diff --git a/src/or/geoip.c b/src/or/geoip.c
index 9f37c021c1..786c40e5b1 100644
--- a/src/or/geoip.c
+++ b/src/or/geoip.c
@@ -917,11 +917,11 @@ geoip_dirreq_stats_init(time_t now)
   start_of_dirreq_stats_interval = now;
 }
 
-/** Store all our geoip statistics into $DATADIR/dirreq-stats. */
+/** Write dirreq statistics to $DATADIR/stats/dirreq-stats. */
 void
 geoip_dirreq_stats_write(time_t now)
 {
-  char *filename = get_datadir_fname("dirreq-stats");
+  char *statsdir = NULL, *filename = NULL;
   char *data_v2 = NULL, *data_v3 = NULL;
   char written[ISO_TIME_LEN+1];
   open_file_t *open_file = NULL;
@@ -935,6 +935,10 @@ geoip_dirreq_stats_write(time_t now)
   /* Discard all items in the client history that are too old. */
   geoip_remove_old_clients(start_of_dirreq_stats_interval);
 
+  statsdir = get_datadir_fname("stats");
+  if (check_private_dir(statsdir, CPD_CREATE) < 0)
+    goto done;
+  filename = get_datadir_fname("stats"PATH_SEPARATOR"dirreq-stats");
   data_v2 = geoip_get_client_history_dirreq(now,
                 GEOIP_CLIENT_NETWORKSTATUS_V2);
   data_v3 = geoip_get_client_history_dirreq(now,
@@ -1029,6 +1033,7 @@ geoip_dirreq_stats_write(time_t now)
   if (open_file)
     abort_writing_to_file(open_file);
   tor_free(filename);
+  tor_free(statsdir);
   tor_free(data_v2);
   tor_free(data_v3);
 }
@@ -1043,12 +1048,11 @@ geoip_entry_stats_init(time_t now)
   start_of_entry_stats_interval = now;
 }
 
-/** Store all our geoip statistics as entry guards into
- * $DATADIR/entry-stats. */
+/** Write entry statistics to $DATADIR/stats/entry-stats. */
 void
 geoip_entry_stats_write(time_t now)
 {
-  char *filename = get_datadir_fname("entry-stats");
+  char *statsdir = NULL, *filename = NULL;
   char *data = NULL;
   char written[ISO_TIME_LEN+1];
   open_file_t *open_file = NULL;
@@ -1060,6 +1064,10 @@ geoip_entry_stats_write(time_t now)
   /* Discard all items in the client history that are too old. */
   geoip_remove_old_clients(start_of_entry_stats_interval);
 
+  statsdir = get_datadir_fname("stats");
+  if (check_private_dir(statsdir, CPD_CREATE) < 0)
+    goto done;
+  filename = get_datadir_fname("stats"PATH_SEPARATOR"entry-stats");
   data = geoip_get_client_history_dirreq(now, GEOIP_CLIENT_CONNECT);
   format_iso_time(written, now);
   out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND,
@@ -1079,6 +1087,7 @@ geoip_entry_stats_write(time_t now)
   if (open_file)
     abort_writing_to_file(open_file);
   tor_free(filename);
+  tor_free(statsdir);
   tor_free(data);
 }
 
diff --git a/src/or/rephist.c b/src/or/rephist.c
index 44bf940013..f7d0b2bbcf 100644
--- a/src/or/rephist.c
+++ b/src/or/rephist.c
@@ -1358,7 +1358,7 @@ rep_hist_exit_stats_init(time_t now)
                                  sizeof(uint32_t));
 }
 
-/** Write exit stats for the current period to disk and reset counters. */
+/** Write exit stats to $DATADIR/stats/exit-stats and reset counters. */
 void
 rep_hist_exit_stats_write(time_t now)
 {
@@ -1367,10 +1367,14 @@ rep_hist_exit_stats_write(time_t now)
   uint64_t *b, total_bytes, threshold_bytes, other_bytes;
   uint32_t other_streams;
 
-  char *filename = get_datadir_fname("exit-stats");
+  char *statsdir = NULL, *filename = NULL;
   open_file_t *open_file = NULL;
   FILE *out = NULL;
 
+  statsdir = get_datadir_fname("stats");
+  if (check_private_dir(statsdir, CPD_CREATE) < 0)
+    goto done;
+  filename = get_datadir_fname("stats"PATH_SEPARATOR"exit-stats");
   format_iso_time(t, now);
   log_info(LD_HIST, "Writing exit port statistics to disk for period "
            "ending at %s.", t);
@@ -1466,6 +1470,7 @@ rep_hist_exit_stats_write(time_t now)
   if (open_file)
     abort_writing_to_file(open_file);
   tor_free(filename);
+  tor_free(statsdir);
 }
 
 /** Note that we wrote <b>num_bytes</b> to an exit connection to
@@ -2663,11 +2668,11 @@ _buffer_stats_compare_entries(const void **_a, const void **_b)
     return 0;
 }
 
-/** Append buffer statistics to local file. */
+/** Write buffer statistics to $DATADIR/stats/buffer-stats. */
 void
 rep_hist_buffer_stats_write(time_t now)
 {
-  char *filename;
+  char *statsdir = NULL, *filename = NULL;
   char written[ISO_TIME_LEN+1];
   open_file_t *open_file = NULL;
   FILE *out;
@@ -2706,7 +2711,10 @@ rep_hist_buffer_stats_write(time_t now)
       stat, tor_free(stat));
   smartlist_clear(circuits_for_buffer_stats);
   /* write to file */
-  filename = get_datadir_fname("buffer-stats");
+  statsdir = get_datadir_fname("stats");
+  if (check_private_dir(statsdir, CPD_CREATE) < 0)
+    goto done;
+  filename = get_datadir_fname("stats"PATH_SEPARATOR"buffer-stats");
   out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND,
                                     0600, &open_file);
   if (!out)
@@ -2758,6 +2766,7 @@ rep_hist_buffer_stats_write(time_t now)
   if (open_file)
     abort_writing_to_file(open_file);
   tor_free(filename);
+  tor_free(statsdir);
   if (str_build) {
     SMARTLIST_FOREACH(str_build, char *, c, tor_free(c));
     smartlist_free(str_build);
diff --git a/src/or/router.c b/src/or/router.c
index f33add8269..1c8bb1d061 100644
--- a/src/or/router.c
+++ b/src/or/router.c
@@ -1903,8 +1903,8 @@ extrainfo_dump_to_string(char *s, size_t maxlen, extrainfo_t *extrainfo,
     time_t since = time(NULL) - (24*60*60);
     log_info(LD_GENERAL, "Adding stats to extra-info descriptor.");
     if (options->DirReqStatistics &&
-        load_stats_file("dirreq-stats", "dirreq-stats-end", since,
-                        &contents) > 0) {
+        load_stats_file("stats"PATH_SEPARATOR"dirreq-stats",
+                        "dirreq-stats-end", since, &contents) > 0) {
       int pos = strlen(s);
       if (strlcpy(s + pos, contents, maxlen - strlen(s)) !=
           strlen(contents)) {
@@ -1915,8 +1915,8 @@ extrainfo_dump_to_string(char *s, size_t maxlen, extrainfo_t *extrainfo,
       tor_free(contents);
     }
     if (options->EntryStatistics &&
-        load_stats_file("entry-stats", "entry-stats-end", since,
-                        &contents) > 0) {
+        load_stats_file("stats"PATH_SEPARATOR"entry-stats",
+                        "entry-stats-end", since, &contents) > 0) {
       int pos = strlen(s);
       if (strlcpy(s + pos, contents, maxlen - strlen(s)) !=
           strlen(contents)) {
@@ -1927,8 +1927,8 @@ extrainfo_dump_to_string(char *s, size_t maxlen, extrainfo_t *extrainfo,
       tor_free(contents);
     }
     if (options->CellStatistics &&
-        load_stats_file("buffer-stats", "cell-stats-end", since,
-                        &contents) > 0) {
+        load_stats_file("stats"PATH_SEPARATOR"buffer-stats",
+                        "cell-stats-end", since, &contents) > 0) {
       int pos = strlen(s);
       if (strlcpy(s + pos, contents, maxlen - strlen(s)) !=
           strlen(contents)) {
@@ -1939,8 +1939,8 @@ extrainfo_dump_to_string(char *s, size_t maxlen, extrainfo_t *extrainfo,
       tor_free(contents);
     }
     if (options->ExitPortStatistics &&
-        load_stats_file("exit-stats", "exit-stats-end", since,
-                        &contents) > 0) {
+        load_stats_file("stats"PATH_SEPARATOR"exit-stats",
+                        "exit-stats-end", since, &contents) > 0) {
       int pos = strlen(s);
       if (strlcpy(s + pos, contents, maxlen - strlen(s)) !=
           strlen(contents)) {