Privacy Policy

Welcome to WPStats ("we", "our", "us"). This Privacy Policy explains how we collect, use, and protect information when you use our website analyzer at wpstats.org. We take your privacy seriously and are committed to keeping your data minimal and protected.

1. What information we collect

1.1 Rate limiting data

To enforce our fair-use policy of 5 free analyses per day, we store a SHA-256 hash of your IP address in a temporary file on our server. This hash cannot be reversed to obtain your original IP address. The file is automatically deleted after 24 hours.

1.2 Technical request data

Like all web servers, ours automatically records standard HTTP access logs which may include your IP address, browser user agent, the time of your request, and the HTTP status code. These logs are used solely for server security and debugging, are retained for a maximum of 7 days, and are not shared with any third party.

1.3 Analyzed URLs

When you submit a URL for analysis, we fetch that URL's content from our server to perform the analysis. We do not permanently store the URLs you submit or the content we fetch. The data exists only in memory during the analysis process.

1.4 Information we do NOT collect

• Your name, email address, or any registration information
• Payment information (the service is free)
• Browser history or browsing behavior
• Device identifiers or advertising IDs
• Location data beyond what is inherent in IP addresses

2. How we use information

The limited information we collect is used exclusively to:

• Enforce the daily rate limit — 5 analyses per IP per 24 hours
• Prevent abuse — detect and block automated bot attacks
• Maintain server security — monitor for malicious requests
• Improve the service — aggregate, anonymous usage statistics only

We do not use your information for advertising, profiling, or sale to third parties.

3. Third-party services

3.1 Google PageSpeed Insights API

When you analyze a site's speed, we send the target website's URL to the Google PageSpeed Insights API. Your own IP address is not sent to Google — only the URL of the site being analyzed. Google's use of this data is governed by the Google Privacy Policy.

3.2 Google Fonts

We use Google Fonts (Inter and Space Grotesk) for typography. When you load our page, your browser makes a request to Google's servers to download these fonts. Google may log this request. You can learn more at Google's Privacy Policy. If you prefer, you can use a browser extension to block font loading.

3.3 Tabler Icons CDN

We load icon fonts from cdn.jsdelivr.net (jsDelivr). jsDelivr may collect standard access log data. See jsDelivr's Privacy Policy for details.

4. Cookies

WPStats does not use cookies for tracking, advertising, or analytics. We do not set any first-party cookies. Some third-party resources (Google Fonts, jsDelivr) may use cookies or local storage as part of their CDN infrastructure. These are not under our control.

5. Data retention

Data type	Retention period	Purpose
IP hash (SHA-256)	24 hours	Rate limiting
Server access logs	7 days	Security monitoring
Analyzed URLs	Not stored	N/A
Analysis results	Not stored	N/A

6. Your rights (GDPR)

If you are in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access — You can request a copy of data we hold about you.
• Right to erasure — You can request deletion of your data (IP hashes expire in 24h automatically).
• Right to object — You can object to our processing of your data.
• Right to portability — You can request your data in a machine-readable format.
• Right to complain — You can lodge a complaint with your local data protection authority.

Because we do not collect registration data, most of these rights are automatically satisfied. To exercise any right, contact us at privacy@wpstats.org.

7. Data security

We take reasonable technical and organizational measures to protect the data we do collect:

• All connections are encrypted via HTTPS (TLS 1.2+)
• IP addresses are stored only as one-way SHA-256 hashes
• The data directory is blocked from public web access via .htaccess
• We do not use databases — rate data is stored in isolated server-side files
• Bot protection via HMAC tokens prevents automated abuse

8. Children's privacy

WPStats is not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

9. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically. Continued use of WPStats after changes constitutes acceptance of the updated policy.

10. Contact us

If you have questions about this Privacy Policy or your data, contact us at: