Privacy Policy

Last updated: 25 August 2026

Blueberry Client (“Blueberry”, “we”, “us”) is operated by Mystic Systems LLC. This policy explains what we collect, why, and what we do not collect.

1. Who can use Blueberry

Blueberry is not intended for children under 13, and we do not knowingly collect personal information from them. If you are under 13, do not create an account or purchase anything. If you are between 13 and the age of digital consent in your country (16 in parts of the EU/UK), you may use Blueberry only with a parent or guardian’s permission.

If we learn we have collected data from a child under 13 without parental consent, we delete the account and its data. Parents or guardians can request this at any time at support@blueberryclient.com.

2. What we collect

2.1 Account identity — from your Microsoft/Xbox sign-in

• Xbox XUID — your account identifier. Everything you own is keyed to it.
• Gamertag — shown in the launcher and in-game.

We never receive or store your Microsoft password. Sign-in happens with Microsoft and we only receive the result.

2.2 Account state we create

• Device ID — a random identifier generated on your PC, used to enforce one active session per account. It is not derived from your hardware.
• Session ID — so a new sign-in can end the previous one.
• Entitlements — what you have access to.
• Owned cosmetics and equipped cloak — so your items follow your account.
• Blueberries balance and ledger — every movement of the in-app currency, kept as an audit record.
• Purchase history — what was acquired, when, and by which method.

2.3 Payments

Payments are processed by Stripe. We never see, receive, or store your card number. From a completed purchase we store the Stripe payment identifier, the amount, the currency, and the email address you gave Stripe at checkout — retained so we can identify a payment for support, refunds, and chargebacks. Stripe’s handling of your data is governed by Stripe’s Privacy Policy.

2.4 Product analytics

• Launcher version, client version, Minecraft version, Windows build number
• Session length, in the launcher and in-game
• Whether a launch succeeded, and if not a category for why (e.g. “not signed in”) — never a file path
• Which features you have enabled, and which actually ran — names only
• Approximate country, and how many times you joined proximity chat

In analytics, your IP address is used to derive a two-letter country code and is then discarded. We do not keep IP addresses in our analytics. Security check-ins are separate and do retain them — see 2.7.

2.5 Proximity chat (voice)

We cannot hear you, and we do not record you. Voice audio is end-to-end encrypted between players. It passes through a relay that forwards packets without being able to decrypt them — the relay never holds the key that would make that possible. No voice audio is stored by us at any point.

From the relay we collect only aggregate traffic totals (bytes, packet counts, connected users and rooms) to size and pay for the server. These are not linked to you.

2.6 Diagnostics on your own PC

The launcher and client write log files to your computer. These stay on your machine. We do not upload them. If you send one to support, you are choosing to share it.

2.7 Device security and anti-tamper

To enforce bans and detect tampering with the client, the launcher reports adevice fingerprint every time it starts. We store, against your account:

• Hardware identifiers — your Windows MachineGuid, yourcomputer name, and the MAC address of every physical network adapter, plus a hash combining them
• IP addresses — the address you connected from, with a timestamp. We keep up to the 20 most recent per device
• Debugging and reverse-engineering tools — if the launcher detects one running (for example a debugger) it records the name and shuts itself down

Up to 12 devices are kept per account. This is used to enforce bans and investigate abuse — nothing else. It is not used for advertising, profiling, or analytics, and it is not shared with anyone. Section 7a of the Terms explains how it is used to enforce a ban.

If a tampering tool is detected while you are signed out, the report is still sent, without an account attached. It carries the same hardware identifiers and IP address.

3. What we do NOT collect

• No voice recordings. We are technically incapable of decrypting your voice.
• No chat messages.
• No in-game coordinates, world data, or which server you are playing on.
• No keystrokes. Analytics record that a feature ran, never what you typed.
• No card numbers. IP addresses are not kept in analytics, but security check-ins do retain them — see 2.7.
• No third-party advertising or tracking networks are in use as of the date above. No Google Analytics, no advertising pixels, no third-party trackers. See section 4a.

4. Cookies

Our website uses two cookies. Both are first-party, both are httpOnly (page scripts cannot read them) and sameSite=lax, and neither is used for advertising, profiling, or tracking you across other sites.

• Sign-in. Keeps you signed in. Expires after 12 hours. Strictly necessary to sign you in, so it does not require consent.
• Creator attribution (bb_partner). Set only if you arrive through a creator’s link, such as blueberryclient.com/theirname, so that the creator is credited if you buy. It stores only that creator’s public link name — nothing about you. It is a session cookie, so it is discarded when you close your browser, and it is ignored one hour after you followed the link. It is needed because buying requires signing in with Microsoft, which sends you off this site and back, and nothing in the address survives that trip.

4a. Advertising — current status, and what happens if that changes

Any promotional banner you currently see in the launcher is our own, served from our own servers. It is not supplied by an advertising network, sets no cookie, and does not profile you.

We may introduce third-party advertising in future. If and when we do:

• We will update this policy before any advertising code runs.
• Where the law requires it, we will ask for your consent before any advertising or analytics cookie or identifier is set, with a genuine reject option. Advertising will not be treated as “strictly necessary”.
• We will name the providers and link their privacy policies.
• Where applicable law gives you the right to opt out of the sale or sharing of personal information for targeted advertising, we will provide that control.

We are telling you this for transparency. This notice does not by itself constitute your consent to advertising cookies, and we will not rely on it as consent.

5. Who we share data with

We do not sell your data. We share it only with providers who run the service for us:

• Stripe — payment processing
• Google Cloud — application hosting and database
• Cloudflare — website, downloads, and network protection
• Microsoft / Xbox Live — sign-in

We may also disclose data where legally required, or to investigate fraud, chargeback abuse, or violations of our Terms.

6. Where your data is processed

Our servers are in the United States. If you are outside the US, using Blueberry means your data is transferred there. For UK/EU users we rely on Standard Contractual Clauses with our providers as the transfer mechanism.

7. How long we keep it

• Account, entitlements, cosmetics — until you ask us to delete them
• Blueberries ledger and purchase history — kept as a financial record even after account deletion, as tax and chargeback rules require
• Raw analytics events — 48 hours
• Device security records (hardware identifiers, IP history, tamper flags) — for the life of the account
• Daily aggregated analytics — a rolling window
• Lifetime aggregate totals — indefinitely, not tied to an identifiable person
• Voice audio — never stored

8. Your rights

Depending on where you live you may have the right to access, correct, delete, or export your data, to object to or restrict processing, and to withdraw consent. To exercise any of these, email support@blueberryclient.com from the address associated with your purchase. We respond within 30 days.

If you are in the UK/EU you may complain to your data protection authority. If you are in California you have rights under the CCPA/CPRA, and we confirm we do not sell or share personal information as those laws define it.

Deleting your account removes your access to everything associated with it, including purchased licences, and cannot be undone.

9. Security

Sign-in tokens are encrypted on your PC using Windows DPAPI. Traffic is encrypted in transit. Voice audio is end-to-end encrypted. No system is perfectly secure, and we cannot guarantee absolute security.

10. Changes

We may update this policy. Material changes will be announced in the launcher or on the website. Continuing to use Blueberry after a change means you accept the updated policy.

Contact

support@blueberryclient.com
Mystic Systems LLC, 30 N Gould Street, Ste N, Sheridan, WY 82801, USA