Privacy

Your package.json

A pasted package.json is matched against the catalog and never stored. The report you get back is encoded in its own URL, and only the names of packages that matched a rule go into it. Anyone you send that link to sees what the link says. Nothing sits on a server waiting to be looked up.

The CLI and the MCP server run on your machine and send nothing anywhere.

Cookies

This site sets no cookies of its own.

Analytics

The site runs Vercel Web Analytics. Per Vercel, it uses no third-party cookies. A visitor is identified by a hash created from the incoming request, and that session is discarded after 24 hours. Each page view stores the URL, referrer, country and region, browser, operating system and device type.

It also runs Vercel Speed Insights. Per Vercel, its data points are anonymous and cannot be used to follow a visit across pages or identify a person. Each one stores the route, network speed, browser, device, country and a Core Web Vital.

Both are described in Vercel's words. I have no access to anything beyond the aggregated dashboards.

Questions

Open an issue on GitHub.