Two scripts the host was inserting are off, and the only analytics is the host's own count.
Cloudflare had been inserting its Web Analytics beacon and a bot-detection script into every page of this site. The content security policy blocked both, so nothing left any browser, but the page as served carried them. Both are off, and the managed robots.txt with them. What we read is Cloudflare's aggregate traffic count, and the privacy page says so.
Our own check missed it because it fetched the site the way a script does, and the host inserts only for browsers. It now fetches as a browser, fails on any script the build did not write, and reads robots.txt back byte for byte. On analytics the options were the host's aggregate count, counting page views ourselves, or a script in the page. The first changes nothing about what a visitor's browser does and nothing about what is recorded per visit, so the privacy page changed by one sentence.