Where a Digital Footprint Check Gets Its Data

A digital footprint check derives its data from specific files within a user's archive. This mapping outlines which files are accessed, skipped intentionally, and the distinction between reading and writing operations. The report's credibility hinges on this aspect, as the numbers presented depend on it.

The file extraction yields an archive containing approximately twenty files. The tool solely reads files pertinent to post content and account history. These files include:

1. tweets.js: Holds every historical post, timestamps, and engagement counts. It serves as the primary source for the overall health score and risk list.

2. like.js: Records like history, revealing interest patterns and topic exposure.

3. direct-messages.js: Stores direct message history, aiding in identifying shared contact details.

4. phone-number.js and email-address-change.js: Trace linked contact details and change history.

5. ip-audit.js and account-creation-ip.js: Document login and account creation records, useful for timeline verification and region inference.

6. tweets.js: Performs the primary analysis, with other files acting as supplementary checks.

Each report block has a distinct origin. The main score utilizes tweets.js, weighted by item count and risk category. The list of risk items stems from tweets.js, which also identifies sensitive topics and applies pattern matching for phone numbers, emails, addresses, and locations. Additionally, tweets.js references dictionary and context rules, flagging false positives.

Timeline verification relies on tweets.js and ip-audit.js for aggregated data, while contact exposure assessment involves tweets.js, direct messages, and account files. The file selection process intentionally skips unrelated information, such as ad engagement records, follower and following lists, device tokens, and language tags.

The parsing process remains local, meaning that the extraction, file reads, rule matching, and scoring all occur on the user's device. No post text leaves the device, ensuring the results remain private. Only deletion necessitates authorized connections to the platform, which does not upload any archive content. The boundary between reading and writing operations is clear: parsing occurs locally, while deletion operates externally.

It is essential to understand that the reported count may not align with the platform due to several factors. Time gaps, deleted content, reposts and quotes, and media-only posts all contribute to discrepancies. By understanding the source of the data, users can better question and analyze the report, turning it from a verdict into a chain of verified connections.