Counters, not people.

• Counters (stats_cells). One row per counter: a quarter, a laptop class, a memory tier, one measurement and a count. A contribution adds 1 to six counters. No row belongs to one person.
• Consent counters (stats_consent). One row per quarter and wording version, with a count. It shows which wording the counted contributions were made under.
• Network keys (stats_seen). A keyed hash of the IPv4 address or the IPv6 /48 block, plus the quarter. It enforces one contribution per network per quarter. Keys of a past quarter are deleted by the first request after the quarter ends.
• Abuse limiter (rate_limit). A salted hash of the network and a counter, for 10 minutes.
• Shared reports (reports) are not statistics. They have their own consent, are pseudonymous, and are never counted into or joined with the counters.

• Marginals only. Each measurement is counted on its own: verdict, memory pressure, swap, graphics use, processor use. The pairings are never stored, so nobody can rebuild what one laptop looked like. site/tests/marginals.test.mjs fails if any table or write ties two measurements together.
• No identifier and no time. The counters have no ID, no timestamp, no IP address and no link to a shared report. The quarter is set by the server.
• Ranges, not numbers. The client sends bands such as "5 to 20 percent", never exact readings. The exact model is reduced to a class.
• Small groups stay hidden. A group is published from 10 contributions, as a range. A split is published from 50, and only if no value is above 90 percent or below 10 percent.
• Waiting period. A quarter is published at least 30 days after it ends, so a live counter cannot be compared with an earlier copy.
• One rounded total. The only sum is the number of contributions, rounded down to 10. With count ranges of at least 10 per group, it cannot be subtracted into the exact size of a hidden group.

The tests are the ones from the Article 29 Working Party opinion on anonymisation (WP216).

• Singling out. No row describes one laptop, and the smallest published group has at least 10 contributions.
• Linkability. The counters hold no key shared with another store. The network key table holds no value, and its keys change every quarter.
• Inference. A split is withheld when one value dominates a group, so knowing a laptop is in the group does not reveal its value.

• 49 addresses. A flooder with enough distinct networks can fill a small group with fake contributions and read one real contributor's values from the split. With one contribution per network per quarter and splits from 50, that takes at least 49 distinct IPv4 addresses or /48 blocks per group per quarter. A botnet or proxy pool removes that cost, so the figures are called indicative.
• First 30 days. Database backups (Cloudflare D1 Time Travel) could in theory isolate a single contribution during the first 30 days. After that it cannot be singled out or withdrawn.
• Membership. Whoever holds the server secret could test whether a given address contributed during the quarter. That reveals membership only, never what it contributed. The keys are deleted at rollover.
• Self-selection. Contributions cannot be verified, and the people who measure are not a sample of all Mac owners. The statistics say so on every page.
• Operator access. The operator can read the raw counters. They hold no rows about people, but they hold groups smaller than 10, which are never published.
• Not retractable. Because the counters are not linked to anyone, a contribution cannot be removed later. The checkbox says so before the click.

A new table, a new measurement, a new use of the counters, or a new wording needs this note, the marginals test and the consent version to change together. Selling data, training on it, or joining it with another store is a new purpose and would need its own consent first.