Privacy checkup

What this website can see about you

Every site you visit learns a few things automatically: your address on the internet, roughly where it is, and a surprising amount about your browser and device. This page shows you exactly what, measured right here in your browser.

It keeps nothing. No cookies, no analytics, no outside services, no database. It even checks itself, live, after your results. If you're into this stuff, every section has a raw-data view, and How this page works explains how to verify all of it in your browser's developer tools.

At a glance

Your results

Plain answers first. Each line links to the details further down. Nothing here is a score, because there is no fair way to boil privacy down to one number.

1 · Connection

Your internet address

Not tested

Every site you visit gets your IP address. It's needed to send the page back to you. From it, anyone can look up which company connects you to the internet and roughly where that connection lives.

IP address216.73.217.63 (IPv4)
Provider (from the address)Checking…
Network number (ASN)—
Looks likeNot tested (my heuristic)
Web protocol—
Encryption—
Nearest Cloudflare data center—

The network check didn't load. The data center is the Cloudflare building your request entered. It usually sits near your real location, or near your VPN server.

Raw network data (what Cloudflare reported for this request)
Not loaded

tlsClientCiphersSha1 / tlsClientExtensionsSha1 are hashes of your browser's TLS hello. Like the fingerprint words, they describe your software, not you, and they don't change with a VPN.

2 · Location

Where your address says you are

Not tested
City / region / countryChecking…
Postal code (approximate)—
Coordinates—
Time zone for that address—
Your browser's clock—
Your browser's languages—

IP location is a database guess. It's often right about the city or the provider's hub, and often wrong about the street, sometimes by dozens of miles. The coordinates are the center of that guess, not your house.

Consistency check

  • Clock vs. address: Can't compare (no time zone for this address).
  • Language vs. country: Can't compare.

Optional: compare with your device's own location

Your browser will ask first. If you allow it, the coordinates are used here, in this tab, to draw the picture below. They are never sent anywhere, and closing the tab forgets them.

3 · Same-browser test

Could a site recognize you without cookies?

Checking…

Sites can measure small details of your browser (how it draws text, your graphics chip, your fonts, your screen) and combine them into a fingerprint. I turned yours into three words. The words leave out your IP address on purpose.

Your browser's fingerprint words

measuring…

 

  1. Write down the three words.
  2. Open this page again in a private window, or clear your cookies, or switch your VPN on or off.
  3. Same words? Sites could recognize this browser again even without cookies. Different words each session? Your browser randomizes its fingerprint. That's a good sign.

Before and after: what does a VPN change?

Take a snapshot, switch your VPN on (or off), then check again. The page doesn't reload, and the snapshot lives only in this tab's memory.

Raw fingerprint data (per-signal hashes)
Measuring…

4 · Privacy signals

Is your browser asking sites to back off?

GPC off
Global Privacy Control (Sec-GPC header)Not sent
Global Privacy Control (JavaScript)—
Do Not TrackOff / not sent

Global Privacy Control is a simple “don't sell or share my data” signal your browser sends with every request. It carries legal weight in some states. In California, businesses that sell or share personal data must treat it as a valid opt-out request (CCPA regulations, §7025), and from 2027 every browser must offer a setting for it (AB 566). Texas law has recognized browser opt-out settings since January 1, 2025, for targeted ads and data sales, with conditions: the signal must be your choice rather than a default, and businesses can decline requests they can't verify (Texas Data Privacy and Security Act, §541.055(e)–(f)). Treat it as a firm request, not a guarantee.

Do Not Track was an earlier attempt. It never became a real standard, most sites ignored it, and Firefox removed it in version 135. GPC replaced it, so don't worry about DNT either way.

5 · WebRTC

Does your browser reveal a second address?

Not tested

WebRTC powers video calls in the browser. To connect calls, it can discover your addresses on its own, outside the normal web request. With some VPN setups, that reveals your real address.

Heads up: this is the only test on the page that talks to another company. It asks Cloudflare's public STUN server (stun.cloudflare.com:3478) to tell your browser which address it sees. Cloudflare receives your address as part of that, as with any connection. Nothing else is sent.

6 · Blocking

Does your browser block ad and tracker patterns?

Checking…

I placed a hidden box with ad-style names and asked for two empty files named like ad scripts, all on this site. No real ads or trackers are involved.

Ad-style box hiddenChecking…
Ad-style file blockedChecking…

This is a heuristic. It shows a blocker is active, not how good it is.

7 · Device & software

What your browser tells every site

Visible to any site

System & browser

Browser—
Engine—
System—
Device type—

Hardware & display

GraphicsChecking…
Processor threadsnot shared
Memorynot shared
Screen—
Window—
Touch points—

Software & devices

Keyboard layout—
Fonts found (of 75 tested)—
Speech voices installed—
Cameras / microphones / speakers—
Storage allowance—
Private window? (heuristic)—

Permissions & status

Permission: geolocation—
Permission: camera—
Permission: microphone—
Permission: notifications—
Battery—
Network estimate—
Cookies enabled—
Automation flag (webdriver)—
You arrived from—

This page sends no referrer onward: every link out of here, and every request it makes, carries no record of where you came from (Referrer-Policy: no-referrer).

Raw request headers your browser sent
accept: */*
accept-encoding: gzip, br
cache-control: private, no-store, no-transform
cross-origin-opener-policy: same-origin
date: Wed, 28 Oct 2026 03:31:52 GMT
permissions-policy: geolocation=(self), payment=(), usb=(), serial=(), hid=(), midi=(), display-capture=(), browsing-topics=()
referrer-policy: no-referrer
user-agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])
x-content-type-options: nosniff
x-invocation-id: cle1::c57qz-1793158312571-5d66342b7b15

No client hints (sec-ch-*) were sent. Firefox and Safari don't send them.

Raw device data
{
  "env": null,
  "device": null
}

8 · Next steps

What I'd do with your setup

  • Run the WebRTC test if you use a VPN

    It's optional and contacts one outside server, which is why it waits for you. It's the classic way VPN users get unmasked.

  • Turn on Global Privacy Control

    It tells sites not to sell or share your data, and some state laws give it teeth. Check your browser's privacy settings for Global Privacy Control.

  • Check what this page can't

    DNS leaks and how your VPN behaves when it drops can't be tested from a single site without contacting others. Mullvad's connection check and the other tools under Go deeper cover those.

9 · Keep a copy

Your report

Copy it as text, save it as a JSON file, or print it. All three are made right here in your browser. Nothing is uploaded.

Everything this page measured (JSON)
{
  "generatedAt": "(stamped when you copy or save)",
  "page": "https://nickscomputerrescue.com/what-we-see",
  "note": "Generated in your browser. Nothing in this file was sent to or stored by the site.",
  "connection": null,
  "consistency": {
    "timezone": "unknown",
    "language": "unknown"
  },
  "fingerprint": null,
  "standardizationSignals": [],
  "browser": null,
  "environment": null,
  "device": null,
  "privacySignals": {
    "gpcHeader": false,
    "gpcJs": null,
    "dnt": null
  },
  "webrtc": "not run (opt-in)",
  "blocking": null,
  "preciseLocation": null,
  "beforeAfter": null
}

This page, checking itself

Starting…

…

Requests to other websites

…

Requests to this site (listed below)

…

Cookies this page can see

…

Blocked by my security policy

Counted by your own browser's performance log. The optional WebRTC test, if you run it, talks to Cloudflare's STUN server outside this log; the page tells you before it does. Saved browser storage for this site: none.

See every request this page made

    10 · Verify it yourself

    How this page works

    What runs: the page loads its own code, styles and fonts from this site. Your browser then runs the checks above locally. It makes exactly one data request, to /what-we-see/api on this same site, which answers with what Cloudflare already knows about your connection (address, provider, location guess, encryption details) and the headers your browser sent. The tracker test fetches two empty files from this site. The before-and-after check repeats the data request. That's all.

    What's kept: nothing by me. No cookies are set, nothing is written to your browser's storage, and the data service has no database, no logging and no analytics. Your results disappear when you close the tab.

    The honest fine print: this site runs on Vercel behind Cloudflare. Like every web host, they keep standard request logs (address, time, page, browser name) for security and operations, under their own policies. Cloudflare also sends a Network Error Logging header that asks your browser to report failed connections to Cloudflare. The optional WebRTC test contacts Cloudflare's STUN server, and only if you press its button. Precise location stays in this tab. A true DNS-leak test can't be done from a single website without involving outside servers, so I link to tools that do it below.

    Check with DevTools: press F12 (or right-click → Inspect), open the Network tab, tick “Disable cache”, and reload. Every row should be this site. Under Application → Cookies and Local storage, you should find nothing set by this page. The security policy below is sent as a Content-Security-Policy header; the line connect-src 'self' is what forbids this page's code from talking to any other server, even if I wanted it to.

    The exact security policy and headers
    Content-Security-Policy:
    default-src 'self';
    script-src 'self' 'nonce-RANDOM-PER-VISIT';
    style-src 'self' 'unsafe-inline';
    img-src 'self' data: blob:;
    font-src 'self';
    connect-src 'self';
    media-src 'none';
    object-src 'none';
    frame-src 'none';
    worker-src 'none';
    manifest-src 'self';
    base-uri 'none';
    form-action 'self';
    frame-ancestors 'none';
    upgrade-insecure-requests
    
    Referrer-Policy: no-referrer
    Permissions-Policy: geolocation=(self), payment=(), usb=(), serial=(), hid=(), midi=(), display-capture=(), browsing-topics=()
    Cross-Origin-Opener-Policy: same-origin
    Cache-Control: private, no-store, no-transform

    The nonce changes on every visit. Styles allow inline rules because the page sets a few with JavaScript; scripts never run inline without the nonce.

    Go deeper

    Other good, independent tests. They are separate sites with their own policies.

    Want help locking this down?

    I help people set up their phones, laptops and home networks so they share only what they choose: browsers, VPNs, DNS, password managers, and the settings that actually matter. Calm, plain-English, and at your kitchen table if you like.

    House calls across the Texas Hill Country. Bring this report and we'll go through it together.

    Nick's Computer Rescue · Center Point, Texas · (830) 510-1425