What I don't know

Honestly, at the end of the volume

My script reads a lot. Here is everything it never does, and proof you can check yourself.

I keep nothing about you for more than 15 minutes after your last move.
I didn't set a single cookie.
My script ran on page 2 only.
My logs know neither your address nor the words from the field.

Back to page 1

What my script never does

It reads nothing before your click. Page 1 has no script; it starts only on page 2, which only the button opens.
It asks for no permission: camera, microphone, location, notifications, reading the clipboard, motion sensors, fonts, windows, the local network.
It leaves nothing that outlives the tab: no cookies, localStorage, sessionStorage, IndexedDB, Cache Storage or service workers. Your browser may keep the script file itself in its cache, like any file.
It scans neither your computer nor your network: no localhost ports, no addresses in your home network, no chrome-extension:// addresses. That is the line between a lesson and a break-in (Art. 267 of the Polish Criminal Code).
It harvests nothing on the sly: no hidden fields to catch your autofill. It reads only what you type or paste into the “Write something” field yourself, and what you copy from my page.
It listens to no keys anywhere but that one field, and never measures how fast you type.
It doesn't recognise you on your next visit: no cookie and no list of fingerprints. Memory is volume 2.
It talks to nobody but me: no CDNs, no analytics, no one else's STUN servers.
It doesn't write on the page. Every word and picture you see came from me, from the server.

The proof: two headers

Every response carries a Content-Security-Policy header. Your browser enforces it itself, even if I tried to cheat.

Page 2

the only one with a script

Content-Security-Policy: script-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'

script-src 'self': your browser runs only a script from this domain, that is, mine. connect-src 'self': the script can send only to me.

This header doesn't cover the side door: browsers don't apply connect-src to WebRTC. So I tell you plainly where my script knocks: stun:js.watch-kube.bryzek.it:31478, my own STUN server. You can check it in the code.

Page 1, page 3, the case file and this page

Content-Security-Policy: script-src 'none'; base-uri 'none'; form-action 'none'

script-src 'none' forbids all scripts, so your browser couldn't run one here even if I tried. Volumes 1 and 2 send the same header.

Read the script: /static/watch.js One file, no libraries, not minified, with comments.

What my script reads and sends

All of it, in order. What isn't listed here, my script doesn't do; if it did, that would be a bug.

When: Only on page 2, which only the “Show me what a script sees” button opens. The page loads it asynchronously (async), and it reads for 3 seconds at most.
Clock and languages: Time zone, locale, 12- or 24-hour clock, first day of the week and the browser's languages. Also how far your clock is off mine: the script sends me one HEAD request for its own file and reads the time from the answer's Date header.
Graphics card: The card's vendor and name from WebGL (the unmasked name where the browser gives it), and the vendor and architecture from WebGPU.
Processor and memory: The number of cores (hardwareConcurrency) and, where the browser gives it, the memory (deviceMemory).
Screens: The screen's size, the part free of the taskbar or Dock and where it starts, the scaling (devicePixelRatio), a second monitor (screen.isExtended), where the window sits and the size of the page's window.
Battery: The charge level and whether it is charging (only Chromium-based browsers answer).
Keyboard: What twelve keys would type in your layout (navigator.keyboard.getLayoutMap, Chromium only). It listens to no key.
Voices: How many voices your computer has, in how many languages, up to ten of the languages and up to ten names.
Fingerprints: A small drawing made in memory (a PNG picture and its SHA-256 hash) and a short sound rendered in memory and never played, each made twice to catch noise, and a few results of the browser's maths.
The side door: ICE candidates, the lines a video call would exchange, gathered with my own STUN server (stun:js.watch-kube.bryzek.it:31478) and sent exactly as the browser wrote them, with the address my STUN server saw. No connection is ever made.
Extensions: Wallets that answer the public EIP-6963 call with their name, whether window.ethereum exists, and the attributes extensions add to my page's <html> and <body> by themselves (read after 2 seconds). It probes nothing.
Moves: Only while page 2 is open: the pointer's position (at most 10 times a second), the wheel (20 times) and the scroll position (5 times), these three only for the first 2 minutes; clicks and where they land; the kind of pointer (mouse, pen, touch) and its strongest press; which of my panels the pointer rests on, and for how long (from 1 second); leaving the tab and coming back; what you copy from my page (up to 200 characters).
The “Write something” field: What the field holds, read at most once a second while you type, so your typing rhythm never leaves your browser, and once more when you leave the tab or the page or click a link; and what you paste into it. Up to 500 characters each time.
Sending: The readings once, in one POST request; the moves in small batches, about four times a second. Only to this site, with the page's token.
The end: The script switches itself off when you leave page 2, or after 10 minutes at the latest.

What I keep, and for how long

What the script read and everything it noted on page 2, the words from the field included, lies under your page's token. Each part expires on its own 15 minutes after it was last written, so at most 15 minutes after your last move on page 2. The token, with your IP address and User-Agent, expires 15 minutes after page 1; until then the case file shows you all of it.

All of it lives only in my server's memory: nothing goes to disk or into the logs.

Dead tricks

Two tricks this volume doesn't show, because browsers killed them:

Disk size and private mode: Pages asked the browser how much they may store, guessed your disk's size from the answer, and a private window from a smaller one. Today Chrome gives every page the same fixed amount, about 10 GB (I measured it in Chrome 156), and its makers announced the same fix for Incognito.
Addresses in your home network: Any page could once read your computer's address in your home network through WebRTC. Today the big browsers hide it behind a random name ending in .local, or don't give it out at all. Act 2 shows what is left of it.

Real cases

What my script does in the open, others have done quietly:

“No boundaries”, 2017: Princeton researchers found session-replay scripts, which record every move on a page, on 482 of the 50,000 most popular sites, and that was a lower bound.
eBay, 2020: eBay's site was reported to check localhost ports on its Windows visitors' computers, looking for remote-desktop programs, reportedly to fight fraud. My script never touches your computer's ports.
Leaky Forms, 2022: Researchers checked the 100,000 most popular sites: on 1,844 (seen from the EU) and 2,950 (from the US), an e-mail address typed into a form went to tracking, marketing and analytics firms before anyone clicked “send”. Session-replay scripts collected passwords on 52 sites (USENIX Security 2022).
Local Mess, 2025: Meta Pixel and Yandex Metrica, on ordinary websites, passed your visits through localhost, your phone's own address, to the Facebook, Instagram and Yandex apps on Android, which linked them to who you are in the app. Disclosed in June 2025; Meta stopped on 3 June 2025 and Yandex stopped too; Chrome 137 began blocking it.
Chrome 142, 2025: Since Chrome 142, a site that wants to reach your home network or your computer with ordinary requests must ask you first. WebRTC is not covered yet. My script never asks, because it never goes there.
LinkedIn, 2026 (reported): LinkedIn's script reportedly checks browsers for about 6,000 extensions. The 2026 reports are contested, and LinkedIn disputes them. My script only hears the extensions that introduce themselves.

Controller: watchout.click contact@watchout.click
Purpose: Showing you, for education, what one script on one page reads about your computer, your hiding place and your moves. Nothing else: no analytics, no ads.
Legal basis: Reading your browser with my script: your request, the click on “Show me what a script sees” (Art. 399(3)(2) of the Polish Electronic Communications Law: a service you asked for). What the script read and noted: legitimate interest, the educational purpose of this site, showing you what one script sees (Art. 6(1)(f) GDPR).
Data: What my script read (the list above); your moves on page 2, including what you typed or pasted into the field and what you copied from my page; and, in the page's token, your IP address and User-Agent.
Recipients: Nobody but me: everything stays on my servers. My script talks only to this site and to my own STUN server, and I pass nothing on. I look up your address's place and provider in a database on my own server, without asking anyone.
Retention: What the script read and noted: 15 minutes after it was last written, so at most 15 minutes after your last move on page 2. The token with your IP address and User-Agent: 15 minutes after page 1.
Your rights: You have the right to access your data (the case file shows all of it), to have it erased, to restrict its processing and to object, and to lodge a complaint with a supervisory authority (in Poland: the President of UODO).

Geolocation data: IP Geolocation by DB-IP (CC BY 4.0). Fonts: Patrick Hand and Patrick Hand SC (SIL Open Font License), served from this site.