Privacy text to embed

Anyone embedding the counter has to tell their visitors what happens. Here it is – a paragraph to copy, and next to it the entries that belong in a record of processing activities.

The paragraph for your privacy policy

General version. Open this page through your counter's management link and it will carry your counter number and match your settings.

Visitor counter

This website uses the Stats4U visitor counter (stats4u.net, LW IT Solutions Company, Łódź, Poland). When a page is opened, your browser loads a counter image from stats4u.net and, as a technical necessity, transmits its IP address, the browser identification and the address of the page being viewed.

The IP address is used to determine country and city approximately and to build a daily hash, which counts a visitor only once per day – also when reaching a goal that the site operator has defined. It is not stored in the statistics. The daily hash is built with a secret salt that changes every day and is deleted after 2 days; after that it cannot be traced to anyone. The web server's access log holds the IP address for up to 14 days.

The counter sets no cookies and reads nothing from your device. What is stored are daily totals: hits, visitors, country, browser, operating system, language, the pages of this website that were opened and the transitions between them, the domain of the referring page, events and goals defined for this website (per goal the number of visitors who reached it, by country, device, browser, operating system, language, referring domain and entry page), time on page, scroll depth, load time, and the entry and last page of a visit. They are kept for 400 days. Processing takes place in Poland; no data is transferred to third countries. For the duration of a visit there is additionally one row in the live list “who is on the site now”: country, city, the page currently open, browser, operating system, device type and language, plus the domain of the referring page and the entry page. It is deleted at the next nightly clean-up. While the page stays open the counter checks in about once a minute so that this row does not age prematurely; all it sends is the counter number, and nothing additional is stored.

The legal basis is our legitimate interest in audience measurement (Art. 6(1)(f) GDPR).

Stats4U privacy policy: https://www.stats4u.net/privacy

Only if you have added data-screen="1" to your embed code, the counter also reads screen resolution, window width and pixel ratio. Then this sentence belongs in the paragraph as well:

On this website the counter's script also reads three values from your device: the screen resolution, the width of the browser window and the pixel ratio. That is an access to your terminal equipment. Only a count per day is stored, for 400 days, the window width only as one of seven bands.

What the counter collects

This overview is generated from the system configuration and describes the actual state.

Item	Purpose	Stored	Retention
IP address	derive country and city; goes into the daily hash	not in the counting statistics, but in the operations log	14 days in the server and operations log
Daily hash (salted)	count a visitor once per day; accept the report sent on leaving a page only from counted visitors; count a goal reached once per visitor and day	yes, 16 bytes	2 days
Online row of a visit	“online now” display, last page and entry page, characteristics for goals	daily hash with country, city, page last opened, browser, operating system, device, language, referring domain and entry page	until the nightly clean-up, at the latest about 25 hours after the last request
User agent	browser, operating system, bot detection	no, only the result	–
Page URL	most visited pages	yes	400 days
Referrer	where visitors come from	domain only	400 days
Browser language	language breakdown	only the result	400 days
Excluded addresses	leave the owner's own visits uncounted	only on request, in the clear	until withdrawn
Events	count what visitors did (click, form)	only name and count per day; names that look like personal data are rejected	400 days
Goals	count how many visitors reached a goal defined by the operator (event or page), and where they came from	per goal and day the number of visitors and of triggers, and a count per characteristic (country, device, browser, operating system, language, referring domain, entry page)	400 days
Polls	count votes; one vote per visitor, poll and day	per answer and day a count, also per country and device type; the daily hash without the answer	counts until the poll is deleted; daily hash 2 days
Address checksum (salted)	limit abuse: count requests per address and hour (events, time on page, device values, failed password entries and deletion attempts)	yes, with the times of the last hour, in a file	about 2 hours; deleted at the next clean-up
Page transitions	which page follows which (on by default, can be switched off)	only the pairs and their count per day	400 days
Time on page	how long a page was visible	only one of six bands, counted per day	400 days
Scroll depth	how far down the page was visible	only the quarter reached, counted per day	400 days
Last page of a visit	where visitors stop	only the address and its count per day	400 days
Entry page	which page a visit showed first, by source type	only the address and its count per day	400 days
Time on page, per page	which page holds readers	only sum and count per address and day	400 days
Load time	how long the counted page took to load	only one of five bands, counted per day	400 days
Screen resolution	what resolution the screen has	only the value and its count per day	400 days
Window size	how wide the browser window was	only one of seven bands, counted per day	400 days
Device pixels	resolution times pixel ratio	only the value and its count per day	400 days

The daily hash is built from IP, user agent, counter number, date and a secret salt that changes every day and is deleted after 2 days. After that, not even a known IP allows anyone to work out which hash belonged to whom. Because the counter number is part of it, the same visitor on two different sites cannot be recognised as the same person.

Time on page, scroll depth and the last page are measured without any identifier. The counter reads nothing from your device for this: it measures its own running time and the window's scroll position, works out a band and a percentage from them, and sends only those two. The window height stays in the browser for these measurements. Since 16 September 2026, however, the server accepts the report the script sends when you leave the page only if the same browser was counted for this counter on the same day — otherwise programs that merely run the script would distort the figures. To check this, it forms the daily hash as it does when counting and looks it up in the online list, for a visit across midnight also the one from the day before. The result of this check is not stored, and the report is not linked to the hash. The last page of a visit needs no additional collection at all; it falls out of the nightly clean-up of the online list. The entry page likewise falls out along the way: the counting path writes a row anyway, and if it is new, that was the first view of the visit. The load time comes from the measurement the browser made of ITS OWN request to the counted page — not a characteristic of your device. Since 27 August 2026 three items can be added that the counter's script really does read from your device: the screen resolution, the width of the browser window and the pixel ratio. That is an access to your terminal equipment and is not to be confused with the measurements above. Since 11 September 2026 it happens only where the site operator has switched it on — for site owners who want to know which screens they are designing for. Here too only a count per day is stored: resolution and device pixels as a value, the window size only as one of seven bands, because an exact window size would be a means of recognition.

The counter sets no cookies and by default reads nothing from your device. Only where the site operator switches it on does its script read three values: the screen resolution, the width of the browser window and the pixel ratio. On stats4u.net itself a session cookie is set only when you create or change a counter.

E-mail address of the counter owner. Some counters from before 2026 have one on file; anyone entering one in the wizard does so voluntarily. It is used to send the management link to that exact address on request – no other address can be given – and, once confirmed, for a single notice if the counter falls silent and for the letters the owner switches on: the weekly summary, an e-mail on unusual days and a message on reaching a set threshold. Anyone can also subscribe to the weekly summary of a counter; only a confirmed address receives it, and each weekly summary can be unsubscribed with one click. Addresses are stored in plain text, never passed on and never used for advertising. Unconfirmed addresses are deleted after two days at the latest. There is no automatic deletion period for the owner's address; it can be removed at any time in the owner box of your own statistics page, otherwise on request through the support form.

Visits to stats4u.net itself. When a page there is reached from another site or with utm_source in its address, the server keeps the first such source of the day – only the domain or the utm_source value, and the page reached – together with a salted daily hash of IP address and user agent that matches no counter's hash. No cookie is set, and requests recognised as automated are not recorded. This record is deleted after 2 days. When a counter number is taken, where the visitor came from is stored with that number – the referring domain or utm_source value (or the first source of the day), the pages on stats4u.net, the time and when the code was first copied – without IP address or identifier, for as long as the counter exists; for a number with which nothing was ever counted, 400 days. Legal basis: Art. 6(1)(f) GDPR – knowing which ways to the service lead to counters that are actually used.

The home page and the statistics pages serve Google AdSense advertising. The blog serves Google AdSense advertising. A consent layer asks for your agreement first.

The legal basis for counting is the site owner's legitimate interest in audience measurement (Art. 6(1)(f) GDPR).

Whoever embeds the counter on their site is the controller for the data collected there; Stats4U processes it on their behalf.

LW IT Solutions Company Lukas Wójcik
al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland
stats4u@lukaswojcik.com

Details under Art. 28(3) GDPR

Subject matter: Audience measurement for the website on which the counter is embedded.
Duration: For as long as the counter is embedded; after that the retention periods below apply.
Nature and purpose: Collecting, aggregating and displaying access figures.
Type of data: IP address (processed, not stored in the statistics), browser identification, address of the page opened, referrer (domain only), browser language; through the script also events and goals defined for the website, time on page, scroll depth and load time; screen resolution, width of the browser window and pixel ratio only if switched on with data-screen="1".
Data subjects: Visitors to the website on which the counter is embedded.
Place of processing: Poland (EU). No transfer to third countries.
Sub-processors: None for the counting. Country and city are determined on the same server from a local database; no external service is queried.
Retention periods: Daily hash 2 days, web server access log 14 days, daily totals 400 days.
Technical measures: Delivered over HTTPS only. No cookie. The salt of the daily hash changes every day and is deleted after 2 days. The counter number is part of the hash: the same visitor cannot be recognised as the same person across two different websites.
Rights of data subjects: Access and erasure through the support form. After 2 days no attribution is technically possible any more, because the salt has been deleted – not even by the operator.

What is not here

This is not legal advice. The text describes what this service does; whether it is enough for your site depends on your jurisdiction and your lawyer.

A signed data processing agreement is not offered at present. If your supervisory authority or your employer requires one, this counter is currently not the right choice for you – saying so plainly is more honest than handing you a paper nobody has signed.