Abstract: User events of a platform are processed to extract aggregate information about users of the platform at an event processing system. A query relating to the user events is received at the system and at least one query parameter is determined from the query. Various privacy controls are disclosed for ensuring that any information released in response to the query cannot be used to identify users individually or to infer information about individual users.

Abstract: User events of a platform are processed to extract aggregate information about users of the platform at an event processing system. A query relating to the user events is received at the system and at least one query parameter is determined from the query. Various privacy controls are disclosed for ensuring that any information released in response to the query cannot be used to identify users individually or to infer information about individual users.

Abstract: User events of a platform are processed to extract aggregate information about users of the platform at an event processing system. A query relating to the user events is received at the system and at least one query parameter is determined from the query. Various privacy controls are disclosed for ensuring that any information released in response to the query cannot be used to identify users individually or to infer information about individual users.

Abstract: A system for processing user events from a platform having a plurality of users comprises: an input configured to receive user events of the platform, each of which is associated with an identifier of one of users of the platform; a plurality of event processors for processing the user events; an event allocator configured to allocate the user events to the event processors based on the user identifiers associated with the events; and a total count generator. Each of the user events is assigned to one of the event processors, and the event allocator is configured to allocate all of the user events associated with that user identifier to that same event processor. Each of the event processors is configured to generate, from the user events allocated to it, a local user count indicating a number of unique user identifiers associated with those user events.