Privacy Policy

Summary

This website is a set of static pages. It has no user accounts, no registration form, no third-party analytics, no advertising network and no cookies of any kind. We do not build profiles of visitors and we do not sell data.

We do count visits, with a counter we wrote ourselves: it stores no IP address, writes nothing to your device, and cannot recognise you tomorrow. The resulting figures are public — anyone can read them at /statistic/, without a password. How that works is described in Visit statistics below.

Who we are

BlueBox Production is an independent game studio. We operate this website and the games, tools and services described on it. In this document, “we”, “us” and “the studio” mean BlueBox Production; “you” means the person visiting this website.

Scope

This policy covers the pages served from this website. It does not cover services operated by other companies that you may reach from here — game platforms, app stores, video hosting — each of which runs under its own privacy policy. Where a section of this document applies to one of our own separate products, that is stated explicitly.

What we collect

Through this website, we collect:

Cookies and local storage

This website sets no cookies and writes nothing to localStorage or sessionStorage. Your browser will cache static files — stylesheets, scripts, images, the web font — as it does for any website; that cache lives on your device, under your control, and can be cleared at any time from your browser settings.

Because we set no non-essential cookies, there is no consent banner. We consider that a feature.

Server logs

Like any web server, ours records a line for each request it answers. A log entry may contain:

• the IP address the request came from;
• the date and time of the request;
• the path requested and the HTTP status returned;
• the referring page, where the browser sends one;
• the browser user-agent string.

These entries exist to keep the service running and to spot abuse — scanning, brute-force attempts, denial-of-service traffic. They are not used for analytics or profiling, they are not combined with other data sets, and they are not shared with advertisers. Logs rotate automatically and are normally deleted within 14 days, unless a specific entry is retained longer as part of an ongoing security investigation or because law requires it.

Visit statistics

We wanted to know how many people visit and which pages they read, without the usual price of that knowledge. The counter works like this:

• When a page opens, your browser sends one request carrying the page path, the host of the site you came from (never the full address), a rough screen-width category, and nothing else. A second request when you leave carries how many seconds the page was open.
• The server needs to tell two visitors apart, so it takes your IP address and browser string, mixes them with a random salt, and keeps only the resulting hash. The address itself is discarded within minutes and never reaches the database.
• The salt is regenerated every night and the old one is overwritten. Once that happens, yesterday's hashes can no longer be matched to today's, so nobody — including us — can tell that the same person came back.
• Nothing is written to your device: no cookie, no local storage, no identifier of any kind.
• If your browser sends Do Not Track or Global Privacy Control, no request is sent at all.

What is stored per event: the date, that day's hash, the page, the referring host, a screen-width category, browser family, operating system family, and the seconds spent on the page. Events are kept for up to 400 days so year-on-year figures are possible, then deleted.

Third-party services

This website loads no third-party scripts, fonts or trackers: every file, including the web font and the visit counter, is served from our own domain. That means no request leaves your browser to another company simply because you opened a page here.

Links on this site do point outward. When you follow one, you enter a service operated by someone else, and that service decides what it collects:

• VK Play — hosts one of our games in the browser.
• YouTube — hosts our trailers and channel.
• RuStore and Apple TestFlight — distribute the Rupor mobile apps.
• Rupor (pynop.online, web.pynop.online) — our messenger, where the community lives.

We embed nothing from these services on our pages — no video players, no widgets — so nothing is requested from them until you deliberately click through.

Games and accounts

Our games are playable without creating an account on this website. Where a game runs on an external platform, that platform's own terms and privacy policy apply to your session there.

Where one of our games or services does maintain an account of its own, the data handling for it is described in our Data Processing Policy, which covers what is stored, why, for how long, and how to have it removed.

Bluegent

Bluegent, our AI agent, is software you install and run on your own machine. Downloading the installer from our domain produces an ordinary web-server log entry, as described above. What the agent does on your computer afterwards happens locally, under your control, and is governed by the documentation and terms shipped with the agent itself rather than by this website policy.

Children

This website is a studio and catalogue site. It is not directed at children, and we knowingly collect no personal data from anyone, of any age. Age restrictions for individual games, where they apply, are set on the platform that distributes the game.

Your rights

Depending on where you live, data protection law may give you the right to ask what personal data an organisation holds about you, to have it corrected or deleted, to object to certain processing, and to complain to a supervisory authority.

For this website, the honest answer to “what do you hold about me?” is: at most a short-lived server log entry that we cannot reliably link to you as an individual. If you believe we hold more than that — for example through one of our other services — contact us and we will look into it and respond.

Security

The site is served over HTTPS with a valid TLS certificate. It is composed of static files, so there is no database behind it and no login to compromise. Server access is restricted to the people who maintain the infrastructure, and software is kept up to date.

No system is perfectly secure. If you find a vulnerability in anything we run, please tell us before you tell anyone else — we would rather fix it quietly and thank you publicly.

Changes

If this policy changes, the updated version is published on this page with a new “last updated” date. Where a change materially affects how data is handled, we will say so in our community channel rather than relying on you to re-read the page.

Contact

Questions about this policy, or a request about your data, can be sent to us through our community in Rupor: web.pynop.online/invite/FDF4B4A8. We read it daily and answer there faster than anywhere else.

See also our Data Processing Policy for the operational detail: categories of data, retention periods, sub-processors and how requests are handled.