webcounter

Privacy Policy

Last updated 14 October 2026

WebCounter (webcounter.co.za, "we") gives website owners a free visitor counter and a free report. We built it to count people without tracking them. This policy explains what we collect, why, and what we do not do. It is written with South Africa's Protection of Personal Information Act (POPIA) in mind.

The short version

  • The counter sets no cookies and uses no local storage on your visitors' browsers.
  • We never store IP addresses.
  • We never sell data, and we do not use it for advertising profiles.
  • Location is approximate: country, region and city at most. Never a suburb or street.
  • Query strings are never stored, so anything in a link after the "?" never reaches us.

Visitors to sites that use the counter

When a page with the counter loads, the counter script reads the count and, once a real person interacts with the page (scrolls, taps, types or stays a few seconds), sends one small message to us. From that message and the request around it we use:

  • Your IP address and browser user agent, briefly. They are combined with a random value that changes every day and turned into a one-way code, so the same visitor is counted once per day. The IP address and user agent themselves are not stored. The daily random value is deleted after the day ends, so older codes cannot be traced back to anyone.
  • Approximate location (country, and where available region and city), supplied by our network provider Cloudflare from the IP address. We store it, not the IP address it came from.
  • The page address without its query string or fragment (for example /shop/mugs), so the site owner can see their top pages.
  • The referring address without its query string (for example google.com or blog.example.com/post), so the site owner can see where visitors came from. Moving between pages of the same site is not recorded as a referral.
  • Signals used to filter bots, such as whether the browser reports being automated. These are checked and discarded, not stored.

Visitor data is stored as daily counts per site, plus one coded row per visitor per day. None of it identifies a person, and we do not combine it across sites.

Website owners with a WebCounter account

  • Your email address and a securely hashed password, to sign you in. We never store the password itself.
  • The domains you add and your counter settings.
  • A sign-in cookie and a form security cookie on webcounter.co.za only, while you use your account. They are strictly necessary and are not used for tracking.

Cookies

The counter places no cookies on your visitors' devices, so it does not need a cookie banner of its own. Our own website sets cookies only when you sign in to an account. Cloudflare, which protects and delivers our service, may set a short-lived security cookie to tell people from automated traffic.

What we do not do

  • We do not store IP addresses, suburbs, street addresses or precise location.
  • We do not sell, rent or trade any data.
  • We do not build advertising profiles or follow visitors from one site to another.
  • We do not store query strings, form contents or anything typed on a page.

Why we process it

We process visitor data to provide the counting service the site owner asked for, which is our legitimate interest and theirs, and account data to provide your account. We collect only what that requires.

Who else sees it

  • The site owner sees counts, pages, referrers and approximate locations for their own site. If they switch on the public stats page, totals and countries are visible to anyone with the link.
  • Our service providers: Cloudflare (network and security) and our hosting provider. They may process data outside South Africa, under their own data protection commitments.
  • Authorities, only where the law requires it.

How long we keep it

  • The daily random value behind visitor codes is deleted after its day.
  • Daily counts, pages, referrers and locations are kept while the site stays on an account, so the owner can see their history. They are deleted when the owner asks us to remove the site or account.
  • Account details are kept while the account is open, and deleted on request.

Security

Data is held on servers we control, passwords are hashed, and access is limited to what is needed to run the service.

Your rights

Under POPIA you may ask what personal information we hold about you, ask us to correct or delete it, and object to its processing. Because we do not store IP addresses or identifiers, we usually cannot link visitor counts back to a particular person. Account holders can ask us to delete their account and every site on it. You may also complain to the Information Regulator of South Africa (inforegulator.org.za).

Contact

For privacy questions or requests, email [email protected].

Changes

If this policy changes, we will update the date at the top of this page.