Buruda lets you reach the owner of a car by its licence plate, without anyone exchanging phone numbers. This policy explains what personal data Buruda handles, why, where it goes, and what you can do about it.
This English policy applies to people who use Buruda outside the Republic of Korea. People in Korea are covered by the Korean policy. A Traditional Chinese translation is provided for convenience; if the two differ, this English version prevails unless the law of your place of residence says otherwise.
Buruda is operated by an individual developer based in the Republic of Korea (“we”, “us”). We decide how and why your data is used (the “data controller”), and the same person acts as the privacy / data protection officer.
Contact for anything about your data: younghwa.labs@gmail.com. We reply within 30 days.
We never ask for or store phone numbers.
| Data | When | How it is stored |
|---|---|---|
| Account identifier — your email address, or the account ID given to us by Apple or Google when you sign in | When you create an account | As a keyed hash and in encrypted form |
| Licence plates you register, the country/region of the plate, an optional note for people who contact you, and your notification settings | When you add a car | The plate as a keyed hash and in encrypted form |
| Device data — an identifier generated by the app, operating system, app version, app language, and the push notification token | When you open the app | On our server |
| Messages — which preset message was sent to which registered plate, the reply chosen, and the time | When a message is sent or answered | On our server, linked to the sender’s device or account and the owner’s account |
| Reports and blocks you make, and reports made about you | When someone reports or blocks | On our server |
| Your agreement to the Terms and this policy (document version, language, time) | When you sign up | On our server |
| IP address and basic request logs | Whenever the app or the web page contacts our server | Used to limit abuse; kept in server logs for up to 3 months |
A plate that is not registered is not stored. If you type a plate that no owner has registered, we tell you so and keep no record of the plate.
If a car is not registered and a phone number is written on it, you can type that number to open your phone's own messaging app with a ready-made text. The number is used only on your phone; it is never sent to us or stored.
The web page behind the QR card. If you scan a Buruda card on someone’s dashboard, you can send a message from a web page without an account. We process your IP address to limit abuse and store the message itself; we do not learn who you are.
If you have registered a car, messages that other people send to your plate reach you through us. If someone reports or blocks you, we receive that report. This is data about you that comes from another person rather than from you.
| Purpose | Data used | Basis |
|---|---|---|
| Deliver messages between a sender and a car owner, and their replies | Plates, messages, push token, app language | Providing the service you asked for |
| Create and keep your account | Account identifier, device data | Providing the service; your consent at sign-up |
| Prevent harassment and abuse — rate limits, reports, blocks | Device data, IP address, messages, reports | Our legitimate interest in keeping people safe; legal obligations |
| Answer your questions | What you send to us | Your request |
Giving us an email address and a plate is voluntary, but without them you cannot receive notifications. We do not sell your data, show ads, build advertising profiles, or use analytics or tracking software.
We use the service providers below. They process data only to provide their service to us.
| Provider | What for | Where | Data |
|---|---|---|---|
| Google Cloud (Google LLC) | Runs our server | South Korea | Everything in section 2, in transit and in logs |
| Neon, Inc. | Database | Singapore | Accounts, plates (encrypted), messages, reports, consent records |
| Expo (650 Industries, Inc.), Apple Push Notification service, Firebase Cloud Messaging (Google) | Delivers push notifications | United States | Push token, notification title and text |
| Google (Gmail) | Sends the sign-in code email | United States | Your email address and the one-time code |
| Apple, Google | Sign in with Apple / Google | United States | The account ID they give us |
| GitHub Pages (GitHub, Inc.) | Hosts the web page behind the QR card | United States | IP address of the visitor |
Your data is therefore processed in South Korea, Singapore and the United States. The laws of those countries may differ from the law where you live, and authorities there may be able to access the data under their own law. Using Buruda means your data will be transferred to those countries; if you do not want that, please do not create an account, or delete it.
We do not share your data with anyone else, except where a law or a court order requires it.
You can ask us for a copy of your data, to correct it, to delete it, to stop using it, or to withdraw your consent. You can delete everything yourself in the app: Account → Delete account. For anything else, email us and we will reply within 30 days. We will not treat you differently for using these rights. You can also complain to the privacy authority where you live (see section 12).
Buruda is not directed to children. Outside Korea, accounts are for people aged 18 or older (or the age of majority where you live, if higher). We do not knowingly collect data from anyone under 18 (or under the age of majority where they live). If we learn that such a person has registered, we delete the account.
Connections are encrypted (HTTPS/TLS). Plates and account identifiers are stored as keyed hashes and in encrypted form, so the database alone does not reveal them. Access to the server and the database is limited to the operator. If a breach is likely to harm you, we will tell you and the relevant authority without undue delay.
We do not track you across other companies’ apps or websites, and we do not use cookies for advertising. Because we do not track, we do not respond to “Do Not Track” browser signals.
If we change this policy in a way that matters, we will tell you in the app at least 30 days before the change takes effect. The current version and its effective date are always at the top of this page.
The operator is the Data Protection Officer; contact the email in section 1. You may withdraw your consent at any time by deleting your account or emailing us. Data transferred outside Singapore is protected to a standard comparable to the Personal Data Protection Act. You may complain to the Personal Data Protection Commission.
You may request access to and correction of your personal data and limit its processing by contacting us. Buruda accounts are for people aged 18 or older. Ringkasan dalam Bahasa Malaysia: Buruda menyimpan e-mel akaun, nombor plat kenderaan (disulitkan) dan sejarah mesej anda untuk menghantar pemberitahuan kepada pemilik kenderaan. Data disimpan di Korea Selatan, Singapura dan Amerika Syarikat. Anda boleh memadam akaun anda pada bila-bila masa di dalam aplikasi, atau menghubungi younghwa.labs@gmail.com untuk akses dan pembetulan.
Collector: the operator of Buruda. Purposes: the purposes in section 4. Categories: the data in section 2. Period, area, recipients and methods of use: for as long as you keep your account; in South Korea, Singapore and the United States; by the operator and the providers in section 5; by automated processing. Under Article 3 of the Personal Data Protection Act you may request to inquire about or review your data, receive a copy, supplement or correct it, and ask us to stop collecting, processing or using it or to delete it, by emailing us. If you choose not to provide the data, you cannot receive notifications.
Providing your data is voluntary; without it we cannot deliver notifications to you. It is used for the purposes in section 4 and transferred to the classes of providers in section 5. You have the right to request access to and correction of your personal data; send requests to the email in section 1.
You have the rights to be informed, to object, to access, to rectification, to erasure or blocking, to data portability, to damages, and to lodge a complaint with the National Privacy Commission. The operator is the data protection officer; contact the email in section 1.
You may withdraw consent as easily as you gave it, by deleting your account in the app. Grievance Officer: the operator of Buruda, younghwa.labs@gmail.com. We acknowledge a grievance within 24 hours and resolve it within 7 days. If you are not satisfied you may approach the Data Protection Board of India once it is in operation. People under 18 may not create an account.
You are under no legal obligation to provide your data; providing it is voluntary, and without it we cannot deliver notifications to you. It is used for the purposes in section 4 and passed to the providers in section 5. You have the right to review your data and to ask us to correct or delete it.
The operator is the Information Officer; contact the email in section 1. Your data is transferred outside South Africa with your consent, given when you sign up. You may object to processing, request correction or deletion, and lodge a complaint with the Information Regulator (inforeg.org.za). People under 18 may not create an account.
Your data is disclosed to recipients in South Korea, Singapore and the United States (section 5). You may ask for access to and correction of your data, and you may complain to us; if you are not satisfied with our response you may contact the Office of the Australian Information Commissioner.
You have the right to ask for a copy of your personal information and to ask for it to be corrected. As described in section 3, we receive some information about you from other people (messages sent to your plate, and reports). You may complain to the Office of the Privacy Commissioner.
The operator is the person responsible for the protection of personal information; contact the email in section 1. Your information is stored and processed outside Canada (including outside Québec), where it is subject to the laws of those countries. You may request access and correction, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.