This website update brings referral sources, game starts and estimated active play time into a report protected by the owner’s login. Public totals and private owner detail serve different purposes.
Show what the numbers mean.
Browser sessions are not identified people. Referral information keeps a source domain and short campaign tags when available. Complete referral URLs are discarded; available source information depends on what the browser supplies.
Game-start totals count at most one starting browser session per game per day. Active play time is estimated from foreground, focused play with game input during the last minute, reported in intervals capped at fifteen seconds. The server limits overlapping reports for the same cookie and game. Different games have separate engagement counters.
The HTML games expose running, paused and menu states. The restored Flash games expose fewer internal states, so their time is a player-engagement estimate. These measurements do not establish attention, a completed level or a finished game.
Keep automation in view.
Known-bot signals, explicitly declared automation, likely-human activity and unverified activity have separate categories. User-agent heuristics and interaction signals can be wrong; the human estimate is not a verified count of people. Coverage depends on traffic reaching the analytics endpoint. Signed-in owner visits and marked QA runs are excluded from normal measurements.
Keep the report private.
The owner signs in to see the detailed report. This analytics feature has no player-identity fields and stores no raw IP addresses, raw user-agent strings or complete referral or page URLs. It uses bounded source and campaign values, aggregate totals and anonymous counting digests. It does not infer visitors’ locations.
New analytics totals retain ninety days; their anonymous deduplication data retain thirty days. The existing public daily-session chart keeps its separate 365-day history. Earlier visits are not retrospectively assigned a bot, source or play-time classification.
Recordings still download to the player’s own device. The analytics do not send clips, microphone recordings or gameplay screenshots to the report. The privacy page explains the collection rules. Standard access logs kept separately by the web host are outside this feature.
What the review establishes.
Automated checks: 116 analytics backend, API and concurrency checks passed; 79 legacy counter checks passed; 37 owner-authentication and 39 throttle checks passed; 47 browser-module tests passed.
Native browser review: local browser review used the actual unchanged five game packages and a disposable loopback owner profile; all five emitted start and engagement signals, and 3D pause and navigation held active time still; local owner sign-in, five game rows, the date filter and aggregate-only JSON download were checked; signed-in owner gameplay and the read-only footer left the counters unchanged.
Test traffic is separate from production measurements. Production credentials are chosen separately by the owner. No private report counts or credentials are published here, and no physical mobile or controller test is claimed.