How quietstats works, and what it means for privacy

1. The script

Your page loads a script under 1 KB. On each page view it sends one small message containing: your site ID, the page URL (without the #fragment), the referrer, and the screen width and height. It does not set cookies, and it does not use localStorage, sessionStorage or IndexedDB. If the browser has Do Not Track or Global Privacy Control switched on, it sends nothing.

2. The collector

Our server checks the site ID and that the page really belongs to your registered domain. It drops known bots. It then works out a visitor ID: the first 16 characters of SHA-256(daily random salt + site + IP address + user agent). The IP address and user agent are used in memory for that calculation and to read the device, browser and OS family, then discarded. They are never stored. Country comes from Cloudflare’s country header. Yesterday’s salt is deleted, so IDs cannot be joined up across days.

3. What we store

Per pageview: time, day, the daily visitor ID, path, referrer domain, country code, device type, browser family, OS family, screen size and any utm_source / utm_medium / utm_campaign. That is it.

4. UK law: PECR and the statistical-purposes exception

In the UK, the Privacy and Electronic Communications Regulations (PECR, regulation 6) cover storing information on, or accessing information from, a user’s device, not just cookies. The Data (Use and Access) Act 2025 added an exception so consent is not needed when the sole purpose is collecting statistical information about how your website or service is used, to improve it. The ICO’s final guidance on storage and access technologies (published 29 April 2026) explains the conditions, including:

• you must give clear and comprehensive information about the analytics, for example in your privacy notice;
• you must offer a simple and free way to object (quietstats honours Do Not Track and Global Privacy Control, and you can link to how to switch these on);
• the data must be used for aggregate statistics only, not to identify, track, profile or make decisions about individuals, and not for advertising;
• individual-level data should not be kept longer than needed to produce the statistics.

Caveats, please read. quietstats does not store anything on the device, but the script does read the screen size, and the browser sends its IP address and user agent with every request, so PECR and the UK GDPR can still be relevant. We designed quietstats to fit the statistical-purposes exception, but whether it applies depends on how you use it and what else runs on your site. This page is general information, not legal advice. Check the ICO guidance or ask a qualified adviser. Rules elsewhere (for example the EU ePrivacy Directive) may differ.

5. Suggested wording for your privacy notice