Skip to content
Back to Projects
Active
Tools
Open Source
Feb 2026

unlinkd

Get yourself removed from the internet — and keep the proof. A local-first, fully encrypted workspace for data-broker removal requests and the tamper-evident paper trail a GDPR or CCPA escalation actually needs.

View Source
AES-256-GCM
Encryption
scrypt
Key derivation
None
Backend
HMAC-chained
Audit log
unlinkd project visual

The constraint

Removal is not the hard part; proving it is. Requests get ignored, brokers re-list you months later, and by the time you need to escalate you no longer remember what you sent, to whom, or when. The tools that promise to do this for you require handing your identifiers to a company — which is the same trade you were trying to get out of.

The approach

A browser-only workspace with no backend and no account. Personas, identifiers, accounts, findings, and evidence are encrypted with AES-256-GCM under a key derived from your passphrase by memory-hard scrypt, and every action appends to an HMAC-chained audit log that is verified on unlock.

Process
  1. 1
    Threat model first

    Wrote down what the audit chain does and does not protect against before building it, so the security claims stay bounded to what is true.

  2. 2
    Migrate old envelopes forward

    Legacy PBKDF2 and unversioned envelopes stay readable and are proactively re-encrypted with scrypt on the next unlock rather than stranding existing vaults.

  3. 3
    Bound hostile inputs

    Clamped KDF cost parameters read from stored or imported envelopes so a malicious backup cannot peg the tab with an absurd work factor.

  4. 4
    State the scope honestly

    The connector catalog is guided manual checklists — it captures and organizes evidence, it does not submit opt-outs for you. The README says so before the feature list does.

Outcomes

  • Encrypted local vault and evidence store in IndexedDB with no server component
  • HMAC-chained audit log verified automatically at unlock
  • Auto-lock clears the decrypted vault and passphrase after 15 minutes
  • Cross-tab safety via compare-and-swap writes and BroadcastChannel sync
What I'd do next
  • Broaden the connector catalog and formalize the governance cadence that keeps it from going stale.
  • Add a hardware-key unlock path so the passphrase is not the only factor.
  • Generate escalation-ready PDF bundles directly from the audit chain.
Details

Built a local-first, zero-backend workspace for data-broker and account removal that encrypts every record (personas, identifiers, accounts, findings, evidence, audit log) client-side under a scrypt-derived key.

Implemented an HMAC-chained audit log, auto-lock, persistent-storage requests, backup-staleness warnings, and cross-tab compare-and-swap writes so the evidence trail survives real-world browser conditions.

Related projects