ClickSnitch — DOM Privacy Leak Sniffer

Snitches on every company your clicks talk to. Real-time DOM-to-network privacy leak detection and tracker auditing.

Catch who's tracking you online — click by click. Nothing ever leaves your browser. Most privacy tools look at a whole webpage as one blob. ClickSnitch goes deeper: it shows you what happens the exact second you click a button, submit a form, or scroll a page — and names the real companies that received your data. Click "Check out" or type an email, and ClickSnitch immediately shows which ad networks, analytics firms, and data brokers were contacted in the background — before any consent was given. HOW IT WORKS • Real-time DOM-to-network attribution — every outgoing request is tied back to the exact element (button, link, input, scroll) that triggered it. • Dual-layer capture — in-page hooks pinpoint which element fired a request; a network-layer observer catches everything else: tracking pixels, sub-frame requests, and requests that fire before page scripts load — with real HTTP status codes. • Corporate unmasking — cryptic domains like doubleclick.net, adnxs.com or demdex.net are resolved to their real owners (Google, Microsoft, Adobe...) using the bundled DuckDuckGo Tracker Radar dataset: 5,500+ domains, 770+ parent companies. Loaded entirely from local disk. • CNAME-cloak detection — flags "first-party" subdomains (e.g. metrics.brand.com) that are really disguised trackers used to slip past ad blockers. • Plain-English verdicts — no jargon. ClickSnitch scans outgoing payloads for leaked emails, phone numbers, and identifiers and tells you, in plain words, who received them. THE FIVE VIEWS • Leak Inspector — request stream per interaction, payload/header decoder, PII scanner, and an A–F privacy score. • Cookie Vault — first- vs third-party cookies with HttpOnly / SameSite / Secure flags. • Fingerprint Radar — canvas, WebGL, AudioContext, WebRTC and screen-fingerprinting attempts. • Blocked Matrix — one-click "Shield Me" converts any detected tracker into a native Chrome block rule. • Domains — every tracker destination aggregated across the session. REPORTS • Privacy & Compliance Audit (PDF) — a print-ready, numbered document: executive summary, regulatory exposure table (GDPR Art. 6/7, ePrivacy Art. 5(3), CCPA/CPRA), third-party data-recipient breakdown by company, cookie inventory, fingerprinting log, PII findings, methodology and disclaimer. • Findings (JSON) — the same results as structured data, for spreadsheets or your own tooling. • HAR export — standard HTTP archive for DevTools, Charles, or Postman. PRIVACY 100% local execution. Zero external servers, zero backend, zero telemetry, zero analytics. Your browsing history, visited URLs, inspected payloads and cookies never leave your device. The tracker dataset is bundled — no domain you visit is ever sent anywhere for lookup. WHAT'S NEW IN 1.2.0 • Rebuilt on the full DuckDuckGo Tracker Radar dataset (5,500+ domains, 770+ companies) • Network-layer capture catches pixels, sub-frame trackers, and pre-script requests • New GDPR / ePrivacy / CCPA Compliance Audit PDF and structured Findings JSON export • CNAME-cloaked tracker detection • Streamlined to the five core inspection views • Accuracy and consistency fixes throughout