Mean.Jim: I see a bunch of people are overreacting about a reviewer's interpretation of something in a EULA. I also have not seen one person post the actual text of the EULA that has their undies in such a wad.
OK, very well, so I uninstalled the game, cleared Documents, made sure there is nothing cached that would display an obsolete EULA somehow.
I bring you the latest owlcat EULA, so let's go over the actual text now (at least the relevant part), please see the screenshot (excuse the poor resolution it's due to GOG's insane 500 KB attachment limit), I quote the most important parts of the section 3.1:
"The User hereby agrees that Owlcat Games may collect, store for an indefinite term and otherwise process anonymous information on the Software..."
-- Notice that the term is indefinite, which is very sketchy, at least under Europe's GDPR.
"...information on hardware and Software, to improve the Software, and for marketing purposes. Thereby, the User hereby agrees that Owlcat Games has the right to upload software program files to User's Device, that will record CPU, RAM, operating system, video card, sound card, software and application of the other developer, peripherals, geolocation and any other anonymous technical and statistical information..."
-- Anything that records your geolocation, all software, all hardware, of all other developers, peripherals, etc., is by definiton NOT anonymous. It in essence means that they can extract software data of anything on your computer, for example, your browser data. So, it's nice that they are specifying "anonymous" but it's a flat-out lie.
And shall we continue?
"...The User also agrees that Owlcat shall have the right to transfer the said anonymous information to its subcontractors, performing game development, and vendors providing services necessary for operation of the Game."
-- This basically enables them to sell your private data to anyone who is in the business of game development and "necessary services" which is such a broad definition that it might very well be anyone. For example, it can be a parent development studio, but it may very well be a marketing agency that will then target-ad you, or re-sell your data further.
So to sum it up, we can pretty much see here that owlcat can install a rootkit not related to the game onto your system, they can extract pretty much any data they want, which is - granted - stated as anonymous (but it's really not) and they can give/sell this data to a quite broad range of "external subcontractors".
Plugins my ass... the only external things the EULA talks about are this, and external game content (which is nothing more than WotC Pathfinder license). There is no mention about any Unity plugins.
Is this sufficient proof to you that people are perhaps not overreacting, or do you want to into more detail?
BlueBangkok: And last but not least, 4) The original review which pointed this out has now been censored by GOG on the store page and is no longer visible.
Mean.Jim: You mean the first review on the store page by masterinsan0 if you sort by most helpful?
This is what I see when I filter most helpful reviews. Masterinsan0's is not there, and it's not visible under any filter I tried. Maybe it's just a technical issue, or issue on my side, but the most helpful review which pointed out all of this, seems to be gone.