It get sent to your own private key which everyone else would also have trouble finding. Playxo.com wouldn't get anything out of it, anyone and everyone can have all the private keys of everyone else, playxo's operator or server wouldn't know which private key things are going to, and neither would any other human.
but anyone can do that. you don't need an API to tell you if the address has a balance if you have the private key, you just check your own copy of the blockchain.... just like they are doing...
When you visit a page, they generate all the private keys on the page and check for balances. If you happen upon a key that actually has a balance, they will clean it out before you can.
I kind of doubt it, the browser makes a request to blockchain.info to check the balances. If they wanted to do what you are saying they'd make that request somewhere one the backend.
