Wishlist on Steam
Menu

Privacy policy

Last updated: [DATE]

Draft. This policy is not in force yet.

In short

  • Bururu has no analytics and no ads. Accounts are coming later, and you will not need one; Accounts and Bururu Pro says what they will store.
  • The app sends nothing about you. It downloads the mod list, mods, pictures of the supported games and, if you want them, two drivers. The servers it downloads from see your IP address, as with any web page.
  • A mod reads only what it lists and you agreed to: a game's files, the game's window on the screen, the keys bound to the game and its telemetry packets. On Windows 11 it may also listen to the game's own sound, and on Windows, only for offline games with no anti-cheat, read the game's memory.
  • Bururu itself listens to a game's sound only when you turn on sound haptics or Game sound in headphones, on Windows 11, and keeps none of it.
  • What Bururu and your mods read on your PC stays there, unless you let a mod pass a game's telemetry on to an address it names.
  • This website sets no cookies and loads nothing from other sites.

Who we are

This policy covers the Bururu app and the website getbururu.com. Both are run by Bururu ("we"), the name under which the app's developer, a sole proprietorship registered in Turkiye, does business. Our postal address is [POSTAL ADDRESS]. You can reach us at [email protected].

The website

getbururu.com is a set of web pages. It uses no cookies, no analytics, no ads and no scripts, fonts or images from other sites. The moving picture on the home page is drawn on your device by the site's own scripts, which send nothing anywhere and store nothing in your browser.

Cloudflare hosts the site. To deliver the pages and protect them from attacks, Cloudflare processes your IP address and the details of each request, such as the page, the time and your browser's user agent. See Cloudflare's privacy policy. We use this data only to run and protect the site, and do not try to identify visitors.

Getting Bururu

Bururu comes through Steam. The Wishlist on Steam buttons on this site take you to Bururu's page in the Steam store, with a tag in the link that tells Steam the visit came from getbururu.com and nothing else. Steam then sees your IP address and, when you are logged in, your Steam account, under Valve's privacy policy. Steam installs and updates the app.

The app

Today the app has no accounts; see Accounts and Bururu Pro for what is coming. It has no telemetry: it does not report what you play, how you use it, or when it crashes.

It connects to other computers for these things only:

  • The mod list and mod updates. With the mod list on, Bururu downloads the public mod list from getbururu.github.io (GitHub Pages): at start when the last check is more than 6 hours old, every 6 hours while it runs, and when you click Check now. This is also how Bururu learns about updates for your mods. Bururu fetches download counts at most once a day, and mod icons and texts when you look at them.
  • Mods. A mod's file from its release on GitHub, only when you click Install or Update.
  • Game pictures. With the mod list on, the Games page shows each game's picture from Steam's own files on your PC. For a supported game that Steam has no picture of on your PC, Bururu downloads it once from Steam's picture server (shared.akamai.steamstatic.com) by the game's Steam app id. It downloads the pictures of every supported game together, so the requests do not show which games you have.
  • Bluetooth drivers. The setups of HidHide and usbip-win2 from their GitHub release pages, only when you choose to install them for a DualSense on Bluetooth. These drivers are made by others. HidHide's setup adds a scheduled task that can offer HidHide's own updates.
  • Your account, once accounts exist, and only if you make one or log in: see Accounts and Bururu Pro.
  • Telemetry a mod passes on. A mod that reads a game's telemetry may send the packets on, unchanged, to another address, such as a dashboard on another device. It can do this only for the addresses it lists, and Bururu asks you about them first, see Mods.

Each download is a plain HTTPS request with the user agent Bururu, without a cookie, a token or anything about you. GitHub and Steam's picture server see your IP address, as with any site you visit; see GitHub's privacy statement and Valve's privacy policy. Mod suggestions are worked out on your PC.

You can turn the mod list off with Use the mod list on Bururu's Settings page; the first run asks before anything is downloaded. With the list off, Bururu downloads nothing, except the drivers if you choose to install them.

Bururu also uses network ports that only programs on your own PC can reach (127.0.0.1): for the virtual controller of a DualSense on Bluetooth, which only usbip-win2 on your PC uses, and for a mod that reads a game's telemetry, while the game runs.

What Bururu reads on your PC

Bururu runs as your user. On Windows it asks for administrator rights only to install or update the two Bluetooth drivers, after you said yes. It reads:

  • Your controller: its buttons, sticks, motion, calibration and firmware details, and on the USB cable a DualSense's sound device. To find it, the controllers Windows lists.
  • Programs and windows: which programs run, to see whether a game with a mod or a profile runs (with the folder its program runs from, to check it is that game), and whether Steam, a HidHide tool or another controller app runs. Also which program's window is in front.
  • The mouse and keys: gyro aim moves the mouse while the game is in front. A mod that may read the keyboard sees only the keys bound to its game's actions, and only while the game is in front.
  • Your games, with Look for installed games on: the records your game launchers keep of installed games, to suggest mods and to find a game's folder.
  • Drivers: whether HidHide and usbip-win2 are installed and work, and their versions.
  • Sound devices: Windows' default playback and recording devices, for 30 seconds after the virtual DualSense's sound device is plugged in, so Bururu can set them back if Windows changed them.
  • The game's sound, on Windows 11 only: when you turn on sound haptics or Game sound in headphones (both are off at first), or for a mod you allowed to listen. Bururu takes only the sound of the game's own programs, and only while the game runs, never the whole PC or your microphone. It looks at the sound as it comes, or plays it in the headphones on your DualSense, and keeps none of it.
  • File types: your account's settings for .brr files, to show whether they open with Bururu.
  • What your mods read, see Mods below.

None of this is sent to us or anyone else.

What stays on your PC

Bururu keeps its settings, its log, your mods, their settings and data, the gyro calibration, the list of games it found and the game pictures in its own folder, or in %APPDATA%\Bururu. The window's cache, and the driver downloads until they are installed, are in %LOCALAPPDATA%\Bururu. On Linux, Bururu keeps these in ~/.config/bururu, and the window's files in ~/.cache/bururu and ~/.local/share/bururu. On macOS it keeps them in ~/Library/Application Support/Bururu. Deleting those folders removes it.

Outside its folders, Bururu changes only these:

  • The two Bluetooth drivers, and a folder with their setup logs in %ProgramData%, only for a driver install you said yes to.
  • HidHide's lists, while a DualSense on Bluetooth uses the virtual controller. Bururu takes its entries back afterwards.
  • Windows' default sound device, only to set it back when Windows made the virtual DualSense's sound device the default by itself.
  • With Open .brr files with Bururu on, your account's settings for .brr files.
  • On Linux, an app menu entry with its icon, and the .brr file type, in ~/.local/share. Bururu adds them at its first start.
  • On Linux, Allow on the Controller page asks for your password once and adds one file, /etc/udev/rules.d/70-bururu.rules, so Bururu may use the controller.

Bururu writes nothing in your games' folders.

Mods

Mods are made by their authors. A mod reads only what it lists, and only after you agreed when you installed it, or when you turned it on:

  • The files and folders it names, such as the game's log files, journal and key bindings.
  • The screen: what the game's window shows, read only from the area of that window and only while the game is in front. Bururu does not open the game's program for this.
  • The keys bound to the game's actions.
  • The telemetry packets a game sends to a port on your PC.
  • On Windows 11, the game's own sound while it runs, which Bururu looks at as it comes and does not keep.
  • On Windows only, and only for a game the mod list marks as offline with no anti-cheat, the game's memory. Bururu opens only the game's own program for this. A mod only reads the memory and never writes to it.

On Windows a mod may also read what a game sends to Bururu's virtual controller, such as its rumble, its trigger effects and its lightbar colour. Bururu does not ask about this one, since the game sends it to Bururu's own controller.

A mod cannot open a file or a network connection by itself, and cannot start programs. The one way a mod can pass data off your PC is to forward a game's telemetry packets to an address it names, and Bururu asks you about that address first.

Everything else a mod reads stays on your PC. Bururu keeps no pictures of the screen, unless you turn on a mod's setting for debug captures: while it is on, Bururu saves small captures of the areas it reads into that mod's data folder, and keeps the newest 600. A recording of what a mod's sensors read, which mod makers use for testing, is made only when you start one yourself.

Read what a mod asks for before you install it. Mods in the mod list are reviewed by a maintainer, but their authors are responsible for them.

Accounts and Bururu Pro

Accounts are not in the app yet. This section says what we plan to store once they are.

You do not need an account to use Bururu. Without one, Bururu never contacts our account server; it does so only after you sign up or log in, and then while you stay logged in. You make an account in the desktop app. The phone app, which comes later, can only log in to an account you already have; you cannot sign up there. Pro, which gives early access to new official mods and features, goes with your account.

For each account we store:

  • Your email address, to log you in and to mail you the codes for your account: one to confirm your sign-up, and one when you reset your password. [Decide whether you write about anything else, such as news about Bururu, and if so, only after a separate yes.]
  • A hash of your password, made with Argon2id, to check your password when you log in. We never store the password itself and cannot read it.
  • Your Pro status: whether you have Pro, since when and how you got it, so the app can give you Pro's early access.
  • The day you made the account.
  • Your logins: for each device that is logged in, whether it is a desktop or a phone, when it logged in, when it was last used, and a hash of its login tokens. No IP address and no device name. A login ends when you log out, or after 60 days without use, and then you log in again. Changing your password logs out your other devices, and resetting it logs out all of them. At most 10 devices stay logged in; a new login ends the oldest.

While you sign up, the server keeps your email address, your password's hash and a hash of the code it mailed you, until you enter the code. A password reset keeps a hash of its code. Each code works for 15 minutes, and the server deletes the ones that ran out within the hour after that.

The app talks to the account server at api.getbururu.com over HTTPS. When you log in, it sends your email address, your password, and whether it is the desktop app or the phone app. On your PC, Bururu then keeps a login token: on Windows encrypted for your Windows user, on a Mac in the Keychain, and on Linux in the keyring, or in a file in Bururu's folder where there is no keyring. It also keeps your email address and Pro status in its folder, so the window can show them while you are offline.

To stop password guessing, the server counts requests for each IP address in its memory, for an hour at most. It never stores IP addresses, and its log names no IP address and no email address.

The account server runs at Fly.io, with its data in [Amsterdam, in the EU]. Fly.io also sees your IP address as it passes the connection on to the server. The codes are mailed through [MAIL PROVIDER], which sees your email address and the mail. The mails are plain text, with no links and no tracking. We do not sell the data, use it for ads or share it, except with these two providers, which run the service for us.

We keep the data while your account exists. When you delete your account in the desktop app, the server deletes it, its logins and its codes at once. The server's daily backups keep a copy for [14] more days. [Decide whether an account nobody has logged in to for [NN] years is deleted, and whether you write first.]

Pro is not on sale yet. When it is, you pay through Steam, which handles your payment details under Valve's privacy policy. We get [what Steam passes on, such as your Steam ID, an order number and whether the payment went through], never your card details. The purchase records that Steam and tax law need are kept apart from your account, without your email address, for [NN years].

Children

Today Bururu collects no personal data, from children or anyone else. To make an account you will need to be at least [AGE].

Your rights

Until accounts exist, we hold no data about you that we could look up, so there is usually nothing for us to show or delete. Once you have an account, the desktop app shows your email address and Pro status, and you can delete the account there. For a copy of everything we keep about you, or if you think we hold other data about you, write to [email protected]. Depending on where you live, for example in the EU or the UK, you have the right to see, correct and delete your personal data, to object to its use, and to complain to your data protection authority.

Changes

When this policy changes, we update this page and the date at the top.