Privacy policy
Last updated 5 November 2026
Statiku is web and app analytics. It is run by Victor Abuchi in Kuopio, Finland (“we”). You can reach us at contact@victorabuchi.com.
This policy covers two groups of people:
- People who use Statiku, our customers and their teams. For your account we decide what's collected and why: we're the controller.
- Visitors of the websites and users of the apps that use Statiku. There, the site's owner decides and is the controller; we process the data on their behalf, under our data processing agreement. This policy describes how Statiku works for them, and the site's own privacy policy says what the owner does with it.
If you use Statiku
What we keep
- Your name, email address and password (only as a scrypt hash), and a profile photo if you add one.
- Your websites, their settings, your team and its invitations, and the history you import.
- Your sign-ins: a random token in a cookie named
stk_session, kept on our side only as a hash, for 30 days. It's the only cookie Statiku sets, and only on Statiku itself, to keep you signed in. - Your plan: which one, its status and when it renews, as Polar tells us. Polar handles the payment; we never see your card.
- Password reset links (as hashes, for an hour) and the emails we send you.
Your IP address is used for a few minutes, in memory only, to slow down people guessing passwords. It isn't stored.
Why
To provide the service you signed up for (the contract between us), to keep it secure and to email you about your sites (our legitimate interest in a safe, useful service), and to keep accounting records of payments (a legal obligation, which Polar fulfils as the seller).
How long
Until you delete your account in Settings. Then it's deleted at once, with the websites only you could see and everything they collected; copies in our database backups are gone within 7 days.
If you visit a site that uses Statiku
Statiku stores nothing on your device: no cookies, no local storage, no identifiers. For each page you view, the site sends:
- the page's address, the address you came from and any campaign tags in the link;
- your browser, operating system and kind of device (their families, never versions), and your window's width;
- events the site chooses to count, such as a download or a sign-up.
On our servers, your IP address and browser are used, in memory only, to:
- find your country (which is kept) and approximate city (which is shown in the site's live view while you're on the site and never stored), using a database of address ranges that runs on our own servers;
- make a visitor code: a hash of your IP address and browser with a random key that changes every day. Each key is deleted after a day, so the code can't be traced back to you or linked to the next day's.
Your IP address is never stored.
Exact location, only if you agree
A site's owner can choose to ask visitors for their exact location. If you say yes, in the site's own question and then in your browser's, the point you share is held to about 10 metres, in memory only, while you're on the site, to show you on the site's live map. Its street address is looked up from OpenStreetMap, which receives the point. It's never stored, and if you don't agree, nothing changes.
In apps
An app using Statiku's SDK sends a random install ID it makes for itself, the app's version, the system's version, and whether you're on a trial or licensed. Your country is found from your IP address, which isn't stored.
How long
As long as the site's owner keeps the site in Statiku. Deleting a site deletes everything it collected.
Who else is involved
| Who | What for | Where |
|---|---|---|
| Oracle | Runs Statiku's servers and database | Stockholm, Sweden |
| Polar | Sells Statiku's plans as the merchant of record: checkout, invoices, VAT | United States |
| Our email provider | Sends password resets and site alerts | EU |
| OpenStreetMap Foundation | Street names for locations visitors choose to share; map tiles in the live view, which your browser loads straight from OpenStreetMap | United Kingdom |
| Only if you import from Google Analytics: you sign in with Google, and the sign-in is used for the import and not kept | United States | |
| GitHub | Only if you import release downloads: the repository's public numbers | United States |
Transfers outside the EU rely on the European Commission's adequacy decisions (the United Kingdom, and US companies certified under the EU-US Data Privacy Framework) or on its standard contractual clauses.
Your rights
You can ask to see, correct, delete or move the data about you, to restrict how it's used, or object to it. Most of it you can change or delete yourself in Settings; for anything else, email us. If you visited a site that uses Statiku, ask that site's owner first: they decide about its data, and we'll help them. You can also complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or to the authority where you live.
Changes
If we change this policy in a way that matters, we'll email our customers before it takes effect. The date at the top says when it last changed.