Stats4U - Free Counters

In short

The counter sets no cookies and reads nothing from your device. The IP address is not stored in the statistics; it feeds into a salted daily hash whose salt is deleted after 2 days.

No advertising profiles are built, and no raw data is sold or passed to third parties. Because the counter number feeds into the hash, the same visitor cannot be recognised as the same person across two different sites.

The overview further down is generated from the system configuration, not maintained by hand. It therefore describes the actual state rather than the intention.

1. Controller

The controller within the meaning of Art. 4(7) GDPR for the processing on the pages of www.stats4u.net is:

LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, NIP: PL7252266190, REGON: 369859995. E-mail: stats4u@lukaswojcik.com. Further particulars are in the imprint.

No data protection officer has been appointed; there is no obligation to do so under Art. 37 GDPR. Please address enquiries to the above or use the enquiry form available on every page.

2. Two processes that must be kept apart

This policy concerns two different things, and responsibility for them is not the same.

2.1 The counter on someone else's site. Where a webmaster embeds the counter on their site, they are the controller for the data collected there. They decide whether and how counting takes place, and they must inform their visitors about it. Stats4U processes that data solely on their behalf and is a processor under Art. 28 GDPR. The details are in the data processing agreement.

2.2 Visiting www.stats4u.net itself. For everything that happens on these pages — calling up the home page, creating a counter, viewing a statistics page, the enquiry form — the operator named under 1 is itself the controller. That is covered under 5.

If you arrived here because you saw a counter image on someone else's site: sections 3 and 4 concern you. The operator of that site is your point of contact; they can instruct us to erase your data.

3. What the counter collects

4. Legal bases and objection

4.1 The legal basis for counting is Art. 6(1)(f) GDPR — the legitimate interest of the site operator in measuring the reach of their own site. The interest is in knowing whether and how the site is found; no overriding interests of visitors stand against it, because no identifier is set, the IP address does not enter the statistics and cross-site recognition is technically impossible.

4.2 The counter stores nothing on the device and reads nothing from it. Section 25 TDDDG and Art. 5(3) of the ePrivacy Directive therefore do not apply; consent is not required for the counting. Whether consent is nevertheless required in an individual case is assessed by each site operator for their own site.

4.3 The legal basis for providing the service to the counter owner and for answering enquiries is Art. 6(1)(b) GDPR (performance of a use relationship); for preventing abuse and for operational security, Art. 6(1)(f) GDPR; for legally required retention, Art. 6(1)(c) GDPR; and for anything for which consent is obtained, Art. 6(1)(a) GDPR.

4.4 Right to object. You may object at any time under Art. 21 GDPR to processing based on Art. 6(1)(f) GDPR. Address the objection to the operator of the site on which you encountered the counter; they are the controller. You may also contact stats4u@lukaswojcik.com — we will pass the objection on and act on instruction.

4.5 Excluding one's own visits. The operator of a counter may exclude their own IP addresses and ranges from counting. Those entries are held in plain text, because a range cannot be compared as a checksum, and remain stored until the operator withdraws them.

5. When you visit www.stats4u.net itself

5.1 Web server access log. Every request is logged with the full IP address, time, address requested, response code, volume transferred, referrer and user agent. The log serves fault diagnosis and defence against attacks and is deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR. This applies to every request, including the retrieval of a counter image.

5.2 Session cookie. When you create or change a counter on www.stats4u.net, a session cookie is set. It contains a random identifier, serves solely to hold the steps of the wizard together and expires when the browser is closed. On the privacy policy and imprint pages, none is set, deliberately.

5.3 Advertising. On the statistics pages under /live, advertising from Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is displayed. In doing so Google may process data about your device and, with the corresponding consent, store and read identifiers on your device. The home page carries no advertising.

5.4 Consent management. For visitors from the EEA, the United Kingdom and Switzerland, Google's consent management (“Privacy & messaging”, fundingchoicesmessages.google.com) is loaded. It asks for consent and makes the result available under the IAB TCF standard. Where no consent is given, Google serves advertising without personalisation and without access to your device. You may withdraw your consent at any time using the control in the consent manager.

5.5 Session recording (MousePlayer). On the pages of www.stats4u.net — and only there — a session recording may run that captures mouse movements and clicks and stores something on the device for that purpose. It is loaded only after your consent. It does not run on the pages of customers who embed the counter.

5.6 Own counter. www.stats4u.net counts its own visitors with the same counter it offers. This too is subject to your consent, even though the counter stores nothing on the device.

5.7 Enquiry form. If you use the form, we process what you write into it: the topic, your name, your e-mail address, a counter number where given, and your message. The submission is stored so that it can be dealt with, and is additionally sent as a notification to a messenger service (Telegram) through which the operator receives it. To protect against automated submissions, Google reCAPTCHA checks the transmission; the script required for this is loaded only when you open the form, not when the page is called up. Legal basis: Art. 6(1)(b) and (f) GDPR.

5.8 Counter owner's e-mail address. For counters dating from before 2026 an address is sometimes on file; one may be given voluntarily in the wizard. It has exactly one purpose: to send the administration link, on request, to precisely that address — no other address can be entered. It is stored in plain text, is not passed on and is not used for advertising. There is no automatic erasure period; you can remove it yourself at any time in the owner section of your statistics page.

5.9 Sending e-mail. The administration link is sent via an outgoing mail service (PrivateEmail, Namecheap, Inc.). There is no newsletter and no bulk mailing.

5.10 Automatically generated summary. At the top of a statistics page, two or three sentences about the counter's development may appear. The language model is given exclusively already aggregated figures and the most visited page addresses of that counter — no IP addresses, no visitor identifiers and nothing that could be assigned to an individual person. The processing takes place on the operator's own infrastructure.

5.11 Fonts and embedded files. Fonts, images and scripts on these pages are served from our own server. No fonts are loaded from third-party servers.

6. Recipients

The counter data processed on behalf of controllers does not leave the server in Łódź. It is neither sold nor passed to third parties nor written into anyone else's cloud.

Recipients exist only for the ancillary services named under 5:

• Google Ireland Limited — advertising on the statistics pages, consent management, protection of the enquiry form (5.3, 5.4, 5.7),
• Telegram FZ-LLC — notification of incoming enquiries (5.7),
• Namecheap, Inc. / PrivateEmail — sending the administration link (5.9),
• MousePlayer — session recording on www.stats4u.net, only with consent (5.5).

Beyond this we disclose data where we are legally obliged to do so — for instance to law enforcement authorities on a valid order.

7. Transfers to third countries

Processing takes place in Poland and therefore within the European Union.

A transfer to a third country occurs only with the recipients named under 6. For Google, the European Commission's adequacy decision on the EU-US Data Privacy Framework applies, supplemented by standard contractual clauses. For Namecheap, standard contractual clauses apply. For Telegram (United Arab Emirates) the transfer is based on Art. 49(1)(b) GDPR; it concerns exclusively the details you yourself write into the enquiry form. Anyone who does not use the form is not affected.

For third countries without an adequacy decision, access by state authorities cannot be ruled out with the same certainty as within the EU. That is why this is stated here, and why the scope is kept this small.

8. Retention periods

The periods are set out in the overview under 3. In summary:

• web server access log: 14 days,
• visitors' daily hashes: 2 days; the salt is deleted with them,
• aggregated evaluations (pages, referrers, languages, events): 400 days,
• excluded addresses: until withdrawn by the counter owner,
• counter owner's e-mail address: until erased by them,
• submissions from the enquiry form: until dealt with, and beyond that for as long as commercial or tax retention obligations exist,
• total counter reading: permanently — it is a figure with no personal reference.

A nightly run deletes what has expired. Erasure is not suspended on request.

9. Your rights

You have the following rights against the controller:

• Access (Art. 15 GDPR) — what data concerning you is processed,
• Rectification (Art. 16 GDPR) — correction of inaccurate data,
• Erasure (Art. 17 GDPR) — where no retention ground stands against it,
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR) — for data based on consent or contract,
• Objection (Art. 21 GDPR) — against any processing based on legitimate interests,
• Withdrawal of consent (Art. 7(3) GDPR) — with effect for the future; processing carried out until then remains lawful.

9.1 What limits us here. The statistics contain no IP addresses; the visitor hashes are salted, and the salt is deleted after 2 days. After that, a record can no longer be assigned to any person — not even if you give us your IP address. Under Art. 11(2) GDPR we are not obliged to collect additional data solely in order to answer a request. We will tell you so and explain why, rather than invent an answer.

9.2 Where to send the request. If your concern relates to the counter on someone else's site, the operator of that site is your point of contact (2.1). You may still contact us; we will pass it on and act on their instruction. If it relates to www.stats4u.net itself, contact stats4u@lukaswojcik.com directly.

10. Complaint to a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority, without prejudice to other remedies.

The competent supervisory authority for the controller is:

Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

You may equally contact the supervisory authority of your place of residence or of your workplace.

11. No automated decision-making

There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling. No advertising profiles are built, no interests are inferred and no assessments of individual persons are made.

The detection of automated requests (“bots”) evaluates the user agent of a request, not a person, and has no legal effect for anyone.

12. Is provision required?

There is neither a statutory nor a contractual obligation to provide data. Without processing the items named under 3, however, a request cannot be counted — that is the function itself, not a condition.

Providing an e-mail address is voluntary. Without one, only the administration link cannot be sent.

13. Security

All pages and the retrieval of the counter image run exclusively encrypted over HTTPS. The server is located on the operator's premises; the database accepts no connections from outside. Credentials are held outside the directory reachable over the network.

Visitor recognition works with a secret salt that changes daily. Because the counter number feeds into the hash, the same visitor produces two different hashes on two different sites — cross-site recognition is therefore technically impossible, not merely prohibited.

The full description of the measures under Art. 32 GDPR is in Annex 1 of the data processing agreement.

14. Children

The service is aimed at operators of websites, not at children. No data of children is knowingly collected. The counter does not distinguish by age, because to do so it would have to collect exactly the kind of data it does not collect.

15. Changes to this policy

This policy is kept up to date when the processing changes. The version published at www.stats4u.net/privacy governs; it carries a version number and a date.

The overview under 3 is generated from the system configuration on every request. If the technology changes, the overview changes with it — it cannot become outdated without the code changing too.

16. Further documents

The following apply in addition:

• the terms of service — what the service does, what it does not do, and who is answerable for what,
• the data processing agreement — for everyone who embeds the counter on their own site,
• the privacy text for your site — a ready-made paragraph for your own policy, tailored to your own counter, in eleven languages,
• the imprint.

Version

Version 1.0, dated 19 August 2026.