What it actually does

PlayCounter runs as a Windows desktop application and periodically looks at which processes are running. When it sees an executable filename it recognises as a game, it starts a session and stops it when that process exits.

It does not inject into games, hook rendering, install a driver, or run a kernel component. It is not an overlay, and it does not read game memory. It is closer to Task Manager than to anti-cheat software.

What leaves your PC

  • Executable filenames, for matching. To identify a game, the filename such as example.exe is sent to PlayCounter's API. On Windows the full path is not sent.
  • Cover images. Artwork for recognised games is fetched from IGDB.
  • Update checks. Version checks and downloads use GitHub.
  • Anonymous activity, where applicable. The service supports an anonymous live view of what is being played; this is not tied to an account because there are no accounts.
  • Feedback and community match submissions. These are sent only when you choose to send them.

What stays local: your session history, per-game totals, settings, and any one-time matching choices you make. The privacy notice is the authoritative document.

Why Windows may warn you

SmartScreen shows a warning for installers it has not seen often enough to have built up reputation. This is normal for small independent software and is a statement about download volume, not about the contents of the file. The warning fades as more people install a given release.

Some antivirus engines also flag process-monitoring behaviour heuristically, because watching running processes is a behaviour shared with monitoring tools generally. If you see a heuristic detection, checking the file on a multi-engine scanner usually shows a small number of heuristic hits against a majority of clean results.

How to verify it yourself

  1. Read the source. PlayCounter is MIT-licensed and the desktop client and API source are public on GitHub. Everything above can be checked against the code.
  2. Download from the official source only. Releases are published on GitHub with release notes and checksums. Do not install a build from anywhere else.
  3. Verify the checksum. Compare the hash of your downloaded installer against the published one before running it.
  4. Watch the traffic. If you want to confirm what is sent, a local network monitor will show you the matching requests directly.

Is it a virus, a miner, or spyware?

No, and the way to be confident about that is not our assurance but the open source, the published checksums, and the fact that you can inspect both. Any tracker of this kind sees which programs you run - that is inherent to the job - which is precisely why the reasonable standard is a tool you can verify rather than one you have to trust.