Verify these claims yourself
We say this site has no trackers. You have no reason to take our word for it — so here's how to check, in about five minutes. The same method works on any site, which is the more useful takeaway.
This is the whole point. Every privacy site claims not to track you. The ones worth trusting tell you how to confirm it. If you learn this once, you never have to believe a privacy policy again.
1. Count the requests (30 seconds)
- Press F12, or Cmd+Option+I on a Mac, to open developer tools.
- Click the Network tab.
- Reload the page.
- Look at the Domain column — add it from the column headers if it's hidden.
What you should see: every single row pointing at goincognito.org — the HTML, style.css, app.js, and on the search page search-index.js. That's it. Nothing from Google, no CDN, no font host, no analytics domain.
What a tracked site looks like: try this on a news site. You'll typically see 50–300 requests to dozens of domains you've never heard of. Each one is a company being told you're reading that page.
2. Check for cookies and storage (20 seconds)
In developer tools, open Application (Chrome) or Storage (Firefox). Look at Cookies, Local Storage, and Session Storage for this domain. All three should be empty. That's also why you never saw a consent banner — there is nothing to consent to.
3. Read the headers (30 seconds)
In the Network tab, click the first row and look at Response Headers. Or from a terminal:
curl -sI https://goincognito.org | grep -i -E 'content-security|referrer|permissions'
You should find a Content-Security-Policy starting with default-src 'none'. That's the important one: it means the browser itself will refuse to load anything from another domain, even if we made a mistake and tried. There's no connect-src at all, so the page cannot send data anywhere — search included.
Referrer-Policy: no-referrer means when you click an outbound link, the destination isn't told you came from a page about being doxxed.
4. Read the source (2 minutes)
Right-click → View Page Source. It's static HTML. There is exactly one script, app.js — open it directly and read it top to bottom; it's about 60 lines. It draws the loading bar, handles the Esc-twice exit, and does nothing else. There are no fetch() or XMLHttpRequest calls anywhere on this site.
The icons are inlined SVG paths rather than requests to an icon CDN, and the fonts are whatever Helvetica or Arial is already on your machine — no font is downloaded, which is itself a common tracking vector.
5. Test the search page offline
The best demonstration: open Search, then turn off your Wi-Fi and search again. It still works, because the index is a file already in your browser and the matching happens on your device. Nothing you type could reach us even if we wanted it to.
What you can't verify from the browser
Being straight about the limits, since a page claiming total transparency should:
- Server logs. You can't see what our host records. Any server receives your IP address in order to answer you — that's how the internet works, not a choice. We keep no per-visitor records and want only a daily total; you cannot confirm that from your side. If that matters to you, Tor or a VPN is the answer, not our promise. That's the honest position and we'd rather say it than claim otherwise.
- Future versions. Today's page is clean. Check again in a year — or read the changelog.
- Whether our advice is correct. A tracker-free site can still be wrong. Cross-check against EFF SSD and Privacy Guides.
The source repository will be linked here once it is published, so you can diff every change rather than trust a summary.
Now do it to someone else
Run steps 1 and 2 on your bank, your favourite shop, and a news site. You'll never read a cookie banner the same way again — and you'll be able to judge any privacy tool by what it loads rather than what it claims.