Work
2026odin337.ru — the studio's own site
A case study you are reading from inside the case study itself. Everything stated here can be checked in your own devtools in about a minute — that is the whole point of it.
Role
- Architecture
- Design system
- Development
- Infrastructure
- SEO
Stack
- Next.js 16
- React 19
- TypeScript
- Tailwind CSS 4
- three.js
- Docker
Facts
Fonts
3 woff2 files, 138,756 bytes (135.5 KiB)
How to check this: Devtools → Network → filter by Font. Three files, all from this domain, and no request to fonts.googleapis.com.
Server code per page
No API routes, no server actions
How to check this: View the page source: the markup arrives complete in the HTML rather than being assembled on the client.
Google Analytics
Not present
How to check this: The Content-Security-Policy response header: not one Google origin in script-src or connect-src. The browser cannot execute what is not listed there.
Cookies before consent
One functional cookie — the chosen language
How to check this: Devtools → Application → Cookies on a first visit. The only entry is langPinned; there are no third-party cookies.
Where form data goes
To the studio's own server in Moscow
How to check this: The connect-src directive in the CSP is the complete list of addresses this page is permitted to talk to at all.
Render tiers
4 — from a static poster to WebGL with postprocessing
How to check this: Devtools → Rendering → Emulate prefers-reduced-motion. The heavy layer does not merely stop — it is never downloaded.
Pages are built ahead of time
No page on this site is assembled at request time: the HTML is complete at build time, and the project contains no API routes and no server actions. The only code that runs on the hosting side is the handler that remembers an explicitly chosen language, and it deliberately reads neither the request body nor any geolocation. The previous version of the site redirected “/” to “/en” based on the country in the visitor's IP address: that billed an invocation on every cold entry, made the home page uncacheable, and inferred an attribute of a visitor from their IP. Language is now an explicit action only.
Three typefaces, zero third-party requests
The fonts are not linked from Google Fonts but built by our own script: each family has its weight axis narrowed to the range actually used and its character set cut down to what actually gets rendered. The primary reason is not file size — it is that fonts.googleapis.com would receive the visitor's IP address on every single page view. The side effect is pleasant: one same-origin, immutably cached woff2 per family instead of a cross-origin CSS round-trip and an unpredictable number of fragments after it.
Heavy graphics never load where they cannot run
The hero scene has four implementations, and the choice between them is made before a WebGL context is created rather than after. The order of the checks is the contract: an accessibility preference outranks a network hint, a network hint outranks a capability probe, and a hardware heuristic comes last. So prefers-reduced-motion sends even a powerful desktop to the static poster, and Save-Data is respected before core count is ever counted. The server always renders the lowest tier, so the first screen is never blank while JavaScript boots.
Personal data does not leave Russia
Form submissions go to our own server in Russia and to a database in Russia, not into the hosting provider's infrastructure. This is the requirement of 152-ФЗ art. 18 §5: the primary record of a Russian citizen's personal data must be created in a database located in Russia. The architectural consequence follows from it — the marketing site has no endpoint capable of accepting a form at all, because an endpoint physically able to write the data to the wrong place will eventually do so.
Analytics — only with consent, and only one
Google Analytics has been removed and cannot come back: it transfers personal data outside Russia, which 152-ФЗ art. 18 §5 forbids for Russian citizens' data. The only permissible analytics is Yandex Metrica, and it loads only after explicit consent — not “by default until refused”. Before consent exactly one first-party cookie is set, recording the chosen language; that is a functional record of the visitor's own action, not a tracking identifier. The list of permitted origins is pinned in the CSP, so a third-party script cannot be added quietly: it simply will not execute.
- Performance
- WebGL
- Data localisation
- Accessibility