SSysLeak

Reference

Privacy policy

SysLeak exists to show you what your browser leaks. A privacy tool that abuses privacy is worthless, so this policy is short, specific, and matches what the code actually does — the code is open to inspection and the claims below are enforced by automated tests.

What we process, transiently

When you load a page, our server reads your connection data — IP address, and from it your approximate location, timezone and network operator (via a locally hosted GeoLite2 database; your IP is never sent to a third-party geolocation service). This is computed per request, shown to you, and discarded. Your IP address is never written to a database and never written to a log file. For rate limiting, a one-way hash of the IP briefly exists as a counter key and expires with the rate window.

What happens in your browser, stays there

The fingerprint collectors, the WebRTC leak test and the Exposure Score all run in your browser. Raw values — your user agent, canvas hash, font list, WebRTC candidates, all of it — are displayed to you and sent nowhere by us. The one exception you should know about: the WebRTC test asks your browser to contact a public STUN server (stun.l.google.com), because that reflection is the mechanism being tested. That request comes from your browser, not from us, and the page discloses it where the test runs.

What we store: anonymous salted hashes, nothing else

To tell you “you share this exact fingerprint with k of N devices,” your browser sends hashes, never values: one hash per signal's value, one hash of the full combination, and one hash of a stable subset used only to recognize repeat visits from the same device — so reloading doesn't inflate the statistics. No cookie and no stored token is involved; the recognition is derived from the same signals shown to you. The server re-hashes everything with a secret salt before storing, so even someone with a copy of the database cannot check whether a known fingerprint is in it. What sits in the database is one row per distinct device: opaque salted hashes and day-granularity dates. No raw signal values, no IPs, no timestamps finer than a day. Devices idle for 90 days are deleted, and the comparison only ever counts the last 90 days.

What we don't do

  • No cookies — this site sets none, for anything.
  • No third-party trackers, ad scripts, or analytics that profile you.
  • No accounts, no emails, no personal data at rest of any kind.
  • No selling, sharing, or transferring of data — there is nothing to sell.
  • No fingerprinting of you for our purposes: the one recognition we perform — a salted hash that tells returning devices apart — exists solely so repeat visits don't double-count in the anonymous statistics. It is never used to track you, profile you, alter what you see, or link anything to an identity.

Questions

The scoring methodology is public on the methodology page, and the security measures behind these claims are documented in the project's SECURITY.md. Contact: privacy@sysleak.com.