BumBoo — Privacy Policy
The official record of a used vehicle, on the advert itself.
Spark Games Ltd · company no. 15379140BumBoo does not sell or share personal information. There is no analytics, no telemetry and no tracking of you, and nothing on any page is an advert.
There is one commercial link, and it is easier to state plainly than to bury. The panel lists places to get an insurance quote, and those links are tagged with the name of this extension so the insurer can see that the visit came from it. Some of them may in future pay a commission for that traffic. The tag names the source, not you: no identifier, no registration, no vehicle and nothing about the person clicking travels with it, and nothing is sent at all unless you click the link yourself. Where a link does earn a commission the panel labels it “paid link” on the link itself.
Nothing is sent to the developer, who receives no data from the extension at all. Plate reading happens on your machine, and the identifier you are checking goes only to the public register for the country it belongs to: GOV.UK for a British registration, RDW for a Dutch kenteken, NHTSA for a VIN. Nowhere else.
One feature reaches a third party, and only when you press it. The locate button beside the postcode field asks your browser where you are and sends those coordinates to postcodes.io — a free public service over Ordnance Survey’s open postcode data — to get the nearest postcode, so a vehicle search can be centred without you typing it. The coordinates are used for that one request and discarded; the postcode is kept on your machine so you do not have to do it twice. Nothing happens on install, on startup, or on opening the popup, and you can always just type the postcode instead.
An AI verdict feature exists in the code and is switched off: the build carries no key for it and does not request the permissions it would need. If a release turns it on, this policy and the permissions it asks for will both say so before it does.
What the Extension Handles
- Vehicle identifiers. A registration, a Dutch kenteken or a VIN, read from the page text, from the advert’s photographs, or typed by you. An identifier identifies a vehicle, not a person, and every record returned is published as open data by the government that holds it.
- Advert details. Make, model, colour, fuel type, year and mileage are read from the page you are already viewing, and used only to check that the MOT record found actually belongs to the advertised vehicle. They never leave your browser.
- Your approximate location (only on request). If you press the locate button beside the postcode field, your browser’s position is read and exchanged for the nearest postcode, which is then kept locally so you do not have to type it. The coordinates themselves are not stored.
Where Data Goes
| Destination | What is sent | Why |
|---|---|---|
m.atcdn.co.uk | a request for advert photos already shown on the page | so the plate can be read locally |
www.check-mot.service.gov.uk | a British registration number | to retrieve the public MOT history |
opendata.rdw.nl | a Dutch kenteken | to retrieve the public APK expiry and recorded defects |
vpic.nhtsa.dot.gov | a VIN | to decode what the vehicle is |
api.nhtsa.gov | the make, model and year that VIN decoded to | to retrieve safety recalls and owner complaints for that model |
api.postcodes.io | your approximate coordinates | only when you press the locate button, to return the nearest postcode |
| an insurer or comparison site | nothing but the fact that BumBoo sent you, and only if you click | so a quote can be obtained, and so the traffic can be counted |
Nothing is sent anywhere else. In particular, nothing is sent to the developer.
The insurance row above those links is worked out entirely on your machine, from what the advert already says. Nothing is asked of anyone to produce it, which is also why it is a wide band and not a quote.
Image Processing
Plate reading happens entirely on your computer, using an OCR engine bundled inside the extension. Photographs are never uploaded anywhere, and no image leaves your browser. No remotely hosted code is executed.
What Is Stored, and Where
Everything is kept in Chrome’s local extension storage on your own machine:
- MOT lookup results, cached for 7 days to avoid repeat requests
- your shortlist, and the search postcode, radius and budget you last used
Cached lookups are clearable from the settings page, and the shortlist from the popup. Removing the extension deletes all of it. Nothing is stored in the cloud, and nothing is synced between devices.
Permissions, and Why Each Is Needed
storage: cache lookups and hold your shortlist and search settings locally.offscreen: run the bundled OCR engine in an extension document, so image processing stays off the web page.activeTab: let the popup act on the tab you are looking at.- Host access to
autotrader.co.uk: display the panel on adverts. - Host access to
atcdn.co.uk: fetch the advert’s own photographs so the plate can be read on your machine. - Host access to
check-mot.service.gov.uk: read the public MOT history. - Host access to
opendata.rdw.nl: read the Dutch register’s public APK and defect records. - Host access to
vpic.nhtsa.dot.govandapi.nhtsa.gov: decode a VIN and read the safety recalls and complaints published against that model. geolocation: fill in the postcode a search is centred on, on request.- Host access to
api.postcodes.io: turn those coordinates into a postcode.
Data Sources
MOT and vehicle data are published by the Driver and Vehicle Standards Agency under the Open Government Licence v3.0. Dutch vehicle, APK and defect data is published by RDW as open data. American vehicle, recall and complaint data is published by the National Highway Traffic Safety Administration as a work of the United States government.
BumBoo is not affiliated with, endorsed by, or connected to DVSA, GOV.UK, RDW, NHTSA, Auto Trader or any other site or service it reads.
What We Do NOT Do
- No analytics, no tracking, no telemetry.
- No accounts, no sign-in, no user profiles.
- No selling, sharing, or sending of any data to the developer or anyone else.
- No ads, and no remotely hosted code.
Children
BumBoo is not directed at children and collects no information from anyone.
Changes to This Policy
Any change to this policy will be published on this page and alongside the extension, and reflected in the “Last Updated” date below.
Contact Us
Questions about this policy? Reach us at spark-apps.co.