Privacy notice

Last updated: 2026-05-03

Owlsignal is operated by Zisomedia (sole proprietorship registered in the Netherlands), trading as Owlsignal. We provide gameplay analytics tooling to game developers ("customers"). This notice covers how we handle data on owlsignal.dev and through the Owlsignal SDKs.

1. Roles under the GDPR

For the players whose anonymous gameplay events flow through Owlsignal, our customers (game studios) are the data controllers — they own the relationship with their players and decide what to measure. Owlsignal (Zisomedia) acts as a data processor on their behalf, governed by the Data Processing Agreement at /dpa.

For our customers themselves (the people who sign in to a dashboard and pay invoices), Owlsignal is the controller. That data is the subject of sections 2–5 below.

2. What we collect

From customers (dashboard users)

• Email, password hash (or Google OAuth identity), and display name.
• Organization name, app names, slugs, API key labels, billing address, VAT number, and Mollie customer ID.
• Standard authentication telemetry from Supabase Auth: timestamps of sign-ins, IP at sign-in time (used for fraud signals only, not retained beyond Supabase's defaults).

From end-users (players in our customers' games)

• An anonymous device identifier (a hash generated client-side; not derived from any persistent OS identifier we ask for).
• Build version, session timestamps, and the events the customer's game emits.
• Optional dimension labels the customer configures (e.g. biome).
• The screen the event happened on — the page path on web (location.pathname, without query strings or hashes), the active scene name in Unity, or the equivalent on iOS/Android. The SDKs auto-attach this so the dashboard can answer "where in the app did this happen?" without per-call instrumentation. Customers can configure a sanitizer to collapse dynamic segments (/users/12345 → /users/[id]) or disable auto-capture entirely; both knobs sit in the SDK Initialize call.

We deliberately do not collect: real names, email addresses, phone numbers, IP addresses (stripped at intake before persistence), precise location, social identifiers, or any value our customers tell us is sensitive. If a customer attempts to send PII as event data — or via the screen path — we treat that as their breach of the DPA, not a feature. As a server-side defence we strip query strings and fragments from the screen value before persistence even when an SDK forgets to.

3. Where data is stored

• Database — Supabase Postgres in eu-central-1 (Frankfurt, Germany). Data at rest stays in the EU.
• Function execution — Vercel functions run in region fra1 (Frankfurt). The Vercel control plane (build logs, observability) runs in the United States; this means request metadata and build artefacts may transit US infrastructure. Vercel signs the EU Standard Contractual Clauses; we accept those terms via Vercel's DPA.
• Email — Brevo (French company, EU-hosted in Paris / AWS Frankfurt). Limited to transactional messages: usage warnings, billing receipts, and any future signup/password-reset flow.
• Payments — Mollie B.V. (Amsterdam, NL, DNB-licensed). Mollie holds payment data; we never see card details.

4. How long we keep it

5. Sub-processors

We use the following processors. Material changes are announced 30 days in advance.

6. Your rights

Under the GDPR you can request access, correction, deletion, portability, or restriction of your personal data, and object to processing. Email privacy@owlsignal.dev from the address on your account; we respond within 30 days.

For end-users in our customers' games: contact the studio directly. They control your data; we process it on their instructions and will assist them with any verified request. The Owlsignal SDK exposes a telemetry opt-out flag — when a player toggles it, the SDK stops sending events to us. We can't detect opt-out server-side because the data is anonymous; that contract is enforced client-side in the game.

7. Security

TLS 1.2+ in transit. Passwords hashed by Supabase Auth (bcrypt with per-row salt). API keys are stored as peppered SHA-256 digests, never in plaintext. Tenant isolation is enforced both at the application layer (every query is tenant-scoped) and at the database layer (Postgres Row-Level Security policies). We will notify affected customers of a confirmed personal-data breach within 72 hours.

8. Contact & complaints

Privacy questions: privacy@owlsignal.dev. If you believe we've mishandled your data and are not satisfied with our response, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.