Lesson 213: Privacy-Safe Telemetry Session Receipt Without PII (2026)

Direct answer: Wire game_session_started (or your first session event) with properties build_label and surface only—then file telemetry_session_receipt_v1.json on BUILD_RECEIPT so facilitators can prove which depot players ran without collecting PII. Continues Lesson 212 save slot labels; pairs the PostHog beginner pipeline (evening wire-up) with live-ops receipt discipline.

Why this matters now (July 2026 privacy audits)

July 2026 teams enable analytics the same week they promote fest_public builds. GDPR second-wave audits and Google Play Data Safety reviews ask what you collect—not whether PostHog is “anonymous enough” by marketing copy. Common failures:

1. Steam ID in event properties — links playtest and fest sessions to accounts (PII when joined).
2. IP retention — PostHog geolocation on by default ($ip: null required).
3. No surface dimension — dashboards cannot separate playtest_invite from fest_public after Lesson 211 isolation.

This lesson is the course milestone for telemetry_session_receipt_v1.json—not a repeat of the ninety-minute blog tutorial.

Beginner path (35-minute receipt pass)

Time: ~35 minutes after PostHog project exists; 50 minutes first self-hosted vs cloud decision.

Developer path (gates T1–T6)

Allowed session event schema

Event name: game_session_started (or one agreed name—do not fork per engineer).

Allowed properties:

Forbidden on session events: steam_id, discord_id, email, player_name, country_code from IP, hardware_id, free-text chat.

Godot 4.5 capture snippet (reference)

func _emit_session_started(surface: String) -> void:
    Telemetry.capture("game_session_started", {
        "build_label": ProjectSettings.get_setting("application/config/version"),
        "surface": surface,
        "session_index": _session_index
    }, ip_null := true)

Unity: same properties on TelemetryClient.Capture; set PostHog $ip null per blog Recipe A.

telemetry_session_receipt_v1.json

{
  "schema": "telemetry_session_receipt_v1",
  "build_label": "fest-demo-2026-10-rc1",
  "analytics_backend": "posthog_cloud_eu",
  "session_event_name": "game_session_started",
  "allowed_properties": ["build_label", "surface", "session_index"],
  "pii_denylist_enforced": true,
  "ip_collection_disabled": true,
  "opt_in_pattern": "region_aware_default",
  "privacy_posture_path": "release-evidence/privacy.md",
  "paired_receipts": {
    "save_slot_label": "release-evidence/saves/SAVE_SLOT_LABEL_RECEIPT.json",
    "facilitator_contract": "release-evidence/facilitator/FACILITATOR_CONTRACT_RECEIPT.json"
  },
  "gates": {
    "T1_build_label_on_session": "pass",
    "T2_surface_dimension": "pass",
    "T3_pii_denylist": "pass",
    "T4_ip_null": "pass",
    "T5_opt_in_documented": "pass",
    "T6_receipt": "pass"
  },
  "live_events_proof_capture_id": "posthog-live-2026-05-25-abc",
  "promotion_allowed": true
}

Pin under release-evidence/telemetry/TELEMETRY_SESSION_RECEIPT.json.

BUILD_RECEIPT columns

Thursday row review — add Telemetry row: denylist + Live Events screenshot ID.

Proof table (session audit)

Key takeaways

1. build_label + surface are the minimum viable session dimensions for multi-channel fest ops.
2. Receipt proves schema, not that you “use PostHog”—Live Events ID is evidence.
3. Denylist is code-enforced—review event JSON in CI, not honor system.
4. Lesson 212 saves and Lesson 213 telemetry are independent trust lanes—both belong on BUILD_RECEIPT.
5. Crash correlation (214) and refund dashboard (215) assume T1–T2 are already GREEN.
6. Pair playtest isolation runbooks for scope vocabulary.
7. AI dialogue moderation (216) must not log player prompts in telemetry—keep NPC patches out of analytics.
8. Blog pipeline teaches wire-up; this lesson teaches promotion gate.

Prerequisites

• Lesson 212 — save slot label receipt
• Privacy-safe PostHog beginner pipeline
• Lesson 206 — facilitator contract (surface vocabulary)
• BUILD_RECEIPT beginner pipeline

Common mistakes

• Logging steam_id “for debugging.”
• Using distinct_id = Steam account hash.
• Skipping surface because “we only have one build.”
• Shipping telemetry before privacy.md exists.
• Mixing chat moderation logs into PostHog.

Troubleshooting

Mini exercise (50 minutes)

1. Add denylist unit test rejecting steam_id property.
2. Emit session on playtest build; verify surface in Live Events.
3. Repeat on fest build; distinct build_label.
4. File receipt; screenshot Live Events UUID into live_events_proof_capture_id.
5. Update BUILD_RECEIPT row before Wednesday smoke.

Next: Lesson 214 — crash symbolicate + build_label correlation.

Continuity — H1 2026 arc (212–217)

FAQ

Replace the PostHog blog tutorial?
No—blog is wire-up; this lesson is BUILD_RECEIPT gate for fest promotion.

Can we add level_id later?
Yes—extend allowlist in receipt semver bump; session event stays minimal until T6 passes.

Self-hosted PostHog?
Set analytics_backend accordingly; T3–T4 rules unchanged.

Web HTML5 itch build?
Same build_label + surface; use anonymous distinct_id per blog—never itch username. For Construct GA4 funnel events, pair playtest analytics preflight with Lesson 241 construct playtest analytics receipt.

Prove session telemetry with build_label and surface only—or pause fest analytics until privacy auditors see the receipt.