Analytics & privacy
What Denofy measures for package authors, what it never stores, and how to opt out.
Package authors see how their packages are found and used: installs, page views, tools, versions, where visitors came from. Denofy measures this without cookies, without storing IP addresses and without tracking individuals.
What is recorded#
Denofy records these events:
| Event | When | Data stored with it |
|---|---|---|
page_view | A package page is opened | package, referrer type, external referrer host, search term from Denofy's own search, country |
install | A version is downloaded with denofy add or from the website | package, version, source (CLI or web), tool, OS family, CLI version, country |
update | A version is downloaded by denofy update | same as install |
check | denofy update checks a package that is already up to date | same as install, without a download |
badge_view | The README badge is loaded | package |
Every event also gets a daily visitor hash (see below) so unique visitors can be counted.
Never stored: IP addresses, cookies or device ids, user agents, full referrer URLs, file paths, project or repository names, anything from your local files. The country is taken from a country header set by the hosting proxy (two-letter code only) when it exists; Denofy does not look up IP addresses itself.
Unique counts without tracking#
For unique visitors Denofy computes sha256(daily salt + IP address + user agent) when the
event arrives and stores only that hash. The salt is random, changes every day and is deleted
after two days. Afterwards nobody — including Denofy — can link a hash to an IP address or link
the same person across two days. This is the same technique privacy-friendly web analytics use.
Bots and CI#
- Requests from crawlers and bots (by user agent) are not recorded.
- Installs from CI systems (the CLI detects
CI, GitHub Actions, GitLab CI, …) are recorded with a CI flag and excluded from the analytics numbers, so a busy pipeline does not look like thousands of users. They still count towards the public download counter.
Retention#
- Raw events are deleted after 90 days.
- The worker aggregates events every hour into daily counts per package (e.g. "12 installs from Cursor on 1 Oct"). These aggregates contain no hashes and are kept permanently.
- Dashboards only read the aggregates, so the numbers can lag up to one hour.
Who sees what#
- Package owners see the analytics of their own packages at Dashboard → Analytics, including CSV exports.
- Admins see platform totals (installs, new packages, new users, top packages).
- Public pages only show the total download count and ratings.
Opt out#
The CLI sends tool, OS family, CLI version and the CI flag as request headers. Turn this off:
export DENOFY_TELEMETRY=0
# or the cross-tool convention
export DO_NOT_TRACK=1With telemetry off the CLI sends x-denofy-telemetry: off, no tool/OS/version headers, and the
registry records the download without a visitor hash, tool, OS, version or country. The download
still increments the package's public download counter, because the file is still served.
On the website, Denofy respects the browser's Global Privacy Control (Sec-GPC: 1) and
Do Not Track (DNT: 1) headers: page views from such browsers are counted without a visitor
hash and without country.
Legal basis#
Analytics are processed on the basis of legitimate interest (Art. 6 (1) (f) GDPR): showing authors how their packages are used, without personal data being stored. Questions: open an issue on GitHub.