// PRIVACY AUDIT

Map your footprint. Score the leak. Get a plan.

Most of us can't say who holds our data or what they do with it. This walks you through it a few questions at a time, then hands back a single grade and a ranked list of fixes — quick toggles first, bigger moves after.

01 Pick the services you use 02 Answer a few short questions 03 Get your score & plan

Runs entirely in your browser — nothing is uploaded. Saving = exporting a file you keep.

// STEP 1 — INVENTORY

Which of these hold your data?

Tap everything you use — email, search, your phone, social, cloud, banking, wearables, your car. You can change this later.

Not listed? Add a custom service

// STEP 2 — DETAILS

Fine-tune what each service holds

We've pre-filled the data each service usually collects, and what you've likely done to limit it. Adjust anything that's off — or just continue. This step is optional.

Tap a service to expand it. Mark what of yours it holds and what you've done to limit exposure — each change updates your score live in the header.

// STEP 3 — HABITS

A few habits that apply everywhere

These cut across every account. Answer honestly — there's no wrong answer, just a clearer picture.

// STEP 4 — LIVE GRADES (OPTIONAL)

Want live crowd grades, too?

Your score already works from a built-in baseline. Optionally, overlay live Class A–E ratings from ToS;DR (Terms of Service Didn't Read), matched to each service by domain.

This pulls public ratings from tosdr.org and refines recipient risk per service. It's optional, and if your browser blocks the request the tool quietly falls back to the baseline.

Live grades not loaded — scoring from the built-in baseline.

Crowd-sourced Class A–E ratings · tosdr.org

DATA SOURCE — Recipient risk combines two layers. The built-in baseline (business model, jurisdiction, declared data collection, policy flags) ships with the tool and works fully offline. Sync grades from ToS;DR overlays live crowd-sourced Class A–E ratings from tosdr.org (Terms of Service Didn't Read), matched to each service by domain and refreshed daily at the source — the same /appdb/version/v2 and /service/v3 endpoints their browser extension uses. If your browser blocks the cross-site request (some do for a file opened locally), the tool falls back to the baseline and tells you; serving this file from a domain, or behind a one-line proxy, resolves it. Grades attach at the company/domain level, so a product without its own ToS;DR review inherits its parent's grade (e.g. Gmail and Drive take Google's), shown with a dashed chip and a ↑ marker. Brands ToS;DR hasn't reviewed at all — many automakers, niche wearables — stay a grey "–" rather than borrow an unrelated grade. Ratings are a starting point — verify the current policy for anything that matters.