Privacy Policy
한국어 보기BLUUPILL Inc. (the “Company”) complies with applicable laws, including Korea’s Personal Information Protection Act (PIPA), and uses this policy to transparently explain how it collects, uses, stores, and destroys personal data in operating BuildersgateGG (the web service and the bggg CLI, the “Service”). The Service is designed to handle the minimum of identifying information and never collects source code, raw prompts, or the real names of your projects. The Korean version of this policy prevails in case of any conflict.
1. Overview
This policy sets out the categories of personal data the Company processes, the purposes of collection and use, retention periods, and the rights of data subjects. The Company processes personal data lawfully and appropriately to protect the freedoms and rights of data subjects.
2. Information We Collect
a. Account information (at sign-up)
- Email address
- When using social login (GitHub, Google): the account identifier, email, profile name, and profile image (if provided) received from that provider
b. Profile information (optional, entered by the user)
- Handle (username), display name, bio, external links, profile image, accent color
- Display settings such as visibility
c. CLI usage statistics (collected with consent)
| Category | Items |
|---|---|
| Device | A locally generated random UUID (machine_id, not a hardware identifier); optional device label |
| Client | CLI version, operating system (darwin/linux/windows), CPU architecture |
| Activity metrics | Per day/IDE/model: session count, message count, token counts, tool-call counts, estimated active time, hourly distribution |
| Tool inventory | Names of models/MCP/skills/rules, origin signals (npm/marketplace, etc.), install/usage flags, usage counts |
| Hashes | Per-user salted one-way hash of project paths/names (project_hash); one-way hash of tool contents (for fork detection) |
d. Automatically generated information
- Logs generated during use, such as access timestamps, authentication session data, and browser/device information
3. Information We Do Not Collect
The Company does not collect or transmit:
- Source code, or raw prompts and responses
- Raw file paths, or the real names of projects, companies, or clients
- Account passwords, OAuth/authentication tokens, or other credentials
- National ID numbers or other unique identifiers, or hardware serials/device identifiers
Project paths and names are processed only as one-way hashes salted per user, so the same project yields different values for different users and cannot be reversed to the original name. The user identifier (user_id) is not included in transmitted data; the server derives it from the authentication token.
4. Purposes of Processing
- Identifying and authenticating users, and managing accounts
- Aggregating and analyzing AI coding tool usage statistics and providing a personal dashboard
- Producing and providing anonymized, aggregated statistics such as tool and model rankings
- Publishing builder profiles within the scope chosen by the user
- Operating and improving the Service, preventing abuse, and responding to inquiries
5. How We Collect
- Information entered or linked during web sign-up and social login
- Usage statistics collected by the CLI you install and run. The CLI presents the data to be uploaded (e.g., via
bggg preview) and transmits it only with your consent (opt-in). - Logs generated automatically during use of the Service
6. Retention Period
- In principle, the Company destroys personal data without delay upon account withdrawal, except where retention is required by applicable law.
- Usage statistics are retained within the scope necessary to provide the Service; data linked to a user is destroyed when the user requests deletion or withdraws.
- Anonymized, aggregated statistics that cannot identify an individual may be retained regardless of the above.
7. Disclosure to Third Parties
The Company does not, in principle, disclose personal data to outside parties. Disclosure occurs only with the user’s prior consent or where required by law.
8. Processors and International Transfers
The Company entrusts the processing of personal data as follows to provide a reliable service.
| Processor | Entrusted work | Country |
|---|---|---|
| Supabase, Inc. | Authentication, database, and file (profile image) storage | United States, etc. |
| Vercel, Inc. | Web service hosting and delivery | United States, etc. |
These processors handle personal data only as necessary to provide the Service. The items, timing, and method of transfer correspond to the “Information We Collect” above, transmitted over the network during use. Any change to these arrangements will be announced through this policy.
9. Anonymized & Aggregated Data
Public statistics such as tool/model rankings and trends are produced by anonymizing and aggregating data from many users and are not provided in a form that identifies any individual. Individual-level publication, such as a builder profile, occurs only within the scope the user opts into; the default is private.
10. Your Rights
- You may, at any time, request access to, correction of, deletion of, or suspension of processing of your personal data.
- You can edit your profile, change visibility, and delete your account directly from the settings screen.
- Other requests may be sent to contact@buildersgate.com, and the Company will act without undue delay in accordance with applicable law.
11. Cookies
The Company uses cookies and similar technologies as needed to provide the Service, such as keeping you signed in. You can refuse cookies via your browser settings, but some features (such as login) may then be limited.
12. Destruction of Data
- When the retention period elapses or the purpose of processing is achieved, the Company destroys the data without delay.
- Electronic files are deleted irrecoverably; printed materials are shredded or incinerated.
13. Security Measures
- A design in which transmitted data contains no user identifier; the server derives it from the auth token
- Per-user salted one-way hashing of project paths/names and tool contents
- Encryption in transit (HTTPS) and access controls
- Access logging for processing systems and application of least-privilege principles
14. Data Protection Officer
The Company designates the following person to oversee personal data processing.
- Company
- BLUUPILL Inc. (주식회사 블루필)
- Data Protection Officer
- Gwangho Park (Representative)
- contact@buildersgate.com
- Address
- B107, Sparkplus Sinnonhyeon, 125 Bongeunsa-ro, Gangnam-gu, Seoul, Republic of Korea
- Business Reg. No.
- 836-86-02319
15. Remedies
To seek remedies for infringement of personal data rights, you may contact the following Korean authorities for dispute resolution or consultation:
- Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
- Privacy Infringement Report Center (KISA): 118 / privacy.kisa.or.kr
- Supreme Prosecutors’ Office Cybercrime: 1301 / www.spo.go.kr
- National Police Agency Cyber Bureau: 182 / ecrm.police.go.kr
16. Changes to This Policy
This policy may be amended in response to changes in law or the Service. Any amendment, along with its effective date and content, will be announced within the Service, with reasonable advance notice for material changes.