No cookies. No account. Nothing stored.
This page shows you what every website learns about your device.
Only once you agree. Until then not a single script runs here that reads anything about you. After that you see every value one by one, explained in plain language.
Reading …
values from your device
This is what we read in a few seconds
A few of them in plain text
Your code on this visit
Where the values come from
This is how many readable features each area of your device handed over. The longest bar is usually not the one you expect.
How unique are you?
The stable features can be turned into a short code. It stays the same even if you delete cookies or browse in a private window.
What studies say about this
The Electronic Frontier Foundation's «Panopticlick» study found in 2010 that around 84 per cent of the browsers tested were unique. A larger French study from 2018 with about two million visitors found roughly one third for phones; phones resemble each other more closely, iPhones especially. To stay honest: uniqueness is not guaranteed, but combined with address, time of day and behaviour it is almost always enough.
How many browsers are unique
The two upper bars come from published studies, not from measurements on this page. The lower one stands for your visit: for this page you are unique, because it would recognise you by your code.
Where your finger is right now
Move your finger across the screen or tap. The field shows your display to scale; every touch appears as a circle in the measured width of your finger, with pressure and trail. None of it is stored.
On a computer the mouse pointer takes over. The values beside it are exactly those the browser hands to every website, without any prompt.
Your behaviour, second by second
This curve grows while you read. Session replay services record a visit in exactly this way, except that they keep it.
Stage 2: what needs to ask first
Nothing has been requested up to this point. A website reads the following values only if you give the browser explicit permission. An app asks in exactly the same way; the difference is that an app keeps the access afterwards.
Location
Accurate to a few metres, with altitude and direction of travel. This is how a weather app asks, and it keeps the access.
Motion sensors
Acceleration, rotation rate, orientation in space. From this one reads whether somebody is walking, travelling or typing.
Camera and microphone
Only after permission do the device names appear, for instance the name of your headphones. Nothing is recorded; the access is closed again immediately.
All fonts
The complete list of installed fonts, not just the guessed ones. Chromium browsers only.
Clipboard
Only the length is shown, deliberately not the content. The point is solely that a page could read it.
Which permissions you have already granted
Without a single prompt it can be read off which permissions you have already granted or refused in this browser.
Your report
Take the result with you. Both are created in your browser; nothing is sent anywhere.
And what does an app see?
An app sees everything the browser sees, plus a great deal the browser never hands over. The decisive part: every analytics or advertising component built into the app runs with the same rights as the app itself.
You give permission to the app. You get the companies inside the app for free.
Readable without asking
| Feature | iPhone | Android |
|---|---|---|
| Exact device model, system version | yes | yes |
| Device name | since iOS 16 only «iPhone» | partly via the Bluetooth name |
| Battery level and charging state | yes, in five per cent steps | yes, plus charging type, temperature, voltage, health |
| Power saving mode, overheating | yes | yes |
| Screen brightness, volume | yes | yes |
| Connected headphones and their name | yes | yes |
| Total and free storage, memory | yes, since 2024 only with a stated reason | yes |
| Last restart, uptime since boot | yes, since 2024 only with a stated reason | yes |
| Installed keyboards | yes, since 2024 only with a stated reason | default keyboard yes |
| Language, region, time zone, calendar | yes | yes |
| Accessibility settings, font size | individual switches can be queried | list of active accessibility services |
| Mobile carrier, SIM country | no longer since iOS 16 | yes |
| Wi-Fi or mobile, concealed connection active | yes | yes |
| Raw motion sensors | yes | yes, sampling rate limited |
| Air pressure, magnetic field | yes | yes |
| Advertising ID | only after consent, since iOS 14.5 | yes, unless deleted |
| Vendor ID across all apps of one provider | yes | similar |
| Developer options, modified systems | detectable | detectable |
| Other installed apps | only targeted checks of up to 50 pre-declared ones | since Android 11 only declared ones; with a special right all of them |
| Clipboard | only with a paste prompt or notice, since iOS 16 | only in the foreground, with a notice, since Android 12 |
Only with permission
| Feature | iPhone | Android |
|---|---|---|
| Precise location, also in the background | yes | yes |
| Wi-Fi name and router identifier | only with location permission | only with location permission |
| Bluetooth devices nearby | yes | yes |
| Devices on the home network | yes, with a prompt since iOS 14 | without a prompt; a dedicated permission is being introduced |
| Activity: walking, driving, cycling | yes | yes |
| Contacts, calendar, photos | yes | yes |
| Photos including place and time of capture | yes | yes |
| Camera, microphone | yes, with an indicator dot | yes, with an indicator dot |
| Health data | yes | yes |
| Usage statistics of all apps | no | yes, via «usage access» |
| Screen content and input of other apps | no | yes, via the accessibility right |
What an attacker does with this
Apple's own list is the best piece of evidence: since May 2024 apps in the App Store must justify why they query boot time, free storage, file timestamps, active keyboards or stored settings. Apple lists these interfaces because they were misused for covert fingerprinting.
The components inside the app
The data flows out by three routes: analytics components, advertising components and the real-time advertising auction. The third route does not even need a malicious app: every advertisement distributes device data to numerous bidders.
| Kind | What is typically collected |
|---|---|
| Analytics | every screen view, every tap, session length, device data |
| Attribution | which advertisement led to the install, advertising ID, address, device |
| Advertising | advertising ID, location if permitted, interests, battery level, network |
| Crash reports | device state, memory, last actions |
| Screen recording | video of app usage, taps, swipes |
| Location components | location in the background, often paid for to the app developer |
The advertising auction
Every advertisement starts an auction within milliseconds. Device data, location, app name and advertising ID are sent to many bidders, including those who never win and only collect the data. The app itself often does not notice.
This is not theory
Every case is publicly documented. The sources are listed with them.
The cases over time
Each mark is a documented case from the table below.
| Year | Case | What happened |
|---|---|---|
| 2025 | Gravy Analytics | Attackers obtained location data from a data broker; the lists named thousands of well-known apps whose advertising data had been siphoned off, often without the developers' knowledge. |
| 2025 | Advertising component and Android apps | Websites passed browsing data on the device itself to locally running apps of the same group; stopped after publication. |
| 2024 | Trade in location data | A data broker offered billions of location points from Germany as a free sample; journalists identified individuals from it, including soldiers and government employees. |
| 2024 | X-Mode and Outlogic | The US trade commission banned the sale of sensitive location data. It had become known that data from, among others, a Muslim prayer app went to military contractors. |
| 2024 | Avast | A fine, because the security company had sold its users' browsing data through a subsidiary. |
| 2022 | Kochava | A complaint by the US trade commission over location data that made visits to clinics and places of worship traceable. |
| 2021 | Grindr | The Norwegian data protection authority imposed a multi-million fine for passing user data to advertising partners. In the same year a US priest was outed with the help of purchased app location data. |
| 2020 | Clipboard | iOS 14 made it visible that numerous well-known apps read the clipboard on opening. |
| 2018 | An advertising component | A human rights organisation showed that many apps sent data to a social network on launch, including data about people without an account there. |
What an ad blocker does, and what it does not
Ad blockers protect well against foreign code from advertising and tracking networks, but not against fingerprinting by the site you are visiting, and not at all inside apps.
What it protects against
- Fraudulent advertisements, fake prize draws and investment scams that reach reputable sites through ad networks. The US federal police explicitly recommended ad blockers at the end of 2022, after fraudsters placed fake advertisements in search results.
- Embedded third-party scripts: chat windows, statistics, fonts, program libraries. If the provider is taken over, their code runs on all customer sites; in 2024 the domain of a widely used service was sold and then delivered malicious code on over 100,000 websites.
- Covert computing: scripts that make the device work for cryptocurrency and drain the battery.
- Redirects to fake sign-in pages.
What it does not protect against
- Fingerprinting by the site you are visiting; its scripts cannot be blocked without destroying the site.
- Server-side values such as address, headers and encryption fingerprint.
- Apps: a browser blocker has no effect there. Only network-wide filters help, and they only partly.
- The extension itself: a blocker may read every page. Use only well-known, open-source blockers.
What you can do now
The list is tailored to the device detected. Most important rule: install updates immediately, grant rights sparingly, use a browser with built-in protection instead of many extensions.
iPhone
- Settings, Privacy, Tracking: turn off «Allow apps to request to track»
- Location per app set to «While using» or «Never»; precise location only for map apps
- In Safari enable advanced tracking and fingerprinting protection for all browsing
- Check local network, Bluetooth, motion and fitness per app
- Review the App Privacy Report: which app accessed what, and when
Android
- Delete the advertising ID (Settings, Privacy, Ads)
- Review «usage access» and «accessibility» and withdraw them from all third-party apps
- Location per app, turn off precise location
- Set up private DNS with a tracking filter
- Review the privacy dashboard regularly
Browser, all devices
- Firefox with strict protection, Brave or Safari instead of Chrome
- One well-known, open-source ad blocker
- As few further extensions as possible
- Set location, camera, microphone, notifications and motion sensors to «Ask»
Everyday life
- Set up third-party billing blocking with your mobile provider
- Avoid cleaner, booster and free concealment apps
- Read the privacy section in the App Store before installing
- Delete unused apps; every app is an open door
- Send photos without location data before sharing them
What this page stores
Nothing.
- No cookies, no local storage, no session identifier, no account.
- No access log: logging is switched off in the web server for this site. The error log runs without addresses.
- No statistics, no audience measurement, no third-party scripts, no fonts from foreign servers.
- All measured values stay in the memory of your browser tab and disappear when you close it.
- Technically unavoidable: to deliver the page the server sees your address. It shows it to you and writes it down nowhere.
- The site runs on its own server in Germany. In front of the server sits a service protecting against overload; for technical reasons it also sees the connection data.
Because nothing is stored, there is also nothing to give information about or to delete.