Find your footprint
Before you remove anything, find out what is actually public about you. This is a 6-step checklist you run yourself, in your own Gemini or Claude chat, with your own identifiers. Nothing you type leaves your device — we never see any of it.
Honest limits, up front: search covers the indexed surface web only. Forums that block indexing, deleted-then-archived pages, and data brokers may not show up. Absence of results is not proof of absence. Demand quoted evidence for every claim — AI tools will otherwise invent connections.
Run the steps in order, in one thread if possible. Paste each step's output into the next step. Replace everything in [BRACKETS] with your own info. Only investigate your own identifiers — never go digging into other real people you stumble across.
Step 1 — Seed inventory & search plan
List your known identifiers, then have the AI write a search plan for each one. Run it on Gemini (turn on Search grounding / Google Search access).
I'm doing a privacy self-audit: I want to find everything publicly linkable about ME from my own online footprint, so I can clean it up. My known identifiers: [HANDLE / USERNAME 1] — [where you used it, e.g. Reddit 2018–2023] [HANDLE / USERNAME 2] — [platform] [EMAIL 1], [EMAIL 2] [any other usernames, old forum names, gamertags] For each identifier, write a search plan: the exact queries you'll run (try the handle alone, handle + site:reddit.com, handle + city keywords, email in quotes, etc.). Then run the plan. Rules: only follow THESE identifiers and whatever they directly lead to — do not go investigate other real people you stumble across. Label every finding VERIFIED (with the exact quoted text and URL) or INFERRED (your guess, with reasoning). If you can't source it, say UNSOURCED.
Step 2 — Extract microdata (once per handle)
For each handle, build a structured profile. The boring details are the dangerous ones.
For the handle [HANDLE], search the web thoroughly (posts, comments, profiles, bios, linked accounts). Build a structured profile with these sections: a) STATED FACTS — location, job/employer, school, age, relationships. Quote + URL each. b) INFERRED FACTS — things strongly implied but not stated. Mark INFERRED, show reasoning. c) DISTINCTIVE DETAILS — rare combos and specifics: employer + role + city, unusual possessions, pet names, specific tools/stack, rare hobbies, exact dates, distinctive phrases. d) CROSS-REFERENCES — every other username, email, URL, or social profile mentioned or linked. e) TEMPORAL MARKERS — "I just moved", "started my new job", dated events. Drop anything you cannot tie to a quoted source from the verified set. Be exhaustive — the boring details are the dangerous ones.
Step 3 — Follow the leads (up to 3 hops)
Every new identifier found in Step 2 gets its own search pass. Stop expanding a branch when a hop yields nothing new.
From the Step 2 profile, list every NEW identifier found (usernames, emails, domains, profile URLs). For each one, run a fresh search pass and extract as in Step 2. Follow new leads up to 3 hops out. Stop expanding a branch when a hop yields nothing new. Keep a visited list so you don't loop. Report: the chain (seed → lead → lead), what each hop added, and where each branch went cold.
Step 4 — Rarity / linkability scoring (the important one)
Score every fact and fact-combination by how uniquely identifying it is — then list the top 10 most dangerous combos.
Review ALL extracted microdata across every handle. For each fact and fact-combination, score how uniquely identifying it is: 1 = generic (millions share it) · 2 = uncommon · 3 = narrow (hundreds) · 4 = very narrow (dozens) · 5 = likely unique to me. Then list the TOP 10 most dangerous combos — the ones an attacker would actually use to link my handles together or to my real identity. For each: the combo, which handles it connects, the evidence URLs, and the concrete fix (delete post / delete account / edit detail / leave it). Sort by danger first, fix-effort second.
Step 5 — Archive & broker check
Check beyond live pages: what persists after deletion?
For my top identifiers [list the 3–5 most important], check beyond live pages: a) Wayback Machine (web.archive.org) for deleted profiles, old bios, removed posts. b) People-search / data-broker sites — do NOT pay for anything; just note which brokers list me and what they expose in previews. c) Forum archives, mirrors, and scrapes (e.g. old Pushshift-style archives) for deleted content. Report what persists after deletion, with URLs where possible.
Step 6 — Attacker's summary
Assemble the final report the way an attacker would, using public sources only. Abstain rather than guess — a wrong link in this report is worse than a missing one.
Assemble the final report the way an attacker would, using public sources only: - CONSOLIDATED PROFILE: what a stranger could assemble about me. Keep verified vs inferred separate. - HANDLE LINKAGE: for each handle, confidence it's me (HIGH / MEDIUM / LOW) with reasoning and evidence. - CROSS-HANDLE LINKS: which handles connect to each other, via what evidence. - THE SINGLE MOST IDENTIFYING COMBO: the one fact-combo I should kill first. - TOP 5 DELETIONS: the five highest-ROI removals, ranked. - WHAT I COULD NOT VERIFY: list dead ends and uncertainties. Abstain rather than guess — a wrong link in this report is worse than a missing one.
After the run
Turn the Step 6 TOP 5 DELETIONS into your cleanup list. Each deletion maps to a guide here — or, if the broker has no guide yet, to a direct request you send yourself. Track everything on the tracker.
Adapted from the defensive self-audit method in "Large-scale online deanonymization with LLMs" (arXiv 2602.16800), rebuilt as a self-audit. Run steps 1–3 and 5 on Gemini with Search grounding; steps 4 and 6 work on Gemini or Claude.