Overview
Who came, where from, and what they did.
Per feature
Every run is written before the work and resolved after, so a run that never finished is visible as abandoned rather than missing. Copied matters as much as finished: for anything that produces text, the copy is the completion event.
What they typed, and what they got
The most recent runs of the feature selected above. Logging the input without the outcome cannot answer the only question worth asking of it.
Open errors
One row per distinct error, keyed by a fingerprint of source, normalised message and path — repeats increment a counter. The same bug with a different id stays one row.
Accounts seen
Every action one account has taken — for support, and for understanding why an account went quiet. Pre-signup browsing is included, because the visitor cookie survives the sign-up.
Google Analytics 4
The third-party view, for cross-checking. Configure the property under Connections. In the UK and EEA it only counts visitors who allowed analytics, like our own identified figures.
New vs returning
Which mode players choose
Most-started lessons
All events
New post
Publish to Discord and/or your Facebook Page. Leave the schedule empty to post immediately.
Post history
Audit log
Discord —
Discord → Server Settings → Integrations → Webhooks → New Webhook → copy the URL. Saved encrypted; it is never shown again. Analytics alerts can be posted here too (Analytics settings).
Facebook Page —
Needs a Page Access Token with pages_manage_posts. Meta App Review is
required before it works on a live Page.
Google Analytics —
Paste the service-account JSON key and your GA4 property ID (a number, not
G-…). Grant that service-account email Viewer on the GA property, and enable the
Google Analytics Data API in the Cloud project.
Change password
Minimum 12 characters. Stored as a salted scrypt hash — never in plain text.
Keep your own visits out of the numbers
Open the link below once in each browser you use. It sets a long-lived opt-out cookie on
xiangqimaster.com, so your own browsing never pollutes the figures on this page.
What is recorded, and for how long
Page views, scroll depth, active time, clicks, form touches, actions with their outcomes, browser-only events, and — with consent — session recordings; all first-party, in our own files, with no third-party analytics service involved. Visitors are identified by a signed cookie for attribution only; the client IP is used for rate limits only, read from exactly one header, and stored only as a keyed hash. Do Not Track and Global Privacy Control switch tracking off entirely. Visitors in the UK and EEA are asked first; without consent their pages count in aggregate with no identifier. Recordings mask every input and are deleted after the replay retention window; every other row goes with its day's file after the general retention window.
How this panel is protected
Sessions are server-side with an HttpOnly · Secure · SameSite=Strict cookie, expiring after 8 hours (1 hour idle). Every change requires a CSRF token. Logins are rate limited with a 15-minute lockout after 5 failures. All credentials are AES-256-GCM encrypted at rest with a key held only in the service environment, and are never sent back to this page. Session recordings are shown inside a fully sandboxed frame with scripts disabled. The service listens on localhost only — the public edge is nginx over HTTPS.