# What vendors see about users

Vendor analytics show a vendor numbers about other people's repositories. The
rules below keep those numbers from pointing at one organization.

## What a vendor sees

- **Ranges, never counts.** Every number is a range with a small random
  change added. A small group shows as **fewer than 15**, and a group of fewer
  than 5 is never shown.
- **Organizations, not repositories.** The unit is the GitHub account that
  installed Upseam, counted once however many repositories it has.
- **Public numbers.** The npm downloads are public registry numbers.

## What a vendor never sees

- The name of an organization, a repository or a user.
- Code, matched lines, diffs or file paths.

## Who is counted

An installation counts for a change only when all of these hold:

- it is not suspended;
- it was installed at least 30 days before the change was published, so an
  installation added after a release never counts;
- it is not the account that owns one of the vendor's registered
  repositories;
- it does not hold the vendor's own source repository;
- its owner has not turned off **Vendor statistics** under Settings, Access
  and data. Turning it off leaves the installation out, past activity
  included.

## How the noise works

Upseam adds the random change inside its database, so the App never receives a
true count. The same true count always shows the same value, so reloading a
page or asking again does not average the noise away. Where a number is split
into parts, only the parts get noise, and the total is their sum.

## What Upseam stores about users

For a match Upseam stores the path, the line and the symbol, never your code.
See [Trust and your data](trust.md) for everything Upseam stores.

:::cards Related resources

- [Analytics](vendor-analytics.md)
  The screens a verified vendor sees.
- [Privacy Policy](privacy.md)
  How Upseam handles personal data.

:::