Política de Privacidade

Updated 25 September 2026. First-party measurement disclosure (English).

Cookie-less first-party page measurement

We run our own measurement at /__h to understand which pages work and to distinguish people from automated traffic. It uses no cookies, no third-party analytics, and no advertising identifiers. We do not sell or share the records from this measurement. The service is operated by the site owner; records and daily token secrets are separate for each site. Other existing services are described separately below.

What your browser sends

When a page opens or its path changes without a full reload, your browser sends the page path without its query string or fragment; the referring site domain only, or the previous page path if it was on this site; a random page number kept in memory; and a random tab session number. It also sends the primary language code (two or three letters), how many languages are configured (0, 1 or 2+), the time zone offset rounded to the hour, colour-scheme setting, pointer type, and whether the browser reports automation.

Screen information is sent as coarse classes, never exact screen dimensions: viewport-width lower bounds of 0, 1, 360, 480, 768, 1024, 1440 or 1920 pixels, and pixel-density classes of 0, 1, 1.5, 2 or 3. The browser sends yes/no flags for whether its window fits the screen and has normal browser chrome, whether local storage could be written, whether the page was prerendered or restored from the back-forward cache, plus a reserved status field fixed at zero; this generic client does not detect 404 pages. It sends whether the page opened in the foreground and whether navigation was a normal load, reload, back/forward action or prerender. Changes limited to the URL query string or fragment do not start a new page-view record.

When the page is hidden, you leave, or the page path changes, it sends total time open and time in the foreground (whole seconds); delay before the first input (milliseconds, or no input); first input kind (mouse, touch, pen, keyboard, wheel or scroll); input and script-error counts; and whether a frame was painted or the window resized. Scrolling is grouped into no scroll, 0%, 25%, 50%, 75% or 100%; page length into 1, 2, 3 or 6+ screens; mouse movement into 0, 1–2, 3–9, 10–49 or 50+ events; and touch movement into 0, 1–4 or 5+ events. Input, click and error counts and timings are transmitted without caps. The server caps those stored counts at 99 and stored timings at one hour.

Click counts describe kinds of controls only: navigation (nav), breadcrumbs (crumb), footer (foot), downloads (dl), copy controls (copy), controls with play or preview labels or classes (play, best-effort), other same-site links (int) and external links (ext). We do not send clicked link destinations, copied text, audio content, typed text or mouse coordinates. Leaving records include the page path, page and session numbers and a sequence number (up to 10 per page view), so reports use the latest summary for each page view; earlier raw summaries remain until pruning.

How visits are counted

The server makes a daily token from your IP address and browser user-agent string with a random secret unique to this site. The secret changes every UTC day and the old one is discarded. Raw IP addresses and raw user-agent strings are not stored with page views; the token cannot be recomputed after the daily secret is discarded. A second daily token uses only the network part of the IP address (the first two IPv4 blocks or first two IPv6 blocks) to help detect automated fleets. The server also records browser and operating-system families, automated-browser flags, whether browser client hints agree with the browser string, and whether the address matches a known hosting network. Cloudflare provides the request country; only its two-letter country code is kept. Request times are recorded on the server.

Returning visits and browser storage

localStorage holds hh:fs:v1: the first visit date, last visit date and number of distinct visit days, capped at 21. Only ranges leave your browser: days since the first visit (0, 1, 2–6, 7–13, 14–29 or 30+), visit days (1, 2, 3–5, 6–20 or 21+), and days since the previous visit (first visit, same day, 1, 2–6 or 7+). The dates themselves are not sent. The record is replaced on the first visit more than 180 days after its first visit date. sessionStorage holds hh:sid, the random number used for that tab session, normally removed when the tab session ends. A separate random page number stays only in page memory. Clearing site data removes these records.

Global Privacy Control and Do Not Track

This first-party measurement honours Global Privacy Control (GPC) and Do Not Track (DNT). When your browser exposes either opt-out setting, it sends only an empty request and writes neither measurement storage record. The server stores no page-view row or visitor token and adds only a number to an opted-out-request counter, grouped by reason only; browser families are not recorded for opted-out requests. If an extension adds only the opt-out HTTP header without exposing the browser setting, local storage may still be written, but the server still discards the page-view data. These promises apply to /__h; the existing services described below have separate behaviour.

Retention

Raw first-party measurement rows are kept for up to 13 months. Daily totals, such as numbers of visitors and pages, contain no individual visit records and are kept indefinitely.

Standard server logs and abuse prevention

Standard server access logs contain IP addresses, browser strings, requested URLs and times and are kept for 14 days for abuse prevention. A separate content-free /api/track/view request is used by the shared scraper detector on sites where it is enabled; it appears in those logs and does not carry the measurement fields above. This separate beacon is not currently enabled on FreeGameSprites. If enabled here, its request will use the same 14-day abuse-log retention.

Existing Google Analytics

FreeGameSprites also uses Google Analytics (GA4), which separately receives usage information such as page views, referral sources, device information, searches and download events. Google Analytics may use cookies and processes that information under Google privacy terms. The cookie-less storage, opt-out and retention promises above describe our first-party service, not Google Analytics. Our first-party measurement records are not sent to Google.