Which site this covers
This policy covers bluerabbit.io — the marketing site, blog, documentation, waitlist, and contact form you are reading right now.
It does not cover the BLUERABBIT product application at play.bluerabbit.io, where adventures, player accounts, and gameplay data live. That is a separate application with its own accounts, its own login, and its own database — a site account here is not a product account there, and neither one can log you into the other. If you are a player or a Game Master looking for how your gameplay data is handled, that is governed separately inside the app.
What we collect
Only what the page you are using actually needs. In full, that is:
- Waitlist signups — your email address, and which page you signed up from. Nothing else.
- Contact form — your name, email address, subject, and the message you write.
- Site accounts — if you register an account on this site, your name, email address, and a securely hashed version of your password. We never store your password itself and cannot read it.
- Session cookie — a single cookie that keeps you logged in while you use the site.
- Server logs — standard web request records (IP address, browser user agent, page requested, timestamp), kept for security and debugging.
What we do not do
Worth stating plainly, because it is unusual enough to be worth checking:
- No analytics or tracking scripts. There is no Google Analytics, no tag manager, no session recording, no heatmaps.
- No advertising cookies, no retargeting pixels, no third-party trackers of any kind.
- No selling, renting, or trading your personal information. Not to anyone, for any price.
- No profiling or automated decision-making about you.
Cookies
We keep this short because there genuinely isn't much to say.
- Essential (always on). A session cookie that keeps you signed in, a security token that protects our forms from being submitted by other sites on your behalf, a cookie recording your choice below, and a cookie set by Cloudflare that distinguishes real visitors from bots. These are strictly necessary for the site to function, so they don't require consent and can't be switched off — but they carry no advertising data and are not used to profile you.
- Analytics (your choice). Anonymous statistics about which pages are read. We do not currently run analytics of any kind. If we introduce it, it will only ever load for people who have actively agreed — your choice is recorded in advance and honoured automatically.
We use no advertising cookies, no retargeting pixels, and no third-party trackers.
Changing your mind. Use the Cookie Settings link in the footer of any page to review or change your choice at any time. Withdrawing is exactly as easy as agreeing was, and takes effect immediately. We also ask again after twelve months rather than treating an old answer as permanent.
Declining analytics costs you nothing — every part of this site works identically either way.
Why we use it
- To reply to you — contact form submissions exist so a human can answer your question.
- To tell you about the relaunch — if you joined the waitlist, we email you about availability and launch news. That is the entire reason the list exists.
- To run your account — authenticating you and keeping you signed in.
- To keep the site working and secure — logs, abuse prevention, and debugging.
Where the law requires a legal basis (for example the UK/EU GDPR), we rely on your consent for waitlist emails, and on our legitimate interest in answering enquiries, operating the site, and keeping it secure for everything else.
Who else touches your data
We use a small number of service providers to run this site. They process data on our behalf and are not permitted to use it for their own purposes:
- Resend — delivers our transactional and waitlist emails. Receives your email address and the message content.
- Cloudflare — sits in front of the site for security, DDoS protection, and performance. Processes request metadata including your IP address.
- Our hosting provider — stores the site and its database.
- jsDelivr — serves the rich text editor library, but only on signed-in administrator pages. Ordinary visitors never load it.
How long we keep it
- Waitlist emails — until you unsubscribe or ask us to remove you.
- Contact messages — until the enquiry is resolved and no longer needed for our records.
- Site accounts — for as long as the account exists. Delete the account and the record goes with it.
- Server logs — a short rolling window, then discarded.
Your choices and rights
You can ask us to show you what we hold about you, correct it, delete it, or send you a copy in a portable format. You can also object to how we are using it, or withdraw consent you have given.
To unsubscribe from waitlist emails, use the unsubscribe link at the bottom of any email we send you — it works immediately and needs no reply from us. For anything else, get in touch and we will action it. We do not charge for any of this, and we will not make you justify the request.
If you are in the UK or EU and you think we have got something wrong, you have the right to complain to your national data protection authority.
Security
The site is served over HTTPS. Passwords are stored using a one-way hash, never in readable form. Administrative areas require authentication, and the developer documentation section is restricted further. We take reasonable measures to protect your information, though no site can promise perfect security.
Children
This website is aimed at organisations and professionals, not children, and we do not knowingly collect information from children through it. If you believe a child has submitted information here, contact us and we will delete it.
International transfers
Our service providers may process data outside your country, including in the United States. Where that happens, we rely on the safeguards those providers have in place for international transfers.
Changes to this policy
If we change this policy we will update the date at the top of this page. Material changes affecting how we use information you have already given us will be communicated directly where we can reasonably do so.
Contact
Questions about this policy, or about data we hold, go to our contact page.