CryptoDakini Browser Observatory — Simple Privacy Audit

Scope
-----
This note describes the bundled CryptoDakini web app source: the browser frontend and the bundled Python server.

What runs in the user's browser
--------------------------------
The fingerprint/observation checks are performed by JavaScript in the user's browser. The checks include browser and platform signals, locale/timezone, display characteristics, canvas, WebGL, audio rendering, fonts/voices/media capabilities, WebRTC, storage, permissions, battery/media-device availability, and browser/runtime/API signals.

The scan result is assembled in browser memory. The current app source does not contain a server-side scan-report database or report file store.

What goes to the server
-----------------------
The browser requests /api/connection. The bundled Python server receives the connection metadata available to it, including the public source IP and normal HTTP request headers.

The server uses local DB-IP City/ASN databases and timezonefinder to enrich the observed IP. It does not call a third-party Geo-IP API for that lookup.

Logs and analytics
------------------
The bundled SimpleHTTPRequestHandler overrides access logging. Request access logs are OFF by default and are only emitted when the environment variable ACCESS_LOG=1 is explicitly set.

The current frontend contains no analytics SDK, tracking pixel, or third-party analytics request.

The server does not contain a scan-report database or report persistence layer.

Infrastructure caveat
---------------------
A reverse proxy, CDN, hosting provider, container platform, system service manager, or other infrastructure placed in front of the app may create its own logs. Those logs are outside the bundled application's own request-logging behavior.

Permissions
-----------
The bundled server sends a Permissions-Policy that disables geolocation, microphone, camera, bluetooth, USB, and payment for the page.

User controls
-------------
"Purge this report" clears the current in-page scan object and visible results. It does not erase browser cookies, VPN configuration, system logs, or logs created by infrastructure outside the app.

Audit conclusion
----------------
For the bundled source inspected for this release: fingerprint tests are browser-side; connection/IP enrichment is server-side; request access logging is disabled by default; and no analytics code is bundled in the frontend.

Made by CryptoDakini
https://youtube.com/@cryptodakini