Privacy & data

Osintracker is built around a simple principle: your investigation data stays on your machine. This page explains exactly where your data lives, what does and does not leave your browser, and your own responsibilities when handling personal data.

Where your data lives

All your investigations — entities, relationships, node positions, custom resources and resource sets — are stored locally in your browser using IndexedDB. There is no Osintracker account and no server-side copy of your cases.

A consequence: your data is tied to this browser, on this device, under this profile. Clearing the browser's site data, using a different browser, or another machine means you won't see the same investigations. This is why regular backups matter.

On first launch, accept persistent storage so the browser does not evict your data during disk cleanups. See Backup → Persistent storage.

What leaves your browser

Osintracker is local-first, but a few network requests are unavoidable or are triggered by your own actions. Being aware of them matters for sensitive work.

Request	When	Goes to
Entity / profile images	When an entity has an image URL, or a connector import downloads profile photos	The server hosting that image — your browser fetches it directly, so that host can see your IP. Cross-origin avatar hosts usually block the download (CORS); the graph then flags the image as missing and keeps the URL so you can open it yourself
Opening a resource/tool	When you click a resource link (queryUrl)	The third-party tool, with the entity's value in the URL
Audience measurement	Loading the Osintracker app, or browsing this documentation	A self-hosted Matomo server — see Analytics below

What never leaves your browser:

• Your investigations and their entities, relationships, comments and notes
• Connector JSON files you import (they are parsed locally)
• Your database exports (.osintracker) — these are files you save yourself

The app's reference data (entity types, families, built-in resources) is bundled into Osintracker, not fetched from a server — so opening the app makes no startup request for it. The only network call on load, besides the application itself, is the cookieless audience measurement described under Analytics.

Important: clicking a resource link reveals your interest — the entity's value and your IP — to a third-party tool. Connector profile-photo downloads on osintracker.com are proxied, so the avatar host sees OSINTracker's server, not your IP. For sensitive cases, read Operational security.

Your responsibilities

Because Osintracker stores data only for you, you are the data controller for whatever you collect. When that data concerns identifiable people (which OSINT often does), you are responsible for:

• Lawful basis & purpose — collect only for a legitimate, defined purpose.
• Data minimisation — keep what you need for the investigation, not more.
• Security — protect your device and your .osintracker backups (they are plaintext and readable by anyone who opens them).
• Retention & deletion — delete investigations and backups when they are no longer needed.

If you operate in the EU, the GDPR applies to your processing of personal data even when the tool itself never sees it. See Methodology → Ethics & legality.

Deleting your data

• One investigation: delete it from its information panel (permanent — export first).
• Everything: clear the site's data from your browser settings, which empties IndexedDB. This cannot be undone, so keep a backup if you might need the data again.
• Backups: delete the .osintracker files yourself from wherever you stored them.

Analytics

Both the Osintracker app (app.osintracker.com) and this documentation site use Matomo, a privacy-friendly, self-hosted audience-measurement tool, solely to count visits:

• It runs without cookies, so no cookie banner or prior consent is required.
• Your IP address is anonymised, and no data is shared with third parties.
• It honours your browser's Do Not Track setting — if enabled, you are not counted.
• It records page views only: it does not track which entities, resources or tools you open, and your investigation data is never sent.

Because the measurement is cookieless and anonymised, it is exempt from prior consent (per the French CNIL's audience-measurement guidance).

Each site has its own measurement, so you opt out per site:

• In the Osintracker app — open the Legal dialog and tick the opt-out box.
• On this documentation site — use the form below; your choice is remembered on this browser: