Privacy Policy

The data controller responsible for personal data described in this policy is StoneForge Labs, s.r.o., a limited liability company incorporated in the Czech Republic (Company ID (IČO) 24546844, VAT ID CZ24546844) (the "Company"), the operator of the Forge Logger service available at forgelogger.dev and app.forgelogger.dev.

Registered address: Nové sady 988/2, 602 00 Brno, Czech Republic. For any privacy-related request you can reach us at support@forgelogger.dev.

Forge Logger is a business-to-business platform. The way we act under the GDPR depends on the data in question:

• As a controller — for the personal data of our customers and their team members: account details, authentication, billing, and how you use the dashboard.
• As a processor — for the telemetry, logs, crash data, and bug reports that you (our customer) send into Forge Logger from your games and applications. You decide what that data contains and remain its controller; we process it on your behalf under your instructions.

If you are an end-user of a game or application that uses Forge Logger and have questions about data collected through it, please contact the developer or studio operating that product. Players answering a feedback form will find the details in section 3.

Game developers who use Forge Logger can publish feedback forms — at forgelogger.dev/f/… or opened from inside their game — to ask players what they think of a demo or a game. If you answer such a form:

• Who is responsible.The game's developer is the controller of your answers and of any contact you choose to share; their privacy policy is linked on the form. Forge Logger stores and processes this data on the developer's behalf, as their processor.
• What is collected.Your answers; the language of the page; the link you came through and its campaign tags; and, if you opened the form from the game, an identifier of your game session and build, so the developer can relate your answers to how the game ran. Only if you tick a separate, unticked box: an e-mail address or Steam profile to share with the developer, and an entry into the developer's raffle. We never ask for your Steam nickname. When you give a consent, we record when, the exact wording you saw, its language and the developer's privacy policy it referred to.
• How contacts are protected.A shared contact is stored only encrypted (envelope encryption backed by Google Cloud KMS), together with a keyed fingerprint used to spot duplicate raffle entries and to find your answers when you ask. It is never shown in the dashboard; the developer's owners and editors can export it, and every export is logged.
• Spam protection. Forms are protected by Cloudflare Turnstile and by rate limits based on your IP address. Your IP address is not stored with your answers; to count visits once per day we keep a keyed hash of it for at most two days.
• How long. A contact is deleted automatically after the developer closes the form — 90 days by default, or the period the developer chose (1–365 days; the form tells you the number) — at the latest 30 days after a raffle draw, and in any case no later than 12 months after you sent it. Your answers stay with the developer without the contact until they delete them or their project.
• AI summary.If the developer's plan includes it, your written answers (not the other questions, never your contact or the fields around it) are sent to our AI sub-processor Anthropic to group all players' answers into themes with a few short quotes for the developer. E-mail addresses, phone numbers, Steam profile links and similar contact details inside the text are masked before it leaves Forge Logger. If the developer deletes your response, its quotes are removed from the summary.
• Games for children. Forms of games marked as made for children never ask for a contact or a raffle entry, are addressed to parents and guardians, and their answers are never sent to an AI sub-processor.
• Your rights. To see, correct or delete your data, or to withdraw a consent, contact the developer (their privacy policy on the form says how). They can find your responses by the contact you shared, give you a copy, and delete the contact or the whole response in their dashboard. If you cannot reach the developer, write to us at support@forgelogger.dev with the link of the form and we will pass your request on.

We collect and process the following categories of personal data:

• Account data — name, email address, and authentication details. If you sign in with Google, we receive your basic profile information (name, email, and your unique Google account identifier) via the openid, email, and profile scopes. We never request access to your Gmail, Drive, or other Google data.
• Billing data — subscription tier, plan status, and billing identifiers. Card and payment details are handled directly by our payment processor (Stripe) and are not stored on our servers.
• Ingested project data — the events, sessions, builds, logs, attachments, and bug reports your applications send to us. This data is controlled by you and may contain personal data of your end-users if you choose to include it.
• Feedback form data — answers, optional contacts and consent records of players who fill in your feedback forms (see section 3). You control it; we process it for you.
• Usage and technical data — IP address, browser/device information, and log data generated when you use the service, used for security, rate-limiting, and diagnostics.

We process personal data for the following purposes and legal bases:

• To provide the service (performance of a contract) — creating and managing your account, ingesting and displaying your project data, and operating dashboard features.
• To process payments (performance of a contract) — managing subscriptions and invoicing via Stripe.
• To secure and improve the service (legitimate interests) — preventing abuse, rate-limiting, debugging, and improving reliability.
• To communicate with you (legitimate interests / contract) — sending service, security, and account-related emails.
• To comply with the law (legal obligation) — meeting tax, accounting, and other legal requirements.

Some optional features use AI models to summarise bug reports, detect likely duplicate issues and summarise the written answers of feedback forms (see section 3; never for games for children). When enabled for your project, relevant report content or players' written answers — with contact details masked — may be sent to our AI sub-processors (see below) to generate these summaries and similarity embeddings. These features can be controlled at the project level, and the underlying providers do not use your data to train their models under our agreements with them.

We rely on a small number of trusted service providers to operate Forge Logger. Each processes data only as needed to provide their service to us:

• Google Cloud Platform — hosting, database, file storage, and encryption key management (EU/US).
• Stripe — payment processing and subscription billing.
• Anthropic and OpenAI — AI-assisted summarisation and duplicate detection (only when those features are enabled).
• Resend — delivery of transactional and account emails.
• Cloudflare — Turnstile bot protection on sign-up and on public feedback forms.

Some of our sub-processors may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to ensure your data remains protected.

We keep account and billing data for as long as your account is active and as required to meet our legal obligations. Ingested project data is retained according to your plan and configuration, and is deleted when you delete it or close your account, subject to short-term backup retention. Contacts shared through feedback forms have their own, shorter limits (section 3). You can request deletion of your account and associated data at any time.

We protect your data with industry-standard measures, including encryption in transit (TLS) and encryption at rest. Sensitive secrets such as integration credentials are encrypted using envelope encryption backed by Google Cloud KMS. Access to production systems is restricted and audited.

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• lodge a complaint with a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

To exercise any of these rights, email us at support@forgelogger.dev. We will respond within the timeframes required by law.

Forge Logger uses strictly necessary browser storage (such as authentication tokens and your theme preference) to keep you signed in and deliver the service. We do not use third-party advertising or cross-site tracking cookies.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email or within the application.

If you have any questions about this Privacy Policy or how we handle your data, contact us at support@forgelogger.dev.