Privacy

How Tombstack handles the telemetry your game sends. This describes the data the platform processes; each studio is the controller of its own players' data.

Tombstack is operated by AnkleBreaker Consulting (SAS, RCS Versailles 912 705 860, 34 rue du Président Wilson, 78230 Le Pecq, France), which acts as data processor on each studio's behalf. The studio is the data controller for its players' data.

What we collect

• Crash metadata: timestamp, build version, OS/arch, a stack signature + stack trace, and a coarse stack hint.
• Optional identifiers you choose to send: a userId and/or Steam64 id, used for affected-user counts and per-player drill-down.
• A device-derived player id, generated by default. When your game has not called SetUser, the SDK derives a stable id as SHA-256(your ingest salt + device id) so crashes from one player group together instead of appearing as unrelated one-off events. It is a salted hash — we never receive or store the raw device identifier — but it is a persistent identifier and therefore personal data, so we list it rather than describing our identifiers as opt-in only. Consent gating is available (RequireConsent in the SDK config) and is off by default; turn it on and nothing is sent until your game calls SetConsent(true).
• Optional minidumps and bug-report screenshots, stored as opaque blobs.
• Breadcrumbs: the most recent log lines (the game's own Debug.Log/warning/error output) captured just before a crash or bug report, to show what led up to it. The SDK keeps only the last 50; their contents are whatever your game logs — avoid logging personal data.
• Session heartbeats (a random session id) to compute concurrency and crash rate.
• Server-triggered log retrieval: for support and incident investigation a studio may request a player's session log from a game server. Retrieval is consent-gated — a log is never pulled from a player who has not granted telemetry consent — retention-TTL'd like other telemetry (your studio's 30–90 day window), and removed by a data-erasure request.

Sub-processors

We use a small number of third parties to run the platform — AWS for hosting, Stripe for payments, and (only if you use the optional AI assistant) Anthropic. Each one, what it receives, and where it is located is listed on the sub-processors page. Ask us for a signed data-processing agreement at any time.

Where & how long

• Telemetry is stored and processed in the EU (AWS eu-west-3, Paris) and is not replicated outside the EU. One exception, stated plainly: if a studio member uses the optional in-dashboard AI assistant, the crash context for that question (stack trace, breadcrumbs, and any identifier already on the crash) is sent to Anthropic in the United States under Standard Contractual Clauses. Ingestion, the dashboard, alerting and the API never do this, and we will disable the assistant for your studio on request.
• Raw crash/telemetry rows and blobs expire automatically — after 30 days on the free tier, and after the window your studio selects (30–90 days) on a paid plan.
• Minidumps can contain process memory — capture is consent-aware and can be disabled in the SDK.

Your rights (GDPR / RGPD)

• Under the GDPR you (or a player, via the controlling studio) may exercise rights of access, rectification, erasure, restriction, portability, and objection.
• A studio can erase all telemetry for a given userId (crashes, bug reports, breadcrumbs, heartbeats, and the associated S3 blobs — minidumps and screenshots) from its game dashboard at any time.
• A player id does appear in the path of the private dashboard URL for that player's profile (for example /games/…/sessions/<playerId>), because that page is addressable and shareable inside your studio. Those routes require an authenticated session, and the pages are served no-store, so they are not cached or indexed — but the id is in the URL, and an earlier version of this page wrongly said identifiers never are. Ingestion endpoints take identifiers in the request body, never the query string, so they do not reach access logs. Secrets live in encrypted infrastructure config, never in the client or repo.
• To exercise a right or raise a complaint, contact us below; you may also lodge a complaint with the French supervisory authority (CNIL).

Questions: contact@anklebreaker-studio.com · See also Terms and Mentions légales.