Introduction

At Boston Korean Life, accessible from https://www.korboston.com, the privacy of our visitors matters to us. This Privacy Policy describes what personal data we collect, why we collect it, how we use and protect it, and what choices you have.

This policy covers the Boston Korean Life website and app only. It does not cover offline data collection or the practices of third-party sites we link to.

This policy explains our data practices. Questions or requests: korbost12@gmail.com.

Definitions

• Personal Data: information relating to an identified or identifiable person — e.g. email address, submission history, IP address.
• Processing: any operation on personal data — collection, storage, use, or deletion.
• Data Controller: korboston.com — Boston Korean Life is a personal project, not a registered business entity.
• You / User: anyone using Boston Korean Life.

Information We Collect

1. Information you provide directly

• Account: email address (used with a one-time sign-in code — we never ask you to create a password), or basic profile info from "Sign in with Google" (name, email, account identifier, and your Google profile photo, which we display in place of an initial in the account menu) if you choose that option instead.
• Profile preferences you set after signing in: display name, preferred language, a general "user type" category (e.g. student, employee, family), your city or neighborhood (we ask for a city or neighborhood only, not a street address or GPS coordinates), a transportation preference, and interest tags.
• Places or events you save, and your progress on the onboarding checklist.
• Corrections you submit about an existing listing, or (for approved trusted contributors) suggestions for a new listing — including any optional link you provide as supporting evidence. These are tied to your account and are never published automatically; an editor or administrator reviews them first.

2. Automatically collected data

• Standard web server logs: IP address, browser type, device type, pages visited, and timestamps — collected by our hosting/infrastructure providers for security and reliability, not analyzed by us for marketing.
• Cookies needed to keep you signed in and to remember your language choice (see Cookies, below).

3. Location data

• If you tap "use my location" or "get directions" on the map, your browser asks your permission and uses your device's location. That location is held in your browser for the rest of your visit — it's used to sort listings by distance and can be reused for further "Directions" requests without asking again — but it is not sent to or stored in our own database, and is not linked to your account.
• Getting driving directions sends your location and the destination's coordinates to our routing provider (OSRM, at router.project-osrm.org) to calculate the route for that request. We don't control or have visibility into that provider's own server logs, so we can't promise they don't retain request data on their end — see their own terms if that matters to you.
• Transit information on a place's page (nearby MBTA stops and arrival times) is looked up using that place's fixed location, not your device's location — your location is not involved in that feature at all.
• We do not derive or store location from your IP address, and we do not track location in the background.

4. What we don't collect, and what we don't ask for

We use passwordless sign-in, so we never see or store a password. We don't ask for your precise home address, government ID numbers, date of birth, or private messages, and we don't track continuous location history. We don't offer a profile-photo upload feature ourselves — if you sign in with Google, the photo shown is the one already on your Google account, pulled from your OAuth profile, not uploaded to us.

We also don't ask for or require immigration status or health information. That said, our profile setup does let you self-select an "immigrant" category (as a general user-type description, not a legal status) and a "healthcare" interest tag (meaning interest in healthcare services, not medical records), and several fields — your display name, city/neighborhood, and any correction or suggestion notes/evidence link you submit — are free text. Please don't put sensitive personal information (yours or anyone else's) into those free-text fields; we don't ask for it and can't guarantee it will be filtered out.

How We Use Your Information

We do not currently use your data for email marketing, ads, or behavioral profiling — see the next section for what changes if that's added later.

Planned — Not Yet Active

We plan to add the following in the future. Nothing below is live today.

• Advertising: once added, we will disclose the ad network(s) used, whether ads are personalized/interest-based, and an opt-out method (e.g. Google Ads Settings, aboutads.info). If this constitutes a "sale" or "share" of data under CCPA/CPRA or similar state laws, we will add the required opt-out link and update the section below.

Cookies

We use three kinds of cookies:

• Session cookies from our authentication provider, to keep you signed in.
• A language-preference cookie (NEXT_LOCALE), set by our translation framework to remember whether you're viewing the site in English or Korean.
• Google Analytics cookies (functional/analytics, not advertising) — only set after you accept the cookie-consent banner shown on your first visit. If you decline, no analytics cookie is set. Retention for this data follows the setting configured in our Google Analytics admin panel; you can ask us for the current value at any time (see Contact, below).

You can change your analytics choice at any time by clearing your browser's site data for this domain, which brings the consent banner back.

Third Parties We Use

We don't sell your personal information. We share data only with the service providers that run the site, and only as needed to run it:

• Supabase — authentication, database, and file storage. Account info, profile fields, saved items, and correction/suggestion submissions live here.
• Google — only if you choose "Sign in with Google" (standard OAuth profile fields).
• Google Analytics — only after you accept the cookie-consent banner. Used to understand aggregate usage (e.g. which pages are visited, how people arrived, general device/location category) — not to identify you personally. Data is retained per our Google Analytics admin setting (default: 14 months) and can be opted out of at any time via the Google Analytics Opt-Out Browser Add-on, or by declining the cookie banner.
• OpenStreetMap — provides map tiles. Loading the map sends your IP address, browser/device information, and tile request details to its servers, even if you do not grant device-location permission. Requested tiles indicate the area being viewed. See the OpenStreetMap Foundation Privacy Policy.
• OSRM (router.project-osrm.org, a public routing service) — receives your location and a destination's coordinates to calculate driving directions when you request them; we don't control what it logs on its own servers.
• MBTA (the V3 API operated by the Massachusetts Bay Transportation Authority) — we send a place's fixed location to look up nearby transit stops and arrival times; your device location is never part of this request.
• Vercel — hosts the website and processes standard request/server logs (IP address, timestamps, pages requested) to serve the site.

We may also disclose data if required by law, to protect the safety of users or the public, or as part of a merger or acquisition (with notice to you).

Data Security

• HTTPS/TLS in transit.
• No passwords are stored (passwordless sign-in), so there's nothing to hash or leak on that front.
• Server-side authorization and row-level database security — even an administrator's actions are checked server-side, not just hidden in the interface.
• Submission review workflow: corrections and suggestions are never auto-published.

If a data breach creates a real risk to your rights, we will notify affected users and, where legally required, relevant authorities.

Data Retention

Deletion applies to our active database. Copies may remain in provider backups until those backups expire under the applicable retention settings.

Your Privacy Rights

You may request access to, correction of, or deletion of your personal data by contacting korbost12@gmail.com. Deleting your account removes your profile, saved items, and checklist progress, and clears the account reference from your submissions — but the correction/suggestion records themselves (including any free text you wrote in them) stay in our database as described above; if you want a specific submission's content removed too, identify the submission in your request. We will review personal information in its text and links for removal or redaction, subject to applicable law. Keeping an account reference separate does not make the remaining content anonymous.

Other Legal Rights

Boston Korean Life is built for people visiting or living in the Greater Boston area — we are not intentionally targeting users in the EU/UK or elsewhere, so this policy does not include the full GDPR/UK-GDPR article-by-article rights sections that would apply to a business deliberately serving those regions. If applicable law in your location grants you additional rights over your data (access, correction, deletion, or an objection to processing), you can exercise them the same way: contact korbost12@gmail.com.

We do not sell or share personal information for cross-context behavioral advertising (California residents: this means there is currently nothing to opt out of under CCPA/CPRA). You can still request to know, delete, or correct your personal information at any time via the email above.

Children's Privacy

Boston Korean Life is a general-audience site and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact korbost12@gmail.com and we will delete it.

Links to Other Websites

Boston Korean Life links to external places, events, and resources. Once you leave our site, this Privacy Policy no longer applies, and we aren't responsible for those sites' practices.

Changes to This Policy

We may update this Privacy Policy. Material changes will be reflected by updating the "Last Updated" date and a notice on the site.

Contact

korbost12@gmail.com