Pencil and Paper — privacy & data

Anonymous play statistics (daily report)

Puzzles solved in total, the current and longest daily streak, one word saying whether the save’s own integrity seal could vouch for that streak (trusted, adopted or refused), editions completed, achievements earned, and one count per puzzle column you have solved in (solved_sudoku and so on) - plus how many times the game has been opened, how many minutes it has been open, and minutes on each of four screens: the front page, solving, the newsstand and the MORE menu. Never your answers, and never which day’s puzzles.

When: At most once a day (by the UTC date): one try a session, about a minute after the game starts, skipped if today’s report has already gone, or while a mod pack that changes the game is loaded. A report that does not arrive is tried again at the next start.

Sent to: https://lostphantom.live/api/pencil-and-paper/telemetry

Every name in it, read out of the game’s code: anon version platform sessions playtimeMin scene_time metrics solved_total streak longest_streak streak_proof editions_completed achievements solved_* front_page solving newsstand more_menu (a * is a family: one name per column, filled in as you play)

Platform: the platform as Unity names it, one word: WindowsPlayer, OSXPlayer, LinuxPlayer or Android (a Steam Deck is not told apart - it reports Linux, or Windows under Proton).

Identifier: A random install id: twelve characters the game makes up on this machine the first time it prepares a report (about a minute into a session, and only with the switch on) and then keeps. It is not made from your Steam account, your hardware or a hash of anything, it is not copied to Steam Cloud or to an account, and turning the switch off does not delete it. It lets us tell one install’s reports from another’s; nothing in them says whose install it is.

Turning it off: the Share anonymous stats switch, on Settings → the DATA tab. It is ON by default. Off stops the report before it is built. The game goes on counting sessions and minutes on your machine while it is off, and a report sent after you turn it back on includes them. The switch is stored in your save, so “Start a fresh paper” - which resets everything, settings included - turns it back on; the random id survives a fresh paper.

What we keep: One record per install - the id, the version, the platform, the session and minute totals, the latest counters and screen minutes, and the first and last day it was heard from - plus daily totals per game. An install not heard from for 400 days is deleted; a daily total is kept for two years. A report carrying a field named like a name, an account or an email address, or any value shaped like an email address, is refused with an error rather than stored. Your IP address reaches our server with the request, as it does for any connection; it is held in memory for a few minutes to limit how often a report is accepted, and it is never written to a table or a log.

Where this is read from: PencilAndPaper: Assets/PencilAndPaper/Scripts/Core/Telemetry.cs BuildPayload and SceneBuckets (the body) and ShouldAttempt (the switch is its first test); UI/TelemetryRunner.cs (the send); Core/SaveData.cs `shareAnonStats` (the default); UI/SettingsScreen.cs case "DATA" (the row)

Bug reports and suggestions

Only what you write, and only when you press SEND. With it go six things the game already knows: the game version, whether this is a public or a tester build, the platform (the word Unity uses — "WindowsPlayer", not your machine), the language you are reading, which page was open, and a random id for this install. No log tail — this game keeps no log buffer, so there is none to send. No name, no account, no email, no device name, no location and no hardware. The install id is a random number the box made up so that three reports about one crash read as one story; it names an install to a queue, never a person to anybody.

Honesty note: there is no switch in front of the box, because it sends nothing unless you have written a report and pressed SEND. Share anonymous stats deliberately does NOT silence this — turning statistics off says you do not want to be measured, not that you no longer want to be able to report a crash.

Where this is read from: PencilAndPaper: Assets/PencilAndPaper/Scripts/UI/FeedbackBox.cs (`IntakeJson` is the one payload builder and `IntakePath` the one spelling of the address), documented in docs/FEEDBACK.md and held in both directions by Tools/feedback-check.py

• Your name, username, email address or any account of any kind - no game sends one. The studio’s statistics address (/api/<game>/telemetry) REFUSES a report carrying a field named like one of those, or any value shaped like an email address, with an error saying so. Slime Wars’ daily report goes to an older address that stores it as sent without that check, and it carries no such field.
• Your IP address is never stored. It reaches our server with every request, as it does for any connection, and the server holds it in memory for a few minutes to limit how often reports are accepted, then forgets it. No table has a column for it and it is not logged. (What our hosting provider’s own network logs keep is outside our code.)
• Anything you type. No chat, no search, and no bug-report text travels with the statistics.
• Your location, contacts, files, other running programs, or anything at all from outside the game.
• No advertising and no third-party analytics service runs in any of these games, and nothing is sold, rented or shared with anybody. Outside this studio’s own statistics, and not governed by its switch: every game is built with Unity, whose engine can report basic hardware details and crashes to Unity; Winter Is Here and Slime Wars tell Steam which achievements you unlock, and Slime Wars also reports lifetime playtime, kills, wins and losses to its Steam stats and leaderboards and signs in to Unity’s player-account service with your Steam login for its online features. Slime Wars and Slime Dominion include Unity’s ad library for a possible phone version and never start it, and Winter Is Here carries PlayFab and Photon code from an older project that nothing calls.

What this adds up to on our side is mostly charts. Per game and per day the dashboard shows:

• how many installs were heard from that day, and how many were new
• total sessions and total minutes played
• which screens took the most time, added up across everybody
• which versions are still in the wild
• whether an install came back a day or a week later

For the games that send a daily report (Winter Is Here, Dug Out, Smokestack Valley, Pencil and Paper and Slime Wars) we also keep one record per install - its latest totals and the first and last day it was heard from - and the dashboard lists a few of them under a short label that stays the same between visits. So we can tell one install from another, but not who is behind it: there is no name, account, Steam id, email or IP address anywhere in it, and the id is random. The screen-time batches keep no per-install record at all.

• The feedback box (REPORT A BUG / SUGGEST A FEATURE on the MORE page, or from Settings) sends what you typed, and with it: the game version and whether this is a tester build or a live one, the platform, the language you are reading, which page was open, and a random id for this install. Nothing else, and the box sends nothing until you press SEND.