The design is nice, but why don't you go completely random with the URLs for the stats? Either make the URLs guessable (1000, 1001, 1002, ...) or list them so that everyone can see them properly or make them unguessable. This way, it seems sort of private, but it isn't at all, because it just increases 2 digits within the URL.
Its using a BSON ObjectId, but I hear what you are saying. thanks for the feedback!