One file. No framework.
Plain HTML, CSS and JavaScript. GSAP runs the intro timeline; everything else is native browser APIs. It loads fast because there's almost nothing to load.
Frontend &
Product
Engineer.
More than ten years on the web: accessibility for Walt Disney Parks and Resorts Online, web check-in at LAN Airlines, the component system behind Savings United's campaign sites. I build with AI as the default: I direct the tools, review what they produce, and own what ships.
Your browser is talking. Scroll to hear what it says.
01 — Playground · No permission asked
Your browser
is talking.
Every site you open gets this list for free. Here is yours, read live. It's computed on your device and never leaves it: no server, no cookies, no tracking. Flip any card to see who uses that detail, and what for.
02 — Possible. Not polite.
What trackers
do next.
Everything above is free for any site. This is what trackers build from it, and it works in most browsers today. Most sites never ask. I will.
Run the tracker tests?
I'll fingerprint this browser, look for extensions and installed fonts, and remember this visit. It all stays in your browser, nothing is sent anywhere, and one click forgets it.
— deletes the stored fingerprint and visit count from this browser.
03 — Where the web draws the line
What I
can't see.
Browsers block all of this unless you say yes, and they show you an indicator while it's on. That's the web working as it should.
- Your cameraNeeds your explicit yes. Then a light or icon shows it.
- Your microphoneSame rule. No silent listening, ever.
- Your historyThe old :visited trick was closed off in 2010.
- Your other tabsEach site lives in its own sandbox.
- Your local networkIn 2025, Meta and Yandex were caught using localhost to link web visits to Android apps. Since Chrome 142, sites must ask first.
- Your passwordsNever exposed to the page you're on.
04 — The decisions behind it
How this
works.
A page about trust has to earn it. These are the calls I made and why.
Nothing leaves your device.
No server, no cookies, no analytics. The only outside requests are the fonts (Google) and GSAP (Cloudflare), so those two see your IP, like on most sites.
Honest over impressive.
Your city comes from your clock's timezone, not GPS: less precise, nothing sent. When a browser hides something, the page says so instead of guessing.
Consent before the creepy part.
The tracker tests run only after you say yes. What they store stays in your browser, and "Forget me" deletes it.
Motion with an off switch.
The intro plays once per session, any key skips it, and it never plays if your system asks for reduced motion.
Built with AI as the default.
I direct the tools, review what they produce, and own what ships. The concept, the limits and the trade-offs on this page are decisions, not defaults.
Every "who uses it" has a source.
Company policies and reporting, as of October 2026: Orbitz and Mac users, Uber and low batteries, TikTok's device data, Meta's device data, Google and fingerprinting, LinkedIn and extensions, Google Ads device targeting, banks and typing rhythm, phone sensor fingerprints.