This document is maintained in German, English and Polish. You are reading the English version, which is also the governing version for all other languages.
This policy sets out what data is processed when counting and when visiting these pages, on what basis, and for how long.
In short
The counter sets no cookies and reads nothing from your device. The IP address is not stored in the statistics; it feeds into a salted daily hash whose salt is deleted after 2 days.
No advertising profiles are built, and no raw data is sold or passed to third parties. Because the counter number feeds into the hash, the same visitor cannot be recognised as the same person across two different sites.
The overview further down is generated from the system configuration, not maintained by hand. It therefore describes the actual state rather than the intention.
1. Controller
The controller within the meaning of Art. 4(7) GDPR for the processing on the pages of www.stats4u.net is:
LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, NIP: PL7252266190, REGON: 369859995. E-mail: stats4u@lukaswojcik.com. Further particulars are in the imprint.
No data protection officer has been appointed; there is no obligation to do so under Art. 37 GDPR. Please address enquiries to the above or use the enquiry form available on every page.
2. Two processes that must be kept apart
This policy concerns two different things, and responsibility for them is not the same.
2.1 The counter on someone else's site. Where a webmaster embeds the counter on their site, they are the controller for the data collected there. They decide whether and how counting takes place, and they must inform their visitors about it. Stats4U processes that data solely on their behalf and is a processor under Art. 28 GDPR. The details are in the data processing agreement.
2.2 Visiting www.stats4u.net itself. For everything that happens on these pages — calling up the home page, creating a counter, viewing a statistics page, the enquiry form — the operator named under 1 is itself the controller. That is covered under 5.
If you arrived here because you saw a counter image on someone else's site: sections 3 and 4 concern you. The operator of that site is your point of contact; they can instruct us to erase your data.
3. What the counter collects
計測時に集めているもの
この一覧はシステムの設定から生成され、実際の状態を示しています。
| 項目 | 目的 | 保存 | 保存期間 |
|---|---|---|---|
| IPアドレス | 国と都市の判定に使用。日次ハッシュに入る | 統計には保存しませんが、運用ログには保存します | サーバーログと運用ログに各14日 |
| 日次ハッシュ（ソルトあり） | 訪問者を一日一回だけ数える | はい、16バイト | 2日 |
| User-Agent | ブラウザー、OS、ボット判定 | いいえ、結果のみ | – |
| ページのアドレス | よく見られたページ | はい | 400日 |
| 参照元 | 訪問者がどこから来たか | ドメインのみ | 400日 |
| ブラウザーの言語 | 言語の内訳 | 結果のみ | 400日 |
| 除外アドレス | 運営者自身の訪問を数えない | 希望した場合のみ、そのまま保存 | 取り消すまで |
| イベント | 訪問者がしたこと（クリック・フォーム送信）を数える | 名前と一日ごとの回数だけ | 400日 |
| ページの遷移 | どのページの次にどのページが見られたか（既定で有効、停止可） | ページの組み合わせと一日ごとの回数だけ | 400日 |
| 滞在時間 | ページが表示されていた長さ | 6 区分のいずれかのみ、日ごとに集計 | 400 日 |
| スクロール到達度 | ページのどこまで表示されたか | 到達した 4 分の 1 の段階のみ、日ごとに集計 | 400 日 |
| 訪問の最後のページ | 訪問者がどこで終えるか | アドレスとその日ごとの件数のみ | 400 日 |
| 入口ページ | 訪問が最初に表示したページ（流入元の種類ごと） | アドレスとその日ごとの件数のみ | 400 日 |
| ページごとの滞在時間 | どのページが読者を引き留めるか | アドレスと日ごとの合計と件数のみ | 400 日 |
| 読み込み時間 | 計測対象のページの読み込みにかかった時間 | 5 区分のいずれかのみ、日ごとに集計 | 400 日 |
| 画面の解像度 | 画面の解像度がいくつか | 値とその日ごとの件数のみ | 400 日 |
| ウィンドウの大きさ | ブラウザーのウィンドウの幅 | 7 区分のいずれかのみ、日ごとに集計 | 400 日 |
| 端末のピクセル | 解像度 × ピクセル比 | 値とその日ごとの件数のみ | 400 日 |
日次ハッシュは、IP・User-Agent・カウンター番号・日付と、毎日変わる秘密のソルトから作られます。ソルトは2日後に削除されます。その後は IP が分かっていても、どのハッシュが誰のものだったかは計算し直せません。カウンター番号が入るため、同じ訪問者でも別々のサイトでは同一人物と判別できません。
滞在時間、スクロール到達度、最後のページは、いかなる識別子も使わずに測定します。そのためにカウンターは端末から何も読み取りません。自身の実行時間とウィンドウのスクロール位置を測り、そこから区分と百分率を求め、その 2 つだけを送ります。これらの計測において、ウィンドウの高さはブラウザーに留まります。訪問の最後のページには追加の収集が一切不要で、オンライン一覧の夜間整理から得られます。 入口ページも同じくついでに得られます。計数の処理はいずれにせよ 1 行を書き込み、それが新しければ、その訪問の最初の表示だったということです。読み込み時間は、ブラウザーが計測対象のページへの自分自身のリクエストについて行った計測に由来します — お使いの端末の特徴ではありません。 2026 年 8 月 27 日から、カウンターが実際に端末から読み取る項目が三つ加わりました。画面の解像度、ブラウザーのウィンドウ幅、そしてピクセル比です。これはお使いの端末設備へのアクセスであり、上記の計測と混同されるべきものではありません。運営者は、サイトの所有者がどの画面に向けて設計しているのかを知りたいという理由から、これを決めました。ここでも保存されるのは日ごとの件数だけです。解像度と端末のピクセルは値として、ウィンドウの大きさは七つの区分のいずれかとしてのみ — 正確なウィンドウの大きさは識別の手がかりになるためです。
カウンターは Cookie を設定せず、端末から何も読み取りません。stats4u.net 上でセッション Cookie が設定されるのは、カウンターを作成または変更するときだけです。
カウンター所有者のメールアドレス。2026年より前のカウンターには登録されていることがあります。ウィザードで入力するかどうかは任意です。 用途はひとつだけで、依頼に応じて管理用リンクをその同じアドレスへ送ることです — 別のアドレスは指定できません。平文で保存し、第三者に渡さず、広告にも使いません。自動的な削除期限はありません。ご自分の統計ページの管理欄からいつでもご自身で削除できます。それ以外はサポートフォームからの依頼で削除します。
トップページと統計ページには Google AdSense の広告が表示されます。 ブログには Google AdSense の広告が表示されます。 その前に、同意レイヤーがあなたの同意を求めます。
計測の法的根拠は、サイト運営者がリーチを測定することへの正当な利益です（GDPR 第6条1項(f)）。
カウンターを自分のサイトに設置した人が、そこで集まるデータの管理者です。Stats4U はその委託を受けて処理します。
Since 27 August 2026 the counter measures nine further things: how long a page was visible, how far down it was visible, which page was the last of a visit, which was the first, how long the individual page held its readers, how fast it loaded, what screen the device has, how wide the window was, and how many real pixels are behind it.
The first six work without an identifier and without any access to your device. The last three are different: for those the counter does query your device. That is an access to your terminal equipment, and we put it here rather than in the small print — the details are below the table.
What is stored is, in all nine cases, only a band, an address or a value with a count per day. There is no row that describes a single visit.
4. Legal bases and objection
4.1 The legal basis for counting is Art. 6(1)(f) GDPR — the legitimate interest of the site operator in measuring the reach of their own site. The interest is in knowing whether and how the site is found; no overriding interests of visitors stand against it, because no identifier is set, the IP address does not enter the statistics and cross-site recognition is technically impossible.
4.2 The counter stores nothing on the device and reads nothing from it. Section 25 TDDDG and Art. 5(3) of the ePrivacy Directive therefore do not apply; consent is not required for the counting. Whether consent is nevertheless required in an individual case is assessed by each site operator for their own site.
4.3 The legal basis for providing the service to the counter owner and for answering enquiries is Art. 6(1)(b) GDPR (performance of a use relationship); for preventing abuse and for operational security, Art. 6(1)(f) GDPR; for legally required retention, Art. 6(1)(c) GDPR; and for anything for which consent is obtained, Art. 6(1)(a) GDPR.
4.4 Right to object. You may object at any time under Art. 21 GDPR to processing based on Art. 6(1)(f) GDPR. Address the objection to the operator of the site on which you encountered the counter; they are the controller. You may also contact stats4u@lukaswojcik.com — we will pass the objection on and act on instruction.
4.5 Excluding one's own visits. The operator of a counter may exclude their own IP addresses and ranges from counting. Those entries are held in plain text, because a range cannot be compared as a checksum, and remain stored until the operator withdraws them.
5. When you visit www.stats4u.net itself
5.1 Web server access log. Every request is logged with the full IP address, time, address requested, response code, volume transferred, referrer and user agent. The log serves fault diagnosis and defence against attacks and is deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR. This applies to every request, including the retrieval of a counter image.
5.2 Session cookie. When you create or change a counter on www.stats4u.net, a session cookie is set. It contains a random identifier, serves solely to hold the steps of the wizard together and expires when the browser is closed. On the privacy policy and imprint pages, none is set, deliberately.
5.3 Advertising. On the statistics pages under /live, advertising from Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is displayed. In doing so Google may process data about your device and, with the corresponding consent, store and read identifiers on your device. The home page carries no advertising.
5.4 Consent management. For visitors from the EEA, the United Kingdom and Switzerland, Google's consent management (“Privacy & messaging”, fundingchoicesmessages.google.com) is loaded. It asks for consent and makes the result available under the IAB TCF standard. Where no consent is given, Google serves advertising without personalisation and without access to your device. You may withdraw your consent at any time using the control in the consent manager.
5.5 Session recording (MousePlayer). On the pages of www.stats4u.net — and only there — a session recording may run that captures mouse movements and clicks and stores something on the device for that purpose. It is loaded only after your consent. It does not run on the pages of customers who embed the counter.
5.6 Own counter. www.stats4u.net counts its own visitors with the same counter it offers. This too is subject to your consent, even though the counter stores nothing on the device.
5.7 Enquiry form. If you use the form, we process what you write into it: the topic, your name, your e-mail address, a counter number where given, and your message. The submission is stored so that it can be dealt with, and is additionally sent as a notification to a messenger service (Telegram) through which the operator receives it. To protect against automated submissions, Google reCAPTCHA checks the transmission; the script required for this is loaded only when you open the form, not when the page is called up. Legal basis: Art. 6(1)(b) and (f) GDPR.
5.8 Counter owner's e-mail address. For counters dating from before 2026 an address is sometimes on file; one may be given voluntarily in the wizard. It has exactly one purpose: to send the administration link, on request, to precisely that address — no other address can be entered. It is stored in plain text, is not passed on and is not used for advertising. There is no automatic erasure period; you can remove it yourself at any time in the owner section of your statistics page.
5.9 Sending e-mail. The administration link is sent via an outgoing mail service (PrivateEmail, Namecheap, Inc.). There is no newsletter and no bulk mailing.
5.10 Automatically generated summary. At the top of a statistics page, two or three sentences about the counter's development may appear. The language model is given exclusively already aggregated figures and the most visited page addresses of that counter — no IP addresses, no visitor identifiers and nothing that could be assigned to an individual person. The processing takes place on the operator's own infrastructure.
5.11 Fonts and embedded files. Fonts, images and scripts on these pages are served from our own server. No fonts are loaded from third-party servers.
6. Recipients
The counter data processed on behalf of controllers does not leave the server in Łódź. It is neither sold nor passed to third parties nor written into anyone else's cloud.
Recipients exist only for the ancillary services named under 5:
- Google Ireland Limited — advertising on the statistics pages, consent management, protection of the enquiry form (5.3, 5.4, 5.7),
- Telegram FZ-LLC — notification of incoming enquiries (5.7),
- Namecheap, Inc. / PrivateEmail — sending the administration link (5.9),
- MousePlayer — session recording on www.stats4u.net, only with consent (5.5).
Beyond this we disclose data where we are legally obliged to do so — for instance to law enforcement authorities on a valid order.
7. Transfers to third countries
Processing takes place in Poland and therefore within the European Union.
A transfer to a third country occurs only with the recipients named under 6. For Google, the European Commission's adequacy decision on the EU-US Data Privacy Framework applies, supplemented by standard contractual clauses. For Namecheap, standard contractual clauses apply. For Telegram (United Arab Emirates) the transfer is based on Art. 49(1)(b) GDPR; it concerns exclusively the details you yourself write into the enquiry form. Anyone who does not use the form is not affected.
For third countries without an adequacy decision, access by state authorities cannot be ruled out with the same certainty as within the EU. That is why this is stated here, and why the scope is kept this small.
8. Retention periods
The periods are set out in the overview under 3. In summary:
- web server access log: 14 days,
- visitors' daily hashes: 2 days; the salt is deleted with them,
- aggregated evaluations (pages, page transitions, referrers, languages, events, time on page, scroll depth, entry page, last page of a visit, time per page, load time, screen resolution, window size, device pixels): 400 days,
- excluded addresses: until withdrawn by the counter owner,
- counter owner's e-mail address: until erased by them,
- submissions from the enquiry form: until dealt with, and beyond that for as long as commercial or tax retention obligations exist,
- total counter reading: permanently — it is a figure with no personal reference.
A nightly run deletes what has expired. Erasure is not suspended on request.
9. Your rights
You have the following rights against the controller:
- Access (Art. 15 GDPR) — what data concerning you is processed,
- Rectification (Art. 16 GDPR) — correction of inaccurate data,
- Erasure (Art. 17 GDPR) — where no retention ground stands against it,
- Restriction of processing (Art. 18 GDPR),
- Data portability (Art. 20 GDPR) — for data based on consent or contract,
- Objection (Art. 21 GDPR) — against any processing based on legitimate interests,
- Withdrawal of consent (Art. 7(3) GDPR) — with effect for the future; processing carried out until then remains lawful.
9.1 What limits us here. The statistics contain no IP addresses; the visitor hashes are salted, and the salt is deleted after 2 days. After that, a record can no longer be assigned to any person — not even if you give us your IP address. Under Art. 11(2) GDPR we are not obliged to collect additional data solely in order to answer a request. We will tell you so and explain why, rather than invent an answer.
9.2 Where to send the request. If your concern relates to the counter on someone else's site, the operator of that site is your point of contact (2.1). You may still contact us; we will pass it on and act on their instruction. If it relates to www.stats4u.net itself, contact stats4u@lukaswojcik.com directly.
10. Complaint to a supervisory authority
Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority, without prejudice to other remedies.
The competent supervisory authority for the controller is:
Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
You may equally contact the supervisory authority of your place of residence or of your workplace.
11. No automated decision-making
There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling. No advertising profiles are built, no interests are inferred and no assessments of individual persons are made.
The detection of automated requests (“bots”) evaluates the user agent of a request, not a person, and has no legal effect for anyone.
12. Is provision required?
There is neither a statutory nor a contractual obligation to provide data. Without processing the items named under 3, however, a request cannot be counted — that is the function itself, not a condition.
Providing an e-mail address is voluntary. Without one, only the administration link cannot be sent.
13. Security
All pages and the retrieval of the counter image run exclusively encrypted over HTTPS. The server is located on the operator's premises; the database accepts no connections from outside. Credentials are held outside the directory reachable over the network.
Visitor recognition works with a secret salt that changes daily. Because the counter number feeds into the hash, the same visitor produces two different hashes on two different sites — cross-site recognition is therefore technically impossible, not merely prohibited.
The full description of the measures under Art. 32 GDPR is in Annex 1 of the data processing agreement.
14. Children
The service is aimed at operators of websites, not at children. No data of children is knowingly collected. The counter does not distinguish by age, because to do so it would have to collect exactly the kind of data it does not collect.
15. Changes to this policy
This policy is kept up to date when the processing changes. The version published at www.stats4u.net/privacy governs; it carries a version number and a date.
The overview under 3 is generated from the system configuration on every request. If the technology changes, the overview changes with it — it cannot become outdated without the code changing too.
16. Further documents
The following apply in addition:
- the terms of service — what the service does, what it does not do, and who is answerable for what,
- the data processing agreement — for everyone who embeds the counter on their own site,
- the Privacy text for your site — a ready-made paragraph for your own policy, tailored to your own counter, in eleven languages,
- the imprint.
Version
Version 1.1, dated 27 August 2026.