Privacy Policy

Effective: October 20, 2026 (first version October 18, 2026)

Summary — Bluetong is a tool by Levelupsoft Inc. (“we”) for viewing and editing data modeling projects (.vpp · .blue): the web app at bluetong.com, a macOS app and a command-line tool. Only invited members can use it. We process only what signing in and storing and sharing projects need, and we use no advertising, analytics or tracking.

Personal data we collect
Projects and app data
Settings you enter and outside connections
Website
When you contact us
Sharing, processors and transfers abroad
Retention and deletion
Your rights
Children
Privacy officer
Changes to this policy

1. Personal data we collect

Account: your e-mail address (your login), your name, your password (kept only as an irreversible argon2id hash), your role (administrator or member).
Sign-up check: the six-digit code e-mailed at sign-up (only a value to verify it, not the code itself) and the IP address that asked for it.
Access records: sign-in sessions (IP address; whether web, macOS app or command line) and an audit log (sign-in, invitations, sharing, saving, permission changes, with the IP address).

Membership is by an administrator's invitation code only; you enter this data when you sign up or sign in, or it arises as you use the service.

2. Projects and app data

Projects on the server: the projects you upload or edit there, their edit history and sharing settings are stored on our server. A shared project is visible only to the members you choose.
Files on your device: a .vpp opened on your Mac or in your browser stays off the server until you choose “Upload to server”. When you turn editing on, a temporary working copy is made on the server for the edit calculations and deleted when you close the file.
Kept only on your device (never sent to us): view settings, the recent-files list, and the session's transport key (the browser's storage on the web, the Keychain in the macOS app).

3. Settings you enter and outside connections

Database connections for “Import from database”: address and account; the password is stored encrypted and never shown again. When you use it, our server connects to the database you named and reads only its table definitions (DDL).
AI settings and AI chat: the address, model and API key (stored encrypted) of an AI provider set up by your administrator or by you. Only when you use AI chat are your conversation and a summary of the open diagram (table and column names and the like) sent to that provider.
API keys: for the API keys you make to use Bluetong from the command line, MCP or other programs, we store each key's name, its public key (to check signatures — the secret part is made on your screen and never reaches our server), its scope (read only, or read and edit), the projects it may use, when it expires, and when and from which IP address it was last used.
File tags and settings: the tags you put on files (only you see them — the sharer's and the recipient's tags are not visible to each other) and your settings (how long the trash keeps files, share notices by e-mail) are stored on our server. Screen settings such as the theme and diagram colours stay in your browser or on your Mac.
Share notices: when another member shares a project with you or changes your share, we store a notice for you (the sender's name and e-mail address, the project's name, the permissions you were given, when you read it) and show it at once in the web and macOS app. We also store whether you want these notices by e-mail as well (on at first).
Push subscriptions: when you turn on notices for a browser with its window closed (in the 🔔 panel) or the macOS app (TestFlight version) registers for notices, we store that browser's push address and encryption keys or that Mac's device token, the browser's description (User-Agent), when a notice last reached it and how many times in a row it failed.
AI chat history: so that you can read and go on with past conversations, each answered conversation (what you wrote, the text of files you attached, a small preview of pictures you attached, the AI's answers and proposals, and what applying them did) is stored on our server by member, project and diagram. The original pictures are not stored. Only you can see your conversations.

4. Website

bluetong.com uses a single session cookie to keep you signed in (not readable by scripts, sent over HTTPS only). It uses no advertising, analytics or tracking cookies and no outside scripts; every file of the page comes from bluetong.com. The macOS app download (bluetong.com/download) needs no sign-in and collects no personal data.

5. When you contact us

If you write to us, we use your address, your name (if given) and your message only to answer and handle your request.

We do not give personal data to third parties unless the law requires it. To run the service we use the processors below, and data may be transferred abroad in the process.

Recipient	Google LLC — Google Workspace (Gmail)
Purpose	Sending sign-up codes and share notice mail (unless you turned it off); sending and receiving support mail
Data	Recipient's e-mail address; the content of the code mail, share notice mail (the sender's name and e-mail address, the project's name, the permissions) and support mail
Country · when · how	The United States and other Google data centers · when mail is sent or received · encrypted network transfer
Retention	As long as the mail is kept in our Google Workspace account

Recipient	The AI provider set up by your administrator or by you (for example Ollama Cloud or an OpenAI-compatible service)
Purpose	Answering the AI chat you asked for
Data	Your conversation; a summary of the open diagram
Country · when · how	Where that provider's servers are · only when you use AI chat · encrypted network transfer
Retention	Under that provider's policy

Recipient	The browser makers' push services — Google LLC (Firebase Cloud Messaging for Chrome and Edge), Mozilla Corporation (Firefox), Apple Inc. (Safari), Microsoft Corporation (Edge on Windows)
Purpose	Delivering share notices to a browser whose Bluetong window is closed
Data	That browser's push address; the notice, encrypted so that only the receiving browser can open it (the push service cannot read it)
Country · when · how	The United States and other data centers of each company · when a notice is made for a browser where you turned on web push · encrypted network transfer
Retention	Until the notice is delivered (under each company's policy)

Recipient	Apple Inc. — Apple Push Notification service (APNs)
Purpose	Delivering share notices to the macOS app while it is not running
Data	That Mac's device token; the notice's text (the sender's name, the project's name)
Country · when · how	The United States and other Apple data centers · when a notice is made for a Mac registered for notices · encrypted network transfer
Retention	Until the notice is delivered (under Apple's policy)

Accounts, projects and records are kept on servers we run in the Republic of Korea.

7. Retention and deletion

Account, access records and audit log: kept while you are a member and deleted without delay when you leave or ask. Records the law requires us to keep are kept apart for that period only.
Projects: a project you move to the trash stays there for the period you choose (7 days at first, 1–365 days), then is deleted with its history, sharing settings and tags (the server checks every hour). While in the trash only you can see it and restore it; members it was shared with no longer see it. 「Delete now」 and 「Empty trash」 delete at once. When you leave, all your projects are deleted.
File tags: deleted when you remove them or when the file is deleted, and all of them when you leave.
Temporary working copies: deleted when you close the file; one left behind is deleted a day later, the next time you start editing.
AI chat history: a conversation you delete in the conversation list is deleted at once; when you leave, all your conversations are deleted.
API keys: a revoked key can no longer be used; its record (name, public key, times and IP addresses of use) is kept while you are a member so that its use can be checked, and deleted when you leave.
Share notices: kept while you are a member (the list shows the latest 50) and deleted when you leave.
Push subscriptions: deleted at once when you turn them off, when the push service tells us the address is no longer in use, or after 10 failed deliveries in a row; deleted when you leave.
Support mail: deleted once it is no longer needed after your request is handled.
Backups: for recovery, the server's data is backed up daily and the latest 14 backups (about two weeks) are kept, the oldest deleted first; deleted data leaves the backups after that period.

8. Your rights

You may ask to see, correct or delete your personal data, or to stop its processing, and you may leave. You can change your password in the app; for anything else, or to leave, write to halo@levelupsoft.com. We will confirm it is you, act without delay and tell you the result. You may also contact the Korean authorities: the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

9. Children

Bluetong is a work tool for invited members and is not directed at children under 14. If we learn that we hold data of a child under 14, we delete it without delay.

10. Privacy officer

Company	Levelupsoft Inc.
Privacy officer	Patrick Kim (developer)
Email	halo@levelupsoft.com

11. Changes to this policy

If we change this policy, we will announce it on this page before it takes effect. The first version took effect on October 18, 2026; the version of October 19, 2026 adds the storing and deletion of AI chat history (sections 3 and 7), its afternoon revision the storing and keeping of API keys (sections 3 and 7), its evening revision share notices, push subscriptions and their delivery (sections 3, 6 and 7), and the version of October 20, 2026 the storing of file tags and member settings and the trash's keeping period (sections 2 and 7).