Privacy

The short version

CO2Stats sets no cookies and runs no advertising. Every file on every page comes from co2stats.com, with one exception: when you start using the website carbon checker, its check that you are a person loads from Cloudflare. We count visits to our pages without cookies, and you can stop us counting yours. If you check a page, its result is public; if you register interest in the agency tier, we keep the email address you give. Both are set out below.

What happens when you visit

The site runs on Cloudflare. To deliver pages and protect the site from attack, Cloudflare processes the address your device connects from (its IP address) and the details your browser sends with each request. We do not store them, and we do not use them to identify you. Cloudflare explains its own handling in its privacy policy.

The Kettle calculator works entirely in your browser: what you type is never sent to us. The birth-year form sends the year to our server only so that it can show you that year’s page; the year is not stored.

If you use the website carbon checker

When you check a page, we store the page’s address and what the check found: its size, its files, the estimate and the hosting facts. Addresses are stored without their query strings, and the files’ addresses without their folders. We do not store who asked for the check. Each result is public: anyone with its link can see it. We keep results for 12 months, then delete them.

To keep the checker free and available to everyone, we count how many checks each visitor makes in a day. The count is filed under a code made from your connecting address and the date with a secret key, not under the address itself, and the same address gets a different code each day. We hold the key, so the code is a pseudonym rather than anonymous: we use it only to count checks. Each count is deleted within three days. Our hosting provider keeps backups for up to 30 days.

Before a check runs, Cloudflare Turnstile checks that you are a person and not a program. It runs in your browser only once you start using the checker’s form, sets no cookies, and looks at signals from your browser and device to tell people from programs. Cloudflare explains what it collects in its Turnstile privacy addendum.

Our lawful basis is legitimate interests: ours in running a free checker that strangers cannot overload or misuse. If a result is about your page and you want it removed, write to hello@co2stats.com with its link, and we will delete it with any earlier results for the page.

Visitor counts

We count visits to our pages so we know which pages people read. We use our own analytics, not anyone else’s, with no cookies. For each page you visit, we record the page you visited, the website you came from, if you followed a link from another site, your screen size, your browser’s language, your browser, operating system and type of device (from what your browser says it is) and your country (from your connection).

We never record your IP address, your city or region, the page’s title, anything after a ? or # in an address, or which page you came from on another site. To count visitors as well as visits, views from the same browser and the same shortened IP address (its last part removed before it leaves our server) are grouped together within a calendar month. The address itself is not kept, but the grouping is a pseudonym, not anonymous.

We do not count you at all if your browser sends Global Privacy Control or Do Not Track, or once you press this button, which stores your choice in your browser:

We keep the record of each visit for up to four months, and backups of it for 14 days more. After that we keep only totals, such as visits to each page in a month, with anything seen by fewer than five visitors grouped together, so the totals cannot identify anyone. Our hosting provider stores them on our behalf and does not use them.

If you email us

If you write to hello@co2stats.com, your message and address are held by our email and help-desk providers. We use them only to answer you and to keep a record of what was said, and delete them once we no longer need them for that.

If you register interest in the agency tier

If you leave your email address on the agency page, we store it with the version of the wording you agreed to and the time you agreed. We use it for one thing: to email you once, if and when the agency tier launches. Our lawful basis is your consent, which you can withdraw at any time by writing to us.

Only we can see the list. It is stored in our database at our hosting provider, Cloudflare, which keeps it on our behalf and does not use it. We keep each address for up to 12 months, or until that one email has been sent if sooner, and then delete it. Our hosting provider keeps backups for up to 30 days, so a deleted address leaves them within 30 days.

To have your address deleted sooner, write to hello@co2stats.com from that address, or tell us which address it is.

Why we may use it

Under UK data protection law, our lawful basis for serving the site, counting visits and answering email is legitimate interests: ours in delivering the site and keeping it secure, in knowing which pages people read, and in answering the messages people send us. None uses more than the information described above, and none is used for anything else.

Who is responsible

CO2Stats is run by Achtung Ltd, 22 Wenlock Road, London N1 7GU, which is responsible for the information described here. Write to hello@co2stats.com.

Your rights

You can ask us what we hold about you, ask us to correct or delete it, ask us to restrict how we use it, or object to our using it at all, by writing to hello@co2stats.com. If you are unhappy with how we handle your information, you can complain to the Information Commissioner’s Office.