A prominent review on GOG says that this game includes hardware scanning spyware on S***m apparently. They said they bought it there and then refunded it after reading the EULA.

A google search and you can see the S***m community post referenced. The developer reponse was that "It was always there, the thread is weird, and if you want to refund the game, I'm sure S***m will let you"

Is the same hard-drive scanning code in the GOG release? The store page doesn't mention an EULA but this is not a standard EULA by any stretch.

What, you never heard of the Unity engine having telemetry by default on pretty much all its games?

It's not the question of telemetry, that's been there since day 1. It's more of a question of "owlcat can install third party spyware on your computer and mine your computer through it" (even data not at all related to the game).

Which spyware? I think the point the other poster tried to make is, are you sure that the "spyware" isn't actually just the standard Unity engine telemetry? For the record, I don't know the answer to that question, but it is worth asking before jumping up and down in rage.

Have you ever read a EULA for anything? I challenge you to find a game with a EULA that doesn't have something in it that you can get upset over.

I believe I found the post the OP is referring to, and the developer responded. The EULA is referring to the Unity Analytics that are part of all Unity games and 3rd party plugins. They are not going to come to your house and install 3rd party spyware because you agreed to it in some EULA. It's funny that this started by a Steam user reading the game's EULA and getting upset about the data collection clause, while Steam collects the same data from its users.

Games and other software can put these data collection clauses in EULAs all they want, but they can't collect anything if you block it with a firewall. If you care so much about your privacy and security, you shouldn't have a PC connected to the internet without a two-way firewall. Windows' firewall "out of the box" is not good enough as it only blocks incoming traffic. It can be configured to block outgoing traffic by default, but you'll manually have to add exceptions for things that need internet access.

I don't know if you have a reading comprehension problem but here we go again:

1. This is not about Unity analytics which every Unity game has and which you can opt out.
2. This is about retro-actively changing the EULA after the game was released, specifically to add an option for owlcat to install additional spyware on your computer, again, unrelated to the Unity analytics itself.
3. I have to point this again, to make sure that you understand what the issue is here - it's not about data collection through analytics, that has always been there, and yes, it's everywhere, here, on Steam, everywhere. This is not about that. This is about owlcat specifically enabling themselves to *install* spyware on your computer.

And last but not least, 4) The original review which pointed this out has now been censored by GOG on the store page and is no longer visible.

See the problem here or should we go over it again?

Cat jumped on the keyboard and posted before I was done.

OK, very well, so I uninstalled the game, cleared Documents, made sure there is nothing cached that would display an obsolete EULA somehow.

I bring you the latest owlcat EULA, so let's go over the actual text now (at least the relevant part), please see the screenshot (excuse the poor resolution it's due to GOG's insane 500 KB attachment limit), I quote the most important parts of the section 3.1:

"The User hereby agrees that Owlcat Games may collect, store for an indefinite term and otherwise process anonymous information on the Software..."
-- Notice that the term is indefinite, which is very sketchy, at least under Europe's GDPR.

"...information on hardware and Software, to improve the Software, and for marketing purposes. Thereby, the User hereby agrees that Owlcat Games has the right to upload software program files to User's Device, that will record CPU, RAM, operating system, video card, sound card, software and application of the other developer, peripherals, geolocation and any other anonymous technical and statistical information..."
-- Anything that records your geolocation, all software, all hardware, of all other developers, peripherals, etc., is by definiton NOT anonymous. It in essence means that they can extract software data of anything on your computer, for example, your browser data. So, it's nice that they are specifying "anonymous" but it's a flat-out lie.

And shall we continue?
"...The User also agrees that Owlcat shall have the right to transfer the said anonymous information to its subcontractors, performing game development, and vendors providing services necessary for operation of the Game."
-- This basically enables them to sell your private data to anyone who is in the business of game development and "necessary services" which is such a broad definition that it might very well be anyone. For example, it can be a parent development studio, but it may very well be a marketing agency that will then target-ad you, or re-sell your data further.

So to sum it up, we can pretty much see here that owlcat can install a rootkit not related to the game onto your system, they can extract pretty much any data they want, which is - granted - stated as anonymous (but it's really not) and they can give/sell this data to a quite broad range of "external subcontractors".

Plugins my ass... the only external things the EULA talks about are this, and external game content (which is nothing more than WotC Pathfinder license). There is no mention about any Unity plugins.

Is this sufficient proof to you that people are perhaps not overreacting, or do you want to into more detail? This is what I see when I filter most helpful reviews. Masterinsan0's is not there, and it's not visible under any filter I tried. Maybe it's just a technical issue, or issue on my side, but the most helpful review which pointed out all of this, seems to be gone.

There is still nothing I see that is worse than any other game's EULA. The only thing different is the wording "upload software program files" which could possibly be a translation error since the publishing company is not native English speakers. As for the part after that, again, go read any game EULA and you'll find similar data collection clauses.

Here are three EULAs I pulled from random game's I currently have installed.
---------- ---------- ---------- ----------

Actually I lied, one of these is GOG's EULA. Can you guess which one? Uncheck verified owners. The reviewer does not own the game on GOG. I posted a screenshot of what I see with my filters.

I provided a concrete evidence of the skullduggery owlcat pulled out, and your response is "b-b-b-but others do the same things" (but not really and it's besides the point regardless)...

BTW this is another example of a game EULA (another Unity game) which I suggest you ready very, very carefully, and then compare it to the shitty WotR EULA:
https://store.steampowered.com//eula/1096530_eula_0

So, if you can't see that the examples we both posted are pretty mild compared to WotR's eula, (*cough* actual rootkit installed in addition to the game which can do god knows what *cough*), I guess that further conversation on the topic is pointless.

What concrete evidence of what skullduggery? And yes, that's one of the points I've been trying to get across that you seem to be missing. You people are so upset with this one EULA, but don't have a problem with the other games that have been doing the same thing.

That shows how well you read my post and EULAs, because the first EULA I quoted from is the exact one you linked to. And in case you haven't figured it out, the second one, the one that also collects your IP address, hardware, browser and other software details, etc., is GOG's EULA.

I don't know where you keep coming up with this rootkit nonsense. Nowhere does the EULA give them permission to install a rootkit. Go back and read that part again. As I said, the only odd thing is that phrasing "upload software program files", but the sentence taken in whole is just saying they're going to collect information about the device you're playing the game on. Two of the the EULAs I posted do the same thing, one of those is GOG's, but you don't seem to be outraged about that.

Maybe they should revise the EULA to be more specific and directly state the unity components used. To limit th EULA specificly to those components, specially considering the current climate.

THIS. Basically grab Windows Firewall Control (binisoft) or whatever blocker you choose and block any access to/from the internet for the applications (or by default).

In my case I go even further, I run _ALL_ games inside a VM. Yes, performance is lower but I have 100% control over what that VM has access to and there is zero other data in that VM except for that particular game.

Rather than a VM, why not just create a separate login for gaming? If the gaming login is not an admin account and only has access to gaming data and nothing else on the machine the only "data" that can be transmitted is information about what hardware you use which is basically like the Steam hardware survey so devs can tell what most people can actually run. Or I guess what other games you play. But does that matter?