Privacy

Last updated 2026-10-21. This page covers the stalemap npm package, its Claude Code plugin, its MCP server, its GitHub Action and this website.

What stalemap doesn't do

It doesn't upload your source code. The scan of your imports and config files runs on your machine.
It has no server of its own, no account and no telemetry. It doesn't collect, store or sell personal data.

What it sends, and to whom

To work out what changed in your dependencies, stalemap requests public data from these services:

The npm registry (or the registry you configure): the names of your dependencies, to read their versions and download their published type declarations.
GitHub: the packages' repositories, to read changelogs, releases, pull requests and upgrade guides. If GITHUB_TOKEN is set or you're logged in with gh, that token is used, for a higher rate limit.
models.dev: the list of models and their training cutoffs.

Those requests contain package names and versions, plus the usual request metadata (your IP address, a user agent). Each service's own privacy policy applies to them.

Optional features that use Claude

Only if you turn them on with --llm, --examples or --guides, stalemap sends type diffs, release-note excerpts, upgrade-guide text and the names of APIs your project imports to Claude, through the Anthropic API or your local claude CLI. Your code isn't included. stalemap probe sends its probe prompts to the provider you choose.

What it stores

Caches of the downloaded data live on your machine in ~/.cache/stalemap (or $STALEMAP_CACHE). Deleting that folder removes them. The notes block it writes goes into your project's CLAUDE.md or AGENTS.md.

This website

stalemap.com is a static site hosted on Vercel. It sets no cookies and runs no analytics. Vercel may keep standard server logs.

Contact

Questions or concerns: github.com/Umair/stalemap/issues, or privately through the repository's security advisories.