Rocket Reversi: Privacy-Preserving Attribution End-to-End

Rocket Reversi is live, and we proved something that usually requires third-party cookies, tracking pixels, and walled-garden APIs: you can measure where players come from without tracking people.

The experiment

• Budget: $100 UTM campaign
• Stack: Umami self-hosted analytics, rotating session tokens, no cross-site identifiers, no ads SDK
• Goal: prove we could detect channel contribution end-to-end while keeping the implementation privacy-preserving

What we built

Instead of persistent identifiers or fingerprinting, Rocket Reversi uses short-lived session tokens tied to a single visit. The flow:

1. User arrives via a tracked link (utm_source, utm_medium, utm_campaign)
2. Session token is created server-side and stored in a partitioned cookie scope
3. Game events emit Umami custom events with the session token, not a user ID
4. Attribution reports match sessions to campaigns without reconstructing identity

This keeps the data useful for growth decisions while avoiding the surveillance model typical of ad attribution.

Results

• Captured full click-to-play attribution in Umami
• Correlated campaign traffic with auth_signup_success and game_start events
• Zero PII in analytics exports; export schema is auditable

Why this matters

The industry is moving back toward privacy-first analytics and static-site hosting. If you want to prove ROI on a small marketing budget without depending on Google Analytics, ad pixels, or cloud ad platforms, this case study gives you a runnable blueprint.

Try it yourself

The implementation is open source in attribution-mcp. If you want the Umami MCP + UTM session-token pattern for your own project, start there.

If you want to see more privacy-first infrastructure for indie studios, follow along or reach out. This repo will keep publishing what we learn.