Privacy at Zuwar
Last updated: 8 October 2026
Zuwar is provided by Arabiana Limited (company number 11540497). This page explains what Zuwar does with personal data. For your account, billing and our emails to you, our full Privacy Policy applies. For data about the visitors of your websites, we act as your processor under our Data Processing Addendum.
If you visit a website that uses Zuwar
The website you visited uses Zuwar to count visits. That website's owner decides how the statistics are used, so please contact them first with any questions. Zuwar processes the data on their behalf.
- No cookies. Zuwar stores nothing in your browser, unless you choose to switch counting off for a website.
- Your internet address and browser details are never stored. They are used for a moment, in memory, to estimate your location and to tell visitors apart for one day.
- You can't be followed across days or websites. Visitors are told apart with a code made from your internet address, browser, the website and a random secret that changes every day. The secret is deleted within two days, so codes from different days or websites can't be linked.
- What is kept: the pages you opened, the website or app that sent you, your approximate country and city, your type of device, operating system and browser, how long you actively read, and which kinds of contact link you tapped, but never the phone number, address or message.
- Email addresses and long numbers are removed from page addresses and titles before anything is stored.
- To stop being counted on a website, open that website with #zuwar-off at the end of its address. Use #zuwar-on to start again.
If you use Zuwar for your websites
We collect your email address, language and country, your websites' settings, the email addresses of anyone you ask us to send reports to, and your billing details through Stripe. We use them to run your account, send your sign-in links, reports and service emails, and bill you. We don't use them for advertising and never sell them. Details are in our Privacy Policy.
Where Zuwar processes data
- DigitalOcean, Frankfurt (Germany): the application, the database and backups. Visitors' data is processed by no other provider.
- Resend (EU region, Ireland): sending emails to account holders and report recipients.
- Stripe: payments.
- Location lookups use a database held on our own servers. Internet addresses are not sent to any location provider. IP Geolocation by DB-IP.
How long data is kept
- Detailed visit records: 25 months. Daily totals: while the account is active.
- Everything about a website: removed when its owner deletes it.
- Account data: 90 days after access to Zuwar ends, then deleted. Backups for up to 7 days more.
- After an account is deleted, we keep only a one-way code made from its email address, so the same address can't start a second free trial.
Your rights
You can ask for a copy of your data, or for it to be corrected or deleted, at [email protected]. If you were a visitor to a website that uses Zuwar, contact that website's owner first; we will help them respond. More about your rights, and how to complain to a data protection authority, is in our Privacy Policy.
Summary tables
What we don't do, and what we do instead
| We don't | What we do instead |
|---|---|
| Set cookies or store any identifier in visitors' browsers (except an opt-out flag the visitor sets themselves) | Count people with an identifier derived in memory from IP address + browser + website + a secret salt that changes every day; salts are deleted at most two days after their day ends |
| Store IP addresses or full browser identification strings | Keep country, region, city (approximate), device type, operating system and browser family |
| Link a visitor across days or across websites | Each website and each day gets an unrelated identifier; a visit ends at the website's local midnight |
| Store phone numbers, email addresses or messages from contact taps | Store only the contact type and the page |
| Keep query strings, emails or long numbers from addresses | Strip query strings; replace email addresses and runs of 7+ digits in page addresses, titles and campaign names; owners can turn off recording page titles |
| Sell or share analytics data | Process it on DigitalOcean (Frankfurt), with email (Resend) and billing (Stripe) providers listed below |
Where data is processed and how long it is kept
| Data | Where | Kept for |
|---|---|---|
| Visitor events (no IP address or browser string) | DigitalOcean Frankfurt: app and managed PostgreSQL | Raw 25 months; daily totals while the account is active; deleted 90 days after access ends; backups up to 7 days longer |
| Visitor IP address and browser string | App memory during one request only | Not stored |
| Owner account (email, country) | DigitalOcean Frankfurt | Until account deletion (+ backups up to 7 days); after deletion only a salted hash of the email remains (one trial per email) |
| Billing (customer, invoices, card) | Stripe | Per Stripe and tax law |
| Emails (owner and report recipients) | Resend (EU region, Ireland) | Per Resend's retention policy for the owner's plan |
| Error reports (optional) | Sentry, if enabled, with personal data removed | 30 days |