Version of 6 November 2026
Privacy policy
This page says what stati stores about you as our customer, what it stores about the visitors of your website, and what it does not store at all.
Who we are
stati is operated by [Company name], [Address], company ID [ID] (“we”). Write to [email protected] with any question about this page.
Visitors of websites measured by stati
stati does not use cookies, local storage or any other identifier in the visitor’s browser. It does not store IP addresses: the address is used only to work out the country and region and is then discarded.
To count how many people visited within one day, stati derives a hash from the IP address, the browser and a secret salt that changes every day and is deleted after two days. After that, the visitor cannot be recognised again, not even by us.
What is kept: the page opened, the time, the referring site and campaign parameters, country and region, the type of device, browser and operating system, and the events the website owner chose to measure (for example a click on a button). No names, e-mail addresses or form contents are ever collected by the script.
We act as a processor for the website owner, who is the controller of this data. The data processing agreement describes that relationship.
Customers of stati
When you create an account we store your name, e-mail address, a hash of your password, your language and the websites you add. If you pay, our payment provider Stripe stores your card details; we only keep an identifier of your subscription and the invoices.
We use this data to run the service, send you the e-mails you asked for (reports, alerts, notices about your trial and plan) and to answer your questions. We do not sell it and do not use it for advertising.
Where the data lives
All data is stored and processed on servers in the European Union (Hetzner Online GmbH, Germany and Finland). Backups are encrypted and kept in the European Union as well.
Who else sees it
Our sub-processors: Hetzner Online GmbH (servers), Amazon Web Services EMEA SARL (sending e-mail), Stripe Payments Europe Ltd (payments), DB-IP (the database that maps IP addresses to countries; the address never leaves our server), Anthropic (optional weekly summaries written from aggregate numbers only, never from individual visits).
How long
Visit data is kept for three years and then deleted. Daily salts are deleted after two days. Your account data is deleted within 30 days after you delete the account; invoices are kept as long as accounting law requires.
Your rights
You can see, export, correct and delete your account data in the application at any time. You can also write to [email protected] to exercise any right under the GDPR, including the right to complain to a supervisory authority.