individual. Individual-level publication, such as a builder profile, occurs only within the scope the user opts into; the default is private.

10. Your Rights

You may, at any time, request access to, correction of, deletion of, or suspension of processing of your personal data.
You can edit your profile, change visibility, and delete your account directly from the settings screen.
Other requests may be sent to contact@buildersgate.com, and the Company will act without undue delay in accordance with applicable law.

11. Cookies

The Company uses cookies and similar technologies as needed to provide the Service, such as keeping you signed in. You can refuse cookies via your browser settings, but some features (such as login) may then be limited.

12. Destruction of Data

When the retention period elapses or the purpose of processing is achieved, the Company destroys the data without delay.
Electronic files are deleted irrecoverably; printed materials are shredded or incinerated.

13. Security Measures

A design in which transmitted data contains no user identifier; the server derives it from the auth token
Per-user salted one-way hashing of project paths/names and tool contents
Encryption in transit (HTTPS) and access controls
Access logging for processing systems and application of least-privilege principles

14. Data Protection Officer

The Company designates the following person to oversee personal data processing.

Company: BLUUPILL Inc. (주식회사 블루필)
Data Protection Officer: Gwangho Park (Representative)
Email: contact@buildersgate.com
Address: B107, Sparkplus Sinnonhyeon, 125 Bongeunsa-ro, Gangnam-gu, Seoul, Republic of Korea
Business Reg. No.: 836-86-02319

15. Remedies

To seek remedies for infringement of personal data rights, you may contact the following Korean authorities for dispute resolution or consultation:

Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
Privacy Infringement Report Center (KISA): 118 / privacy.kisa.or.kr
Supreme Prosecutors’ Office Cybercrime: 1301 / www.spo.go.kr
National Police Agency Cyber Bureau: 182 / ecrm.police.go.kr

16. Changes to This Policy

This policy may be amended in response to changes in law or the Service. Any amendment, along with its effective date and content, will be announced within the Service, with reasonable advance notice for material changes.