Privacy Policy

1. Introduction

BlueprintsLab ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website (gamedevcore.com), the Ultimate Engine CoPilot plugin ("the Plugin"), and related services. By using our services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.

2. Data We Collect

2.1 Account Information (Optional)

If you create a website account, we collect your email address (via Supabase Auth) and any profile information you provide (username, avatar, bio). A website account is optional and is not required to activate or use the Plugin.

2.2 Purchase & License Data

Your license key or FAB order ID and the associated license / entitlement information, used to verify your purchase. If you subscribe, we also keep your plan's status and billing dates. We do not store complete credit card numbers; payment processing is handled by PayPal, NOWPayments and Dodo Payments (the merchant of record for subscriptions), which expose only their own transaction, invoice or customer identifiers to us.

2.3 Device ID and License Checks

When you activate the Plugin, it generates a random device ID (a GUID) on your computer and registers it against your license key or FAB order to verify your seat. The Plugin sends this device ID together with your license key or order ID when you activate, and again every 15 minutes while it runs, to confirm your license is still valid.

The device ID is randomly generated. It is not derived from your hardware, username, or machine, and contains no personal information. The Plugin does not send your operating-system username, computer name, or hardware specifications. Older FAB builds of the Plugin still send a username and computer name; our servers discard them.

2.4 AI Usage Metering

When your AI requests go through our service (the tokens included with a plan, a token pack, or the free AI tier), we count the tokens each request uses against your license, to meter your allowance. Free-tier rate-limit counters reset automatically and are not retained beyond the current reset cycle.

2.5 Usage Data (Only If You Opt In)

If you opt in, the Plugin sends which tools run and what gets created (for example, a Blueprint or a material), linked to your license or account. It powers your stats card and your Learning progress, and it helps us improve the product. You make this choice in the Plugin; to withdraw it, contact us (section 13).

2.6 Learning Progress

If you use the Learning module, your course and lesson progress, XP, level, streaks, achievement unlocks, daily login records, and leaderboard display name are stored against your license or account.

2.7 Bug Reports (Only When You Submit One)

A bug report includes your device ID, your license key or FAB order ID, the report type, your message, the Plugin and engine version, and the AI provider and model. A conversation transcript is included only if you choose to attach one. We also store the IP address the report came from (see 2.13).

2.8 Security Log

When the Plugin refuses a tool call because the license check failed, it records a security event: your device ID, the tool's name, and the first 20 characters of your license token. We use it to detect tampering and license sharing.

2.9 Consent Record

When you answer the Plugin's terms and privacy prompt, we keep a record of your answer: your device ID, a SHA-256 hash of your license token (not the token itself), the versions of the Terms of Service and this Privacy Policy you accepted, your usage-data choice, when you answered, the Plugin version, and your website account if your license belongs to one.

2.10 Community & Referrals

If you use our community forum or referral / affiliate program, we collect the information you provide there: messages, replies, image uploads, reactions, direct messages (visible only to participants), online status and last-seen timestamps for the forum; referral codes, click tracking, commission records, and payout method preferences (PayPal email or crypto wallet address) for the affiliate program. Referral click tracking uses hashed IP values, not full IP addresses.

2.11 AI Conversation History

Your AI chats are stored locally on your computer and are never transmitted to our servers, except when you explicitly attach a conversation to a bug report (see 2.7). The same applies to AI Memory entries, Game Design Documents (GDD), Plugin settings and preferences, project scan / index data, API key configurations, and generated textures / materials / 3D models, all stored locally on your machine and never sent.

2.12 Local Encryption

To protect configuration and credentials saved on your computer, the Plugin derives a local encryption key from an anonymized device identifier provided by your operating system. This identifier is used solely for local, on-device encryption and is never transmitted, logged, or stored by us.

2.13 IP Addresses

When you visit the website or the Plugin contacts our backend, our hosting providers (Vercel, Supabase) transiently process standard request metadata, including your IP address, as part of delivering the service. This is normal web infrastructure logging and is governed by their respective privacy policies.

We also store the IP address a request came from when you activate a license, submit a FAB order, or send a bug report, and use it to detect abuse (spam, license and order sharing) and to rate-limit requests. We do not use IP addresses for license validation, and IPs are never returned in any API response or exposed to the Plugin.

3. How We Use Your Data

• Verify your seat with the random device ID registered against your license key or FAB order
• Process purchases and subscriptions, and verify FAB marketplace orders
• Provide customer support and account management
• Track learning progress, award XP, and manage gamification features
• Show your stats in the Plugin, if you opted in to usage data
• Manage community features (forums, direct messages)
• Meter AI usage and enforce rate limits
• Deliver content updates (AI prompt files, documentation)
• Calculate and pay referral commissions
• Improve our products, using the usage data you opted in to share
• Detect license tampering and sharing, and prevent fraud and unauthorized access
• Comply with legal obligations

We do not use your data for advertising, and we do not sell your personal data to third parties. Usage data linked to you is collected only if you opt in (see 2.5).

4. Third-Party Services

We use the following third-party services:

• Supabase - Database, authentication, and file storage
• Vercel - Website hosting and serverless functions
• PayPal - Payment processing for purchases and donations
• NOWPayments - Cryptocurrency payment processing
• Dodo Payments - Merchant of record for subscriptions: billing, tax and receipts
• Brevo (Sendinblue) - Transactional email delivery
• FAB (Epic Games) - Marketplace purchase verification
• Counter.dev - Privacy-friendly visitor analytics
• PostHog (EU cloud) - Website analytics: pages visited, clicks, errors and key events such as sign-ups and purchases
• Advertising platforms (Reddit, Google Ads, Meta and OpenAI) - Measure whether our ads lead to visits and purchases

The Plugin allows you to connect to third-party AI providers of your choice (OpenAI, Anthropic, Google, etc.). Your interactions with these services are governed by their own privacy policies. We do not control, monitor, or store the data you exchange with them.

If you use the free tier, your AI requests are routed through our proxy server for rate limiting. The proxy forwards your request and counts tokens but does not log or store the content of your prompts or responses.

You may also use a locally hosted LLM, in which case your AI data remains entirely on your machine.

5. Cookies and Tracking

We use cookies to:

• Maintain your authenticated session (Supabase auth cookies)
• Remember your language preferences
• Track referral codes (30-day cookie for affiliate attribution)
• Measure how the website is used (PostHog analytics cookie)

We use Counter.dev and PostHog (hosted in the EU) to understand how the website is used: which pages are visited, where visitors come from, which buttons are clicked, errors, and key events such as sign-ups, purchases and giveaway entries. When you are signed in, these events are linked to your account ID and email. License keys, device IDs and other secrets are removed from page addresses before anything is sent. PostHog does not run inside the plugin. We do not use Google Analytics or advertising trackers.

We advertise on Reddit, Google, Meta (Facebook and Instagram) and OpenAI (ChatGPT). Their measurement tags run on our website pages, never inside the Plugin, so each platform can tell that a visit or a purchase followed one of our ads. A purchase sends the platform the order value and a random conversion id. For Reddit and Meta we also confirm completed purchases from our server, including your email address as a one-way hash, so the sale is counted even if a browser blocks the tag. The OpenAI tag also has an automatic matching feature that can detect contact details you type into a form on a page where it runs, hash them in your browser and send them to OpenAI. We do not give any of these platforms your licence keys, device ids or the content of your chats. Each platform handles this data under its own privacy policy, and you can limit it with your browser's tracking controls or an ad blocker.

To learn which ads lead to sales, we keep one small first-party cookie (gdc_attr, 90 days) that records where you first came from and the last ad or link you used: the campaign name from the address you arrived on, the type of ad click, and the page you landed on. It holds no personal data. We attach it to our own analytics events and, when you create an account, to your account record. It is never sent to the advertising platforms.

You can manage cookie preferences through your browser settings.

6. Data Security

We implement reasonable security measures to protect your data:

• All data transmissions use HTTPS/TLS encrypted connections
• API keys you configure are stored locally and never transmitted to our servers
• Database access is restricted through Row Level Security (RLS) policies
• Activation IDs are randomly generated GUIDs: no hardware data is collected, derived, or stored
• Admin operations require authenticated service role keys
• Payment webhooks are verified with HMAC signatures
• The license record the Plugin keeps for offline use is signed by our server, so it cannot be edited or forged

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Data Retention

• Account data: Retained for the duration of your account
• Device & license data: Retained for as long as your license is active
• Learning progress: Retained for the duration of your account
• Community messages: Retained until deleted by the user or moderation action
• Free tier usage: Token counters reset automatically
• Local data: Persists on your machine until you manually delete it or uninstall the Plugin
• Referral data: Commission records retained for tax and legal compliance purposes

8. Your Rights & Choices

• Access: You can access your personal data through your account page
• Correction: You can update your profile information at any time
• Deletion: You can request deletion of your account and associated data
• AI provider choice: You choose which AI provider processes your data, or use a local LLM for complete privacy
• Free tier opt-out: Use your own API keys to communicate directly with AI providers without our proxy
• Local data: Clear conversation history, AI memory, and all locally stored data through the Plugin's interface
• Opt-out of marketing: Unsubscribe from any marketing communications
• Uninstallation: Removing the Plugin stops all data collection. Local files remain until manually deleted

To exercise these rights, contact us at blueprints.lab@gamedevcore.com

9. Children's Privacy

Our services are not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

10. International Data Transfers

Our backend services (Supabase, Vercel) may process data in regions outside your country of residence. By using our services, you consent to the transfer of information to countries that may have different data protection laws than your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on our website and, where appropriate, communicated through the Plugin's announcement system or email. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

12. Consent

By creating an account on gamedevcore.com, installing, activating, or using Ultimate Engine CoPilot, you agree to this Privacy Policy. If you do not agree with any part of this policy, you must discontinue use of our services immediately.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data:

• Email: blueprints.lab@gamedevcore.com
• Discord: discord.gg/w65xMuxEhb
• Website: gamedevcore.com