Privacy audit of our own apps

I ran our own tracker scanner against our own work. Here is what it is set up to find, what the answer should be, and the parts I did not enjoy writing.

The tool

CrumbTrail scans a public page and reports trackers, analytics scripts, ad pixels, cookies, and related findings. It is live, so you can point it at any of these hosts yourself and check my work:

# open https://crumbs.bryancalabro.com and enter the host you want scanned

What the apps are supposed to do

The house rule for every app on this network is local first: no accounts, no backend, no analytics. State lives in the visitor's own browser under a key named after the host, and nothing is sent anywhere.

For most of these apps that is not a privacy policy, it is an architecture. There is no server to send anything to.

The finding I did not like

Analytics is Vercel Analytics and Vercel Speed Insights, on calabrodesign only. It collects pageview and performance telemetry, and the app itself collects no personal data. (V-4, source: package.json dependencies and README.md in calabrodesign, verified 2026-09-21)

So the rule has an exception, and the exception is the front door. calabrodesign, the portfolio site itself, carries Vercel Analytics and Speed Insights. Every other first-party app I have read carries neither.

I could have written "we do not use analytics" and it would have been true of almost everything. It is not true of the site most people actually land on, which makes it the one place the claim mattered.

The honest version: the tools collect nothing personal, and the tools still exist. If you visit bryancalabro.com, a pageview is recorded by Vercel. If you use an app on a subdomain, as far as I can establish from reading the repos, nothing is.

The second finding I did not like

A HAR file contains cookies, Authorization headers, and request bodies. The HAR viewer on this network reads one in the browser and never uploads it, which is the right design. But nothing in a web page can prove to you that it did not upload something.

So the app is built so the claim is checkable rather than trusted: open the network panel, drop a file, and watch for a request that is not there.

# in the browser devtools network panel, drop a .har onto the app
# expected: zero requests after the page and its assets have loaded

That is a weaker guarantee than "we do not have your data" and a stronger one than "we promise". I would rather be precise about which one it is.

Hosting, and what that means

Hosting is Vercel. It serves the calabrodesign site build. (V-2, source: vercel.json and README.md in calabrodesign, verified 2026-09-21)

A static host still sees request logs. I do not control what Vercel retains, and I am not going to write a sentence implying I do.

What I cannot tell you yet

Product figures are not supplied. None reproduce from a repo or a report in scope. (N-1, source: company/product-facts.md, section 3, verified 2026-09-21)

There is no data-retention figure on this page because there is no sourced one to publish. When there is, it will appear with a date beside it.

How to check any of this

Every claim above is either a file in a public repo or a request you can make yourself. If one of them is wrong, the fastest way to tell me is the contact line on the about page, with the command you ran.