Tracking Creeper

See who's tracking you — on every website. Tracking Creeper reveals the invisible trackers running on the page you're viewing. One click on the toolbar icon opens a beautifully animated report showing every ad pixel, analytics tag, session-replay script, and customer-data SDK active on the site — with logos, IDs, plain-English explanations, and severity ratings. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT YOU GET PER TRACKER ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Every detected tracker shows: • Logo + vendor — instantly recognizable brand mark • Category — Analytics, Advertising, Session Replay, Heatmaps, Customer Data, A/B Testing, Chat, Attribution, Error Monitoring, or Tag Manager • Severity rating — Low / Medium / High / Very High intrusiveness (color-coded) • What it does — plain-English explanation of the tracker's purpose • Why sites use this — typical use case in real terms • What it collects — page views, conversion events, IPs, session recordings, etc. • Detected ID — the tracker's public ID when extractable (e.g. G-XXXXXXXX for GA4, GTM-XXXXXX, Meta's pixel ID, HubSpot portal ID, Yandex counter ID) • Retention — how long the vendor typically keeps your data • Consent — whether GDPR consent is typically required before load • Detection details — expandable drawer showing exactly which signals fired (which window.* globals, which script srcs, which cookies, which network beacons) • Privacy policy link — straight to the vendor's own policy ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ HOW DETECTION WORKS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Three layers run in parallel and merge results: Globals — checks window.fbq, window.gtag, window.google_tag_manager, and hundreds of other SDK breadcrumbs. DOM — inspects <script src> URLs, inline script contents, <iframe> embeds, <meta> tags, and cookie names. Network — the service worker observes outbound HTTP requests and pattern-matches against 100+ known tracker beacon endpoints (e.g. facebook.com/tr/, google-analytics.com/g/collect, analytics.tiktok.com/i18n/pixel). A MutationObserver re-scans when the page injects new scripts/iframes — so SPA navigations and lazy-loaded tags get caught. The service worker also buffers per-tab network hits, so even beacons that fired before you clicked the icon are captured when you open the report. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% PRIVATE — NOTHING LEAVES YOUR BROWSER ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ • No accounts, no sign-in, no email • No analytics or telemetry on the extension itself • No outbound network requests from extension code • No remote code, no eval, no dynamic script loading • No persistent storage — the scan lives in memory only while the tab is open • Cookie names are read for detection; cookie values, passwords, payment info, and personal data are never accessed Privacy policy: https://awen01.cc/privacy-policy ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHO IT'S FOR ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ • Privacy-conscious users — finally see what's happening on the pages you visit • Developers & QA engineers — verify your tracking implementations are firing correctly, with the right IDs • Marketers — audit competitor sites, learn which platforms they use, attribute their strategies • Compliance teams — quickly inventory trackers on your own properties for GDPR / CCPA / LGPD reviews • Journalists & researchers — document tracking practices across the web • Curious people — answer "what is this site actually doing?" ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PERMISSIONS — FULLY JUSTIFIED ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ • activeTab — read the DOM of the tab where you clicked the icon • scripting — fallback inject on tabs opened before install • webRequest — observe (not block) outbound tracker beacons • <all_urls> — required because trackers fire to dozens of different domains The extension never blocks, modifies, or exfiltrates traffic. It only reads, explains, and displays. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Open source. Built with care. Made for the curious.