Who can see the stats?

The browser that created the link. The key for those stats stays on this screen, separate from the short URL. Someone who only has the short link cannot open the stats, and neither can another device. Clearing site data removes the key from this browser.