Nexpad reads a token straight from Solana: who can still mint or freeze it, which extensions are switched on, whether its name can change, how concentrated the largest wallets are and where its curve or pool stands. Nothing is stored on a server and nothing needs a wallet.
Sources: Solana JSON-RPC (account data, largest token accounts, Metaplex metadata, pump.fun curve account) and the public DexScreener pair index for price and liquidity. Answers are cached for 30 seconds per mint. Findings follow fixed rules listed in the docs; they describe permissions and distribution, not intentions.