This is what it does
Try it
Privacy Butler keeps one dated record of each visit — the consent decision, the dark pattern found, the trackers blocked — and drafts the data-access request you are owed. Start on the Overview panel.
Runs in your browser — sample data, no companion process
- What it does: treats consent as refused until it is affirmatively given, names the dark pattern in the record, and tracks the response window on the request it drafts from that record.
- What to try: open the Audit log and the dark-pattern catalogue, then draft a data-access request and watch its deadline appear on the request.
- What it does not do yet: this is the console in its browser-demo mode on seeded sample data — nothing is written to disk, no extension is feeding it real visits, and the letters are drafts that are not sent.
Status
What is built, and what is not
- The running console is the product’s own, in the browser-demo mode its README describes. The audit trail with filters, the ten-pattern catalogue, the request drafting and status flow, the protective switches and the shareable receipt all work on this device against seeded sample data.
- The companion server is tested against a real socket and a real state file. 18 checks pass, covering the state round trip, on-disk persistence, refusal of malformed and non-object bodies, the static whitelist and traversal attempts, the anti-rebinding host and origin guards, and the unreadable-store path.
- The requests cover five regimes, and the limits are real. Templates are written for GDPR, CCPA, LGPD, DPDP and APPI, with the response window tracked alongside each request; the templates have had no legal review, there is no paid tier, and the extension that would act on real pages is not part of this build.
Under the hood
What it is built on
- Stack
- A dependency-free Node companion server and a plain HTML, CSS and JavaScript console. There is no framework and nothing to install.
- Surfaces
- The console at 127.0.0.1:4175 and its companion HTTP server. Opening the console file straight from disk instead runs the browser-demo mode shown above.
- Data
- One JSON state file holding the audit trail, the requests and the settings. An unreadable store is reported as unreadable rather than read as empty, and the previous bytes are moved aside rather than overwritten.
- Auth
- There is no account to create. Reachability is the control: the companion serves the loopback address only and refuses a mismatched host or origin.
Tell us what broke
What the audit trail should hold, which jurisdictions matter to you, or anything the console got wrong — the feedback form is the way in.