Legal

Privacy Policy

Last updated: September 1, 2026

Table of Contents

1. Introduction

HitCounters ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website analytics service.

By using HitCounters, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address
  • Username
  • Password (encrypted)
  • Account preferences

2.2 Website Visitor Data

When visitors browse websites using our tracking service, we collect:

  • IP address (stored in full, not anonymized) — see the note below
  • Browser type and version
  • Operating system
  • Device type (desktop, mobile, tablet)
  • Screen resolution
  • Referring URL
  • Pages visited and time spent
  • Geographic location (country, region, city)
  • Network operator and ASN, used for bot and datacenter-traffic detection

About IP addresses

We want to be precise about this, because it is the item people most often assume works differently.

Visitor IP addresses are stored in full and are visible to the owner of the website being visited, in that site's visitor activity log. They are not truncated, hashed, or anonymized by default.

We hold them because they are what makes the rest of the service work: geolocation, distinguishing returning visitors, and identifying automated and datacenter traffic so that owners can tell real visitors from bots.

IP addresses are never sold, shared with advertisers, or used to track a person across different websites. A visitor's activity on one site is never linked to their activity on another.

How long they are kept depends on the site owner's plan — see Data Retention — and they are erased when the underlying data is deleted.

2.3 Automatically Collected Information

We automatically collect certain information when you use our service:

  • Log data (access times, pages viewed, IP address)
  • Device information
  • Usage patterns

3. How We Use Your Information

We use the collected information for:

  • Providing and maintaining our service
  • Generating analytics reports for website owners
  • Improving and optimizing our service
  • Communicating with you about your account
  • Sending service-related notifications
  • Detecting and preventing fraud or abuse
  • Complying with legal obligations

4. Data Sharing

We do not sell your personal information. We may share data with:

  • Service Providers: Third-party companies that help us operate our service (hosting, email delivery)
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

Website visitor data is only shared with the website owner who installed our tracking code.

5. Cookies & Tracking Technologies

On hitcounters.com (our dashboard)

We use first-party cookies to:

  • Keep you logged into your account
  • Remember your preferences (timezone, theme)
  • Protect against CSRF attacks

On websites running our tracking script

Our visitor-tracking script does not set cookies on the websites where it is installed. Instead, it stores a first-party visitor identifier and session ID in the browser's localStorage (scoped to the site that installed the script). This data:

  • Stays on a single site — no cross-site or cross-device tracking
  • Is never used for advertising or sold to third parties
  • Can be cleared by visitors at any time via their browser

Visitor opt-out: any visitor can opt out of being counted by appending ?hc_optout=1 to the URL of any page running our script. This sets a persistent flag in their browser and the script will skip on that device.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide services:

  • Account Data: Retained until you delete your account
  • Analytics Data: Retained according to your plan (30 days to unlimited)
  • Backup Data: Retained for up to 90 days after deletion

Deleting your account

You can delete your account from the HitCounters iPhone app, under Account → Delete account, or by emailing us at [email protected]. You will be asked for your password to confirm.

What happens then:

  • Any active subscriptions are cancelled at the end of the current billing period. You keep access to what you have already paid for; nothing further is charged. Past payments are not refunded.
  • Your account is scheduled for deletion 7 days later. During that window you can cancel the request and keep the account.
  • After that window, your account and all of its data are permanently deleted. This includes your sites, and the full visitor records for those sites — sessions, page views, outbound clicks, and the IP addresses within them — across every system we store them in.
  • Deletion is permanent and cannot be undone once it has run.

Routine backups may retain copies for up to 90 days, after which they expire and are overwritten.

7. Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Delete your account and all of its data — see Deleting your account
  • Portability: Request a machine-readable copy of your data
  • Objection: Object to certain processing activities
  • Withdrawal: Withdraw consent at any time

To exercise these rights, please contact us at [email protected]

GDPR Compliance

For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (GDPR). Our legal basis for processing includes consent, contract performance, and legitimate interests.

CCPA Compliance

For California residents, we comply with the California Consumer Privacy Act (CCPA). You have the right to know what personal information we collect and to request deletion.

8. Security

We implement appropriate security measures to protect your information:

  • SSL/TLS encryption for all data transmission
  • Encrypted password storage using industry-standard hashing
  • Regular security audits and updates
  • Access controls and authentication
  • Secure data centers with physical security

While we strive to protect your data, no method of transmission over the Internet is 100% secure.

9. Children's Privacy

Our service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

  • Posting the new policy on this page
  • Updating the "Last updated" date
  • Sending an email notification for significant changes

11. Contact Us

If you have questions about this Privacy Policy, please contact us: