TraceGuard Privacy Extension

TraceGuard scores the privacy practices of the sites you visit, and keeps a record of what you have handed over, so you can see both sides of the same picture. It runs entirely on your device. WHAT YOU GET Website Safety Score, 0 to 100, for every site you visit. Six checks run on the page itself: - Reputation, against a bundled phishing and malware blocklist - Third-party trackers, from DuckDuckGo Tracker Radar, Disconnect and EasyPrivacy - Cookies and their flags, names and metadata only, never values - Fingerprinting attempts - The kinds of form fields the page asks for - The site's privacy policy grade, from ToS;DR User Privacy Score, 0 to 100, for you rather than for a site. It is derived from what you have actually handed over: which kind of data went to which site, how risky that site was at the moment you entered it, and how long ago that was. Older entries fade, so the number reflects what is still live rather than a total that only grows. Visiting a site does not move it, because which sites appear in your browsing is mostly not your choice. Your Footprint, the record behind that score: - Every kind of personal data you have entered, such as an email, a password, a card or an address, which sites hold it, and when each was last seen - Entries you may have forgotten, each flagged with its reason: a site you visited only once, a site that scored poorly when you entered the data, or a site you have not seen in months - The tracker companies whose code loaded across your sites, ranked by how much of your browsing each one covered, so a company on dozens of pages stands out from one on a single page A warning where the decision is made. When you start typing into a sensitive field on a site that scored poorly, TraceGuard asks whether you trust the site and tells you what that entry costs against what it would cost on a site we could vouch for. Every alert is listed in the app. System notifications are rationed, so you get at most one per site per browser session instead of an interruption for every page. WHAT TRACEGUARD DOES NOT DO - It does not block anything. It has no blocking permission. A request the dashboard marks as stopped was stopped by your browser or by another extension. - It never sees what you type. It records the type of field on the first keystroke, never the value. It cannot tell an abandoned form from a submitted one, it cannot detect password reuse, and it cannot tell what a site did with your data afterwards. - It has no account, no backend, and no telemetry. Nothing about your browsing is sent anywhere. - It cannot stop a site from keeping data it already has. PRIVACY AND CONTROL Your history is encrypted behind a master password you choose, called the vault. While the vault is locked, new entries are held in memory and encrypted to disk once you unlock. You can export or delete everything from Settings at any time, and developer mode adds an on-device trace that shows how a score was calculated. The extension reads cookie names and flags from `Set-Cookie` headers, which is why it does not ask for the `cookies` permission, and it never records a request's path or query string. The only optional network request is Live rating updates, which is off by default. When you enable it, TraceGuard sends the domain of an unrated site to ToS;DR to look up a policy grade. No other browsing data is included. The phishing and malware blocklist refreshes over a signed update that carries no browsing data. Translated into Spanish, French and German, with light and dark themes. Open source under AGPL-3.0, with the code on GitHub.