--
title: "Where a Digital Footprint Check Gets Its Data"
description: "The score, the risk labels and the timeline come from specific files inside your archive. This maps which files get opened, which get skipped on purpose, where the boundary between reading and writing sits, and why report counts differ from what the platform shows."
tags: ["privacy", "twitter", "security", "webdev"]
canonical_url: https://digital-footprint-health.shop/blog/footprint-check-data-sources
A footprint report hands you a score and a list of flagged posts, and the instinct is to start working through the list. Which files the tool opened, and whether any of it left your machine, tends to be an afterthought.
That gap matters, because the credibility of every number in the report depends on it.
The files that get opened
After extraction, the data folder holds around twenty files. A check reads only the ones tied to post content and account history.
| File | What it holds | Role in the report |
|---|---|---|
| tweets.js | Every historical post, timestamps, engagement counts | Primary source for the score and the risk list |
| like.js | Like history | Signals interest patterns and topic exposure |
| direct-messages.js | Direct message history | Detects contact details shared in private threads |
| phone-number.js, email-address-change.js | Linked contact details and change history | Supporting evidence for contact exposure |
| ip-audit.js, account-creation-ip.js | Login and account creation records | Timeline verification, region inference |
tweets.js does the heavy lifting. The remaining files act as cross-checks. If one stretch of tweets.js is dense with location mentions, and the IP records show logins from that city in the same window, the location signal is far stronger than post text on its own.
Which file feeds which block
A report reads as a single verdict. Taken apart, each block has a different origin.
| Report block | Main source | Method |
|---|---|---|
| 0 to 100 health score | tweets.js | Weighted by item count and share per risk category |
| Risk item list | tweets.js | Pattern matching for phone numbers, emails, addresses, locations |
| Sensitive topic flags | tweets.js | Dictionary and context rules, with false positives |
| Activity timeline | tweets.js plus IP records | Aggregated by timestamp |
| Contact exposure surface | tweets.js, direct messages, account files | Cross-file comparison |
Because the blocks draw on separate sources, a problem in one does not contaminate the others. A mislabelled topic flag does not move the contact exposure line.
What gets skipped on purpose
Unread fields fall into two groups: those unrelated to privacy risk, and those that would distort the analysis.
- Ad engagement records. Nothing to do with what you posted, and they only inflate item counts.
- Follower and following lists. Volume swamps signal, and they involve other people's data.
- Device tokens and personalization settings. No bearing on whether a post carries risk.
- Language tags stored on posts. Re-detected during parsing, since stored tags drift over time.
That filtering has a visible consequence. Report item counts come out lower than people expect, and the mismatch gets misread as missing data.
Where the line between reading and writing sits
This is the question that deserves the least hedging.
Parsing stays local. Extraction, file reads, rule matching and scoring all run on your device. Post text does not cross the network.
Results stay local. The score and the list are held in memory and are not submitted anywhere.
Only deletion needs authorization. Removing posts calls the platform API, which requires an authorized connection. That step uses delete permission and does not upload archive content.
The dividing line is between reading and writing. Once you know where it falls, the architectural questions answer themselves.
Why the count never matches the platform
A mismatch is normal, and sorting the causes stops you misreading it.
- Time gap. The archive is a snapshot from the day you requested it, so anything posted since is absent.
- Deleted content. The archive keeps posts you removed afterwards, which no longer appear on the platform.
- Reposts and quotes. Counting rules differ from the page display, and the gap can run into the hundreds.
- Media-only posts. No text means no text match, but the post still appears on the timeline.
With those four in hand, the correct comparison becomes obvious. Match archive entry totals against the post total on the platform, never against the risk list, which has already been filtered once.
Knowing where the data comes from turns the report from a verdict into a chain you can question. Questioning it is the point.
Top comments (0)