back to overview 
More blogs This website is made to show how websites are able to track you. This does mean that we have to collect sensitive data that we could use to track you. This page explains what we collect, what stays in your browser, and how we protect the rest.
Analytics: Self-Hosted Umami
We use Umami for website analytics. Umami is open-source and cookieless, and we self-host our instance, so nothing is shared with any third party. It records page views and which features get used; that small ping you may notice in your browser’s network tools is Umami at work. We use it only to understand how the site is used and what to improve. The tracker is configured to drop query strings, so your files, inputs and results are never part of that ping.
IP Address Geolocation
To turn the IP address your browser sends to all websites into a physical location, we do most of the work ourselves: our server hosts its own copies of two geolocation databases (DB-IP Lite and MaxMind’s GeoLite2), refreshed monthly, so those lookups never leave our machine. Alongside them, the homepage map still queries two commercial APIs — iphub.info and ipinfo.io — because showing how several providers disagree about where you are is part of the demonstration. Those API calls are made from our server, which limits what these services receive to your IP address alone. The map imagery itself comes from CARTO’s tile CDN, which your browser contacts directly, like any image host.
AdBlock Test
Our AdBlock test functionality checks if your browser is blocking advertisements. To do this effectively, the test attempts to load a resource that is commonly blocked by ad-blocking software. This resource is hosted by Google (specifically, a script related to Google Ads). We explain the technique in detail in how websites detect your ad blocker.
We are aware that loading any Google-related URL could potentially send some information to Google, such as your IP address and browser details. On the homepage, the AdBlock test sits behind a consent button: the test and its Google URLs load only after you click it. The two articles about ad blocking are the exception — they run the test on page load, because the test is what those pages are about, and opening them is the consent.
Browser Fingerprint Hashes
Bscan.info allows you to generate various browser fingerprint hashes (e.g., font, canvas, audio). We maintain a database of these hashes — only the hash values, never the underlying data: your font list, canvas pixels and audio readouts stay in your browser. Alongside each hash we keep the browser’s user-agent string and when it was last seen, which is what powers the ‘top browsers for this hash’ display. It’s important to understand the following:
- Anonymity: We never store your IP address itself, or any other personally identifiable information, alongside a hash. To keep the rarity statistics honest, we keep a scrambled version of your IP (a salted, one-way hash) that can’t be looked up back to your address. It is used for one thing only: counting each visitor once per fingerprint, so refreshing the page can’t inflate how common a hash looks.
- No Third-Party Sharing: This database of fingerprint hashes is for our internal research and to improve the service (e.g., by providing context on how common a specific hash is). We will not share this raw fingerprint data with third parties.
- Purpose: The primary purpose of collecting this data is to provide users with insights into their own digital footprint and to contribute to the broader understanding of browser fingerprinting techniques. The “comparison” feature, where you can share a link with your fingerprint hashes, is entirely opt-in and designed for users who wish to compare their fingerprint across different browsers or sessions. The data shared via this link is based on the parameters in the URL you choose to share.
WebRTC and Other Leak Tests
Tests like WebRTC, timezone, and incognito mode detection operate locally within your browser or by making requests that are essential for the test’s function (e.g., STUN requests for WebRTC, which are inherent to how WebRTC works — ours go to a public Google STUN server, as most of the web’s do). We display the information these tests reveal directly to you. For IP-dependent tests like WebRTC, the public IP displayed is the one fetched as described in the “IP Address Geolocation” section.
Live Behavior Monitor
The homepage includes a live behavior monitor that shows what bot-detection systems read from the physics of your input: how your cursor moves, whether clicks are preceded by real mouse movement, and when the page has your attention. All of it happens inside your browser, and none of it leaves. The monitor’s session counters live in tab-local storage that is erased when you close the tab — close it and everything is gone.
Privacy Tools
The utilities under /tools (the 2FA generator, the password checker, the metadata removers, and the rest) process everything locally in your browser. Your files, passwords and secrets are never uploaded; the only thing those pages send anywhere is the analytics ping described above. One nuance worth knowing: the 2FA generator’s sharing feature packs an encrypted copy of the account into the link itself, so the encrypted blob travels with that URL — but only the password you share separately can open it, and neither the password nor the unencrypted secret ever touches our server.
Our Philosophy
We believe that tools designed to help you understand your online privacy and security should, themselves, be built with privacy as a foremost concern. We strive to minimize data collection, anonymize where possible, and be transparent about our practices.
We are not perfect, but the promises on this page get acted on. The self-hosted geolocation databases described above used to be a “someday” plan — today they answer most location lookups without your IP ever leaving our server. The remaining third-party API calls exist because comparing providers is the point of the map; if that ever stops being true, they go too.
Feedback
We value your feedback! If you have questions about our privacy practices or suggestions for improvement, please feel free to reach out to us using this form: Link to feedback Form (the form is anonymous and hosted on an open-source form website).
