Transparency
Infrastructure, data sources, caching, privacy, and sharing posture.
Hosting & infrastructure
npmtraffic runs on Vercel with Next.js server routes and a small in-memory cache. There is no account system, paid tier, or customer data store; the project stays focused on fast public package analysis.
Data sources
Download counts come from api.npmjs.org. Search, repository metadata, dist-tags, and publish/release markers come from registry.npmjs.org. npmtraffic normalizes date ranges to yesterday UTC because npm download counters lag the current day.
Caching & freshness
Short traffic windows cache for 15 minutes; longer traffic windows cache for 12 hours. Stale traffic can be served for up to 24 hours when npm is unavailable, and stale state is shown in the UI and export metadata. Package metadata can cache longer because it changes less often.
Rate limiting & privacy
Public endpoints are rate limited to prevent abuse. Rate limiting uses request metadata transiently and is not used for profiling. Vercel Web Analytics provides aggregate site usage without ad pixels, cross-site tracking cookies, or user profiles.
Local-first events & sharing
Event markers are stored in your browser by default. Importing npm releases creates local markers from public registry publish dates. If you explicitly share a link that includes an events parameter, that payload is embedded in the URL and can be imported by others.