This policy sets out what data is processed when counting and when visiting these pages, on what basis, and for how long.
In short
The counter sets no cookies and reads nothing from your device. The IP address is not stored in the statistics; it feeds into a salted daily hash whose salt is deleted after 2 days.
No advertising profiles are built, and no raw data is sold or passed to third parties. Because the counter number feeds into the hash, the same visitor cannot be recognised as the same person across two different sites.
The overview further down is generated from the system configuration, not maintained by hand. It therefore describes the actual state rather than the intention.
1. Controller
The controller within the meaning of Art. 4(7) GDPR for the processing on the pages of www.stats4u.net is:
LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, NIP: PL7252266190, REGON: 369859995. E-mail: stats4u@lukaswojcik.com. Further particulars are in the imprint.
No data protection officer has been appointed; there is no obligation to do so under Art. 37 GDPR. Please address enquiries to the above or use the enquiry form available on every page.
2. Two processes that must be kept apart
This policy concerns two different things, and responsibility for them is not the same.
2.1 The counter on someone else's site. Where a webmaster embeds the counter on their site, they are the controller for the data collected there. They decide whether and how counting takes place, and they must inform their visitors about it. Stats4U processes that data solely on their behalf and is a processor under Art. 28 GDPR. The details are in the data processing agreement.
2.2 Visiting www.stats4u.net itself. For everything that happens on these pages — calling up the home page, creating a counter, viewing a statistics page, the enquiry form — the operator named under 1 is itself the controller. That is covered under 5.
If you arrived here because you saw a counter image on someone else's site: sections 3 and 4 concern you. The operator of that site is your point of contact; they can instruct us to erase your data.
3. What the counter collects
What the counter collects
This overview is generated from the system configuration and describes the actual state.
| Item | Purpose | Stored | Retention |
|---|---|---|---|
| IP address | derive country and city; goes into the daily hash | not in the counting statistics, but in the operations log | 14 days in the server and operations log |
| Daily hash (salted) | count a visitor once per day | yes, 16 bytes | 2 days |
| User agent | browser, operating system, bot detection | no, only the result | – |
| Page URL | most visited pages | yes | 400 days |
| Referrer | where visitors come from | domain only | 400 days |
| Browser language | language breakdown | only the result | 400 days |
| Excluded addresses | leave the owner's own visits uncounted | only on request, in the clear | until withdrawn |
| Events | count what visitors did (click, form) | only name and count per day | 400 days |
| Page transitions | which page follows which (on by default, can be switched off) | only the pairs and their count per day | 400 days |
| Time on page | how long a page was visible | only one of six bands, counted per day | 400 days |
| Scroll depth | how far down the page was visible | only the quarter reached, counted per day | 400 days |
| Last page of a visit | where visitors stop | only the address and its count per day | 400 days |
| Entry page | which page a visit showed first, by source type | only the address and its count per day | 400 days |
| Time on page, per page | which page holds readers | only sum and count per address and day | 400 days |
| Load time | how long the counted page took to load | only one of five bands, counted per day | 400 days |
| Screen resolution | what resolution the screen has | only the value and its count per day | 400 days |
| Window size | how wide the browser window was | only one of seven bands, counted per day | 400 days |
| Device pixels | resolution times pixel ratio | only the value and its count per day | 400 days |
The daily hash is built from IP, user agent, counter number, date and a secret salt that changes every day and is deleted after 2 days. After that, not even a known IP allows anyone to work out which hash belonged to whom. Because the counter number is part of it, the same visitor on two different sites cannot be recognised as the same person.
Time on page, scroll depth and the last page are measured without any identifier. The counter reads nothing from your device for this: it measures its own running time and the window's scroll position, works out a band and a percentage from them, and sends only those two. The window height stays in the browser for these measurements. The last page of a visit needs no additional collection at all; it falls out of the nightly clean-up of the online list. The entry page likewise falls out along the way: the counting path writes a row anyway, and if it is new, that was the first view of the visit. The load time comes from the measurement the browser made of ITS OWN request to the counted page — not a characteristic of your device. Since 27 August 2026 three items are added that the counter really does read from your device: the screen resolution, the width of the browser window and the pixel ratio. That is an access to your terminal equipment and is not to be confused with the measurements above — the operator decided in favour of it because site owners want to know which screens they are designing for. Here too only a count per day is stored: resolution and device pixels as a value, the window size only as one of seven bands, because an exact window size would be a means of recognition.
The counter sets no cookies and reads nothing from your device. On stats4u.net itself a session cookie is set only when you create or change a counter.
E-mail address of the counter owner. Some counters from before 2026 have one on file; anyone entering one in the wizard does so voluntarily. It serves one single purpose: to send the management link to that exact address on request – no other address can be given. It is stored in plain text, never passed on and never used for advertising. There is no automatic deletion period; it can be removed at any time in the owner box of your own statistics page, otherwise on request through the support form.
The home page and the statistics pages serve Google AdSense advertising. The blog serves Google AdSense advertising. A consent layer asks for your agreement first.
The legal basis for counting is the site owner's legitimate interest in audience measurement (Art. 6(1)(f) GDPR).
Whoever embeds the counter on their site is the controller for the data collected there; Stats4U processes it on their behalf.
Since 27 August 2026 the counter measures nine further things: how long a page was visible, how far down it was visible, which page was the last of a visit, which was the first, how long the individual page held its readers, how fast it loaded, what screen the device has, how wide the window was, and how many real pixels are behind it.
The first six work without an identifier and without any access to your device. The last three are different: for those the counter does query your device. That is an access to your terminal equipment, and we put it here rather than in the small print — the details are below the table.
What is stored is, in all nine cases, only a band, an address or a value with a count per day. There is no row that describes a single visit.
4. Legal bases and objection
4.1 The legal basis for counting is Art. 6(1)(f) GDPR — the legitimate interest of the site operator in measuring the reach of their own site. The interest is in knowing whether and how the site is found; no overriding interests of visitors stand against it, because no identifier is set, the IP address does not enter the statistics and cross-site recognition is technically impossible.
4.2 The counter stores nothing on the device and reads nothing from it. Section 25 TDDDG and Art. 5(3) of the ePrivacy Directive therefore do not apply; consent is not required for the counting. Whether consent is nevertheless required in an individual case is assessed by each site operator for their own site.
4.3 The legal basis for providing the service to the counter owner and for answering enquiries is Art. 6(1)(b) GDPR (performance of a use relationship); for preventing abuse and for operational security, Art. 6(1)(f) GDPR; for legally required retention, Art. 6(1)(c) GDPR; and for anything for which consent is obtained, Art. 6(1)(a) GDPR.
4.4 Right to object. You may object at any time under Art. 21 GDPR to processing based on Art. 6(1)(f) GDPR. Address the objection to the operator of the site on which you encountered the counter; they are the controller. You may also contact stats4u@lukaswojcik.com — we will pass the objection on and act on instruction.
4.5 Excluding one's own visits. The operator of a counter may exclude their own IP addresses and ranges from counting. Those entries are held in plain text, because a range cannot be compared as a checksum, and remain stored until the operator withdraws them.
5. When you visit www.stats4u.net itself
5.1 Web server access log. Every request is logged with the full IP address, time, address requested, response code, volume transferred, referrer and user agent. The log serves fault diagnosis and defence against attacks and is deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR. This applies to every request, including the retrieval of a counter image.
5.2 Session cookie. When you create or change a counter on www.stats4u.net, a session cookie is set. It contains a random identifier, serves solely to hold the steps of the wizard together and expires when the browser is closed. On the privacy policy and imprint pages, none is set, deliberately.
5.3 Advertising. On the statistics pages under /live, advertising from Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is displayed. In doing so Google may process data about your device and, with the corresponding consent, store and read identifiers on your device. The home page carries no advertising.
5.4 Consent management. For visitors from the EEA, the United Kingdom and Switzerland, Google's consent management (“Privacy & messaging”, fundingchoicesmessages.google.com) is loaded. It asks for consent and makes the result available under the IAB TCF standard. Where no consent is given, Google serves advertising without personalisation and without access to your device. You may withdraw your consent at any time using the control in the consent manager.
5.5 Session recording (MousePlayer). On the pages of www.stats4u.net — and only there — a session recording may run that captures mouse movements and clicks and stores something on the device for that purpose. It is loaded only after your consent. It does not run on the pages of customers who embed the counter.
5.6 Own counter. www.stats4u.net counts its own visitors with the same counter it offers. This too is subject to your consent, even though the counter stores nothing on the device.
5.7 Enquiry form. If you use the form, we process what you write into it: the topic, your name, your e-mail address, a counter number where given, and your message. The submission is stored so that it can be dealt with, and is additionally sent as a notification to a messenger service (Telegram) through which the operator receives it. To protect against automated submissions, Google reCAPTCHA checks the transmission; the script required for this is loaded only when you open the form, not when the page is called up. Legal basis: Art. 6(1)(b) and (f) GDPR.
5.8 Counter owner's e-mail address. For counters dating from before 2026 an address is sometimes on file; one may be given voluntarily in the wizard. It has exactly one purpose: to send the administration link, on request, to precisely that address — no other address can be entered. It is stored in plain text, is not passed on and is not used for advertising. There is no automatic erasure period; you can remove it yourself at any time in the owner section of your statistics page.
5.9 Sending e-mail. The administration link is sent via an outgoing mail service (PrivateEmail, Namecheap, Inc.). There is no newsletter and no bulk mailing.
5.10 Automatically generated summary. At the top of a statistics page, two or three sentences about the counter's development may appear. The language model is given exclusively already aggregated figures and the most visited page addresses of that counter — no IP addresses, no visitor identifiers and nothing that could be assigned to an individual person. The processing takes place on the operator's own infrastructure.
5.11 Fonts and embedded files. Fonts, images and scripts on these pages are served from our own server. No fonts are loaded from third-party servers.
6. Recipients
The counter data processed on behalf of controllers does not leave the server in Łódź. It is neither sold nor passed to third parties nor written into anyone else's cloud.
Recipients exist only for the ancillary services named under 5:
- Google Ireland Limited — advertising on the statistics pages, consent management, protection of the enquiry form (5.3, 5.4, 5.7),
- Telegram FZ-LLC — notification of incoming enquiries (5.7),
- Namecheap, Inc. / PrivateEmail — sending the administration link (5.9),
- MousePlayer — session recording on www.stats4u.net, only with consent (5.5).
Beyond this we disclose data where we are legally obliged to do so — for instance to law enforcement authorities on a valid order.
7. Transfers to third countries
Processing takes place in Poland and therefore within the European Union.
A transfer to a third country occurs only with the recipients named under 6. For Google, the European Commission's adequacy decision on the EU-US Data Privacy Framework applies, supplemented by standard contractual clauses. For Namecheap, standard contractual clauses apply. For Telegram (United Arab Emirates) the transfer is based on Art. 49(1)(b) GDPR; it concerns exclusively the details you yourself write into the enquiry form. Anyone who does not use the form is not affected.
For third countries without an adequacy decision, access by state authorities cannot be ruled out with the same certainty as within the EU. That is why this is stated here, and why the scope is kept this small.
8. Retention periods
The periods are set out in the overview under 3. In summary:
- web server access log: 14 days,
- visitors' daily hashes: 2 days; the salt is deleted with them,
- aggregated evaluations (pages, page transitions, referrers, languages, events, time on page, scroll depth, entry page, last page of a visit, time per page, load time, screen resolution, window size, device pixels): 400 days,
- excluded addresses: until withdrawn by the counter owner,
- counter owner's e-mail address: until erased by them,
- submissions from the enquiry form: until dealt with, and beyond that for as long as commercial or tax retention obligations exist,
- total counter reading: permanently — it is a figure with no personal reference.
A nightly run deletes what has expired. Erasure is not suspended on request.
9. Your rights
You have the following rights against the controller:
- Access (Art. 15 GDPR) — what data concerning you is processed,
- Rectification (Art. 16 GDPR) — correction of inaccurate data,
- Erasure (Art. 17 GDPR) — where no retention ground stands against it,
- Restriction of processing (Art. 18 GDPR),
- Data portability (Art. 20 GDPR) — for data based on consent or contract,
- Objection (Art. 21 GDPR) — against any processing based on legitimate interests,
- Withdrawal of consent (Art. 7(3) GDPR) — with effect for the future; processing carried out until then remains lawful.
9.1 What limits us here. The statistics contain no IP addresses; the visitor hashes are salted, and the salt is deleted after 2 days. After that, a record can no longer be assigned to any person — not even if you give us your IP address. Under Art. 11(2) GDPR we are not obliged to collect additional data solely in order to answer a request. We will tell you so and explain why, rather than invent an answer.
9.2 Where to send the request. If your concern relates to the counter on someone else's site, the operator of that site is your point of contact (2.1). You may still contact us; we will pass it on and act on their instruction. If it relates to www.stats4u.net itself, contact stats4u@lukaswojcik.com directly.
10. Complaint to a supervisory authority
Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority, without prejudice to other remedies.
The competent supervisory authority for the controller is:
Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
You may equally contact the supervisory authority of your place of residence or of your workplace.
11. No automated decision-making
There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling. No advertising profiles are built, no interests are inferred and no assessments of individual persons are made.
The detection of automated requests (“bots”) evaluates the user agent of a request, not a person, and has no legal effect for anyone.
12. Is provision required?
There is neither a statutory nor a contractual obligation to provide data. Without processing the items named under 3, however, a request cannot be counted — that is the function itself, not a condition.
Providing an e-mail address is voluntary. Without one, only the administration link cannot be sent.
13. Security
All pages and the retrieval of the counter image run exclusively encrypted over HTTPS. The server is located on the operator's premises; the database accepts no connections from outside. Credentials are held outside the directory reachable over the network.
Visitor recognition works with a secret salt that changes daily. Because the counter number feeds into the hash, the same visitor produces two different hashes on two different sites — cross-site recognition is therefore technically impossible, not merely prohibited.
The full description of the measures under Art. 32 GDPR is in Annex 1 of the data processing agreement.
14. Children
The service is aimed at operators of websites, not at children. No data of children is knowingly collected. The counter does not distinguish by age, because to do so it would have to collect exactly the kind of data it does not collect.
15. Changes to this policy
This policy is kept up to date when the processing changes. The version published at www.stats4u.net/privacy governs; it carries a version number and a date.
The overview under 3 is generated from the system configuration on every request. If the technology changes, the overview changes with it — it cannot become outdated without the code changing too.
16. Further documents
The following apply in addition:
- the terms of service — what the service does, what it does not do, and who is answerable for what,
- the data processing agreement — for everyone who embeds the counter on their own site,
- the Privacy text for your site — a ready-made paragraph for your own policy, tailored to your own counter, in eleven languages,
- the imprint.
Version
Version 1.1, dated 10 September 2026.