</> Radek Mazár

What this site knows about you

I want to know whether writing a blog is worth it — whether anyone opened an article and where they came from. Counting page views is enough for that. I don’t need to know who you are to do it, and in the statistics I don’t. The web server does keep a technical log of its own, though, and that one works differently — I cover it under The web server’s technical log.

What goes into the statistics

Every time the site sends you a page, one line is added to the statistics:

  • when it happened,
  • the page address — for example /blog/website-without-wordpress, without anything after the question mark,
  • the domain of the site you came from — for example google.com. Only the domain, not the address of the specific page or what you searched for. If you came directly, there’s nothing there,
  • whether you’re a human or a bot — as one of four numbers: human, search engine, monitoring, other bot.

I can tell that last one from a header the browser sends with every request. It’s a guess, not a certainty, and I don’t store the header itself in the statistics — I just derive that number from it once and throw it away.

What doesn’t go into the statistics

  • Your IP address. It never gets into the statistics. The web server writes it to its own technical log in two cases, see The web server’s technical log.
  • Anything that would fingerprint you — browser type, resolution, language, fonts. The browser header is written down only by the log entry for a redirect from http://, described below. By language I mean the one set in your browser: the server doesn’t read it. Which language version you’re reading shows in the page address (/cs/…), and that is recorded like any other address.
  • Cookies. The site doesn’t set any. Your choice of light or dark theme stays stored in your browser and is never sent to the server. Your language choice is remembered the same way: when you pick Czech with the language switcher, your browser remembers it, and the next time you open an English page that has a Czech version, it takes you to that version. The server never receives that choice. It only sees the browser ask for the Czech page right after the English one, and records both like any other.
  • Your name, email, or anything else that makes you you. The site has no logins or forms for visitors.

Why the numbers can’t be read as a head count

I count views, not visitors. If you open the same page three times, that counts as three. Recognizing that it’s still you would take exactly the data I don’t want to store here.

Where the statistics are

In a single file on my server in Germany. It isn’t sent to anyone else: no analytics service, no ad network. Not a single third-party script runs on the site — no Google Analytics, no social media buttons, no embedded videos.

Lines older than 400 days are deleted. Once a day, the statistics file is backed up to the same server, and the last seven copies are kept, so a deleted line disappears from the backups within a week at the latest.

The web server’s technical log

The site counts the statistics itself. Separately, the web server that delivers the pages to you keeps a technical log of its own. For every request to this site, it writes down:

  • when the request came in,
  • the name of the site,
  • the method and the page address — again without anything after the question mark. The method is usually just loading a page,
  • the status code of the response — for example 200 for “fine” or 404 for “there’s no such page,”
  • the size of the response and how long it took to serve it.

That’s the ordinary entry: no IP address, no browser header, and no page you came from. In two cases the web server writes down more, including your IP address:

  • Something fails and the server writes down an error — for example when the site isn’t responding, when someone sends an oversized request, or when someone enters a wrong password for the private part of the site. The error message contains your IP address, the full address of the page including anything after the question mark, the page you came from, and, for a wrong password, the user name entered.
  • You open the site over insecure http://. The server’s general settings handle that request. All they do is redirect you to https://, but they write down a more detailed entry while they’re at it: your IP address, the full address including anything after the question mark, the browser header, and the page you came from.

Technical logs of the web server, including the ones with an IP address, are deleted after 15 days at the latest.

If you want to ask

Email me at radek.mazar@gmail.com. I can’t delete “your” lines from the statistics, I’m afraid — and it’s the good kind of can’t: there’s nothing in them that would tell me which ones are yours. The web server’s technical logs that do contain an IP address delete themselves within 15 days at the latest.