Open. Run. Understand.

Your code stays out of usage statistics.

The official webMARS installation automatically collects statistics about visits and product features. This privacy area explains what is sent and retained.

Open webMARS View the source →

Free and open source · Local work without an account

Automatic session heartbeat

On the official installation, a heartbeat event sends cumulative visible seconds every 60 seconds while the app is visible, including when another tab or window has focus. It uses the same temporary page-session token as the other statistical events. The token is kept in sessionStorage when available and otherwise in memory; it uses no account ID, email, cookie or persistent visitor ID. Sessions seen within the last five minutes estimate presence, not people, and can under-count suspended or offline browsers. Network transport still exposes an IP address to the host.

What the statistics contain

A random temporary visit token, page category, compiler/assembler/execution outcomes, shipped tool identifiers, use of stepping, projects, Cloud and help, built-in lesson numbers, approximate active seconds, interface language, touch/pointer input category and a broad acquisition category. No source code, inputs, output, project names, account IDs, emails, full URLs or raw referrers are included.

Automatic collection and browser storage

Statistics are sent automatically, independently of interface settings, Do Not Track, Global Privacy Control or an earlier statistics choice. There is no statistics checkbox or acceptance dialog. A token in sessionStorage groups events in this tab and expires after 30 minutes without measured activity. A local last-visit timestamp supplies a coarse return category. If storage is unavailable, events use a memory-only token; reloads then create new visits and returns cannot be measured. There is no persistent visitor ID. Network or browser blocking can still prevent delivery.

Time and retention

Interaction time requires a visible, focused page with interaction in the last minute; it is sampled every five seconds and sent roughly every 30 active seconds. Presence heartbeats have the separate timing rules below. The collector retains statistics for 35 days. Counts describe measured visits and feature adoption, not unique people, exact attention or verified learning outcomes. Temporary session tokens allow events to be linked within a visit; calling them statistics does not remove that linkage.

Server logs and Cloud are separate

The host receives your IP address to serve requests. The supplied metrics endpoint does not store it, cookies or raw browser headers. Ordinary access logs may contain IP addresses and browser information; the documented Raspberry Pi logging policy retains those logs for up to 370 days. Cloud sign-in, synchronization and publication are optional and transmit the data required for those operations to the configured BackMars server.

What the operator can analyse

Daily visits, acquisition, languages and devices, feature adoption and observed duration distributions. Different tabs and cleared storage can count the same person more than once. Historical periods used different collection rules; enabling broader collection can increase counts without proving audience growth.

Public statistics

Help → Usage statistics displays aggregate charts for the last 60 minutes, 24 hours and 30 days. The public endpoint contains counts and coarse categories only: no session tokens, individual event records, account identifiers or IP addresses. Small counts do not prove the number of people. Interaction and visible-presence durations use different rules and are shown separately.

Traffic classification

Events include a public/internal/test context, a coarse automation flag and whether trusted pointer/key input was observed. These signals give probable classes, not proof of a human. Help/About privacy lets the operator mark this browser as internal usage; collection continues in its own category. A first-party webmars_visit cookie lasting 30 minutes links web navigation logs with app events. A separate local/context marker remembers internal use; neither marker is an account identifier. Historical and unmarked operator traffic remains unclassified.

Optional social sign-in and account activity

When configured, Google sign-in requests only an account identifier and email. Facebook sign-in retrieves only its account identifier and email; its basic public-profile permission is inherent in Facebook Login. Provider tokens are not stored. Existing accounts must be authenticated before linking another sign-in method. BackMars stores the provider/account mapping for login and keeps private account activity for 35 days to count distinct active accounts. Public reports contain only aggregate account actions and counts, never account IDs, provider IDs or emails. Those account records are separate from browser statistics.

Contact and account data deletion

The operator of the official installation is Nelson Ferreira. To request deletion of your Cloud account and associated private data, email nels.ferreira@sapo.pt from the address associated with your account, identifying the installation and username. Never send your password, authorization tokens or verification codes. The operator verifies account ownership before processing the request and clarifies its scope, including any public publications or revisions. Account deletion is handled by the operator; there is no automatic deletion endpoint. Other self-hosted installations have their own operator and contact.