Digital Footprint Cleaner
find your exposure and generate the removal requests
Telling someone they are not listed, when the check merely failed, is the worst thing a privacy tool can do.
A plain web search surfaces mentions of a person. The real exposure is the data brokers and people-search sites that aggregate an address, a phone number, an age and a list of relatives into one page, and those pages do not rank well in a general search. So a scan here is a plan of narrow searches rather than one broad query: name variants, a location-scoped pass, site-scoped checks against ten platforms, public-record sweeps, and a deep check that queries each broker's own domain individually to find the listing a broad scan misses.
Narrowing factors, an employer or a school or an age, are scored against every result so a different person with the same name in another state sinks instead of being reported as your exposure. They are deliberately never added to the query itself: extra search terms AND against a full-text index, so a factor-stuffed query finds fewer pages rather than more. Every result is banded strong, likely or possible with the matched facts shown, and pages that never name the subject are separated out rather than counted toward a score.
The design decision the whole tool turns on is that every check reports one of three states, not two: found, not found, or unknown. Unknown means the check was blocked, throttled or timed out, and it is coloured differently everywhere it appears. Platforms that answer unreliably, and there are several that return a 200 for every handle that exists or does not, are not requested at all rather than guessed at. A deep scan says "9 of 11 checks completed" and names the two that did not, so a throttled sweep can never be read as a clean result.
It runs on your own machine and refuses any request whose Host header is not localhost, which is what blocks DNS rebinding: without that check, any page open in your browser can reach a service bound to 127.0.0.1 and be treated as same-origin, and CSRF tokens do not stop it. There is no JavaScript at all, disclosure panels and the confidence filter are details and summary elements and :checked CSS, which is what lets the Content-Security-Policy stay as strict as it is. An optional passcode uses PBKDF2-SHA256 with a per-install salt, and when no passcode is set the header says Unlocked, so nobody is left assuming a protection that is not there.
Removal is treated as a correspondence rather than a click. Petitions cite the legal basis you choose, GDPR or CCPA and CPRA or India's DPDP Act, with the right statute and deadline, and a local tracker records who was written to, what they said, and what still needs chasing. Brokers re-list people after three to six months, which is where the long game actually is.
- Python 81.2%
- HTML 12.2%
- CSS 6.6%
Built from
What is still true
- The deep check is bounded. It covers the first eight brokers inside a 25-second budget, because the search backend throttles hard, and the rest are reported as skipped rather than clean.
- Broker removals are not permanent. Data typically reappears, which is the reason the tracker exists.
- It is still in development, and the repository says so rather than implying a finished product.
Screenshots
Roads out
Related articles
- Local-first software
Most software you use today runs on someone else’s computer. Local-first software runs on yours. Here is what that changes, what it costs, and why nearly everything I build works this way.
5 min read · 2026-08-28
Neighbouring holdings
- Read the charter of bruhswer shares privacy, privacy-tools, python
- Read the charter of NCAA Outcome Predictor shares flask, python