Nothing to hide. Here's what the server sees.
The server is blind to your passwords, pad codes, ips, and ciphertext. What it can count is how many pads get created, how many devices connect, and roughly how many bytes flow through per day. Those counts live here. No analytics, no cookies, no tracking. Updated every 10s cache window.
Right now
Daily activity
Breakdowns
What gets pasted
Count of relayed items by content type across all recorded events. This is item count, not bytes.
WebSocket vs long-polling
Count of connection openings by transport across all recorded events. This shows how clients connected, not how much data they sent.
Lifetime totals
Server instances
Each server in the deployment owns its own SQLite file in /share/_stats/. Read-only aggregation at query time — no shared write path.
| instance | started | uptime | live pads | live conns |
|---|
No ip, no pad code, no content
Every row in the stats DB is a small enum (kind), a unix timestamp, an optional byte count, and optional type/transport enums. If the DB leaked you would learn aggregate service load and nothing about any user. The raw JSON feed is at /api/stats — memoized for 10s.