The weare_ Suite
The weare_ suite (github.com/hamr0) is a family of browser extensions that expose what websites actually do to visitors — no cloud lookups, no accounts, no telemetry of their own. Every tool in the suite runs entirely on-device; nothing a weare_ extension observes ever leaves the user’s browser. One member of this suite, wearetosed, is directly relevant to this wiki: its real, vendored code powers one of two independent critic scores on the companion website, and its transparent regex-matching philosophy is the inspiration for this project’s own risk-term keyword filter — see methodology.md §4.
Source note: This page is based on direct reading of the 8 README files in
sources/weare_suitereadmes/(covering wearetosed, wearecooked, wearebaked, weareleaking, wearelinked, wearewatched, weareplayed, and wearesilent). No standalone README for wearehere was present in that folder — every other tool’s README references it only as “all eight extensions consolidated” into one bundle. The description of wearehere below reflects that consistent cross-reference, not a dedicated source document.
The eight tools
| Tool | What it exposes | How it scores/flags |
|---|---|---|
| wearetosed | Toxic clauses in privacy policies and Terms of Service — data sharing & selling, tracking & profiling, data retention, law enforcement access, rights & liability waivers, unilateral control. | Regex-based. Score = (categories detected × 8) + (total unique matches × 2), capped at 100. Vendored as-is and shown as one of two independent critic scores on the companion website; also the inspiration for this project’s own risk-term regex filter (see below). |
| wearecooked | Cookies, hidden tracking pixels, zero-size iframes, navigator.sendBeacon calls, and prefetch links to known tracker domains. Classifies 170+ tracker domains by company/purpose; includes a Cookie Dashboard and one-click Cookie Cleaner. | Per-cookie category classification (Analytics, Advertising, Social Media, CDN, Session/Auth, etc.) with a worst-offender ranking by suspicion score. |
| wearebaked | Real-time network traffic and data-broker activity: 550+ known domains, 84 named data-broker profiles (Acxiom, LiveRamp, Oracle BlueKai, Criteo, and more), beaconing, redirect chains, WebSocket connections, and data-flow direction. | Three-pass domain classification (Advertising, Analytics, Fingerprinting, Social Tracking, Data Broker, etc.) with a quick per-page broker verdict. |
| weareleaking | What a site stores in localStorage/sessionStorage without the user’s knowledge: cross-site tracker IDs (_ga, _fbp, Segment, Amplitude, Hotjar), ad/retargeting parameters (gclid, fbclid, utm_*), device-fingerprint IDs, and exposed PII (email addresses sitting in storage). | Pattern-matching per-site verdict; no numeric score, just category flags. |
| wearelinked | Where a link actually goes before you click: unwraps Google/Facebook/YouTube/Outlook redirect wrappers, flags URL shorteners (t.co, bit.ly, tinyurl.com), and strips/exposes 20+ tracking parameters (utm_source, fbclid, gclid, msclkid, ttclid, etc.) and email-tracking redirects (e.g. click.redditmail.com). | Visual: flagged links get a red underline on the page itself, with a hover tooltip breakdown. |
| wearewatched | Browser fingerprinting techniques (canvas/hidden-image rendering, GPU/driver info, audio-hardware probing, CPU core count, full language-preference list) and silent permission probes (clipboard reads, GPS location, continuous location tracking, notification-permission requests) — explained in plain language, not developer jargon. | Per-technique plain-English explanation of what was detected and why it narrows the user’s identity. |
| weareplayed | Dark patterns: countdown timers (especially ones that reset on refresh), discount/FOMO pressure badges, fabricated scarcity/social-proof claims (“Only 2 left,” “12 people viewing”), pre-checked opt-in boxes, confirm-shaming decline buttons, and deliberately hard-to-find unsubscribe links. | Structural DOM pattern matching, no AI. Each detected pattern type adds 20 points, capped at 100. |
| wearesilent | Form-field exfiltration before the user clicks submit — address-autocomplete services (Loqate/Addressy), fraud-detection scripts (Forter), session-replay tools (FullStory, Hotjar, Mouseflow), marketing pixels (Meta Pixel, TikTok Pixel), and CRM/analytics scripts reading field values as they’re typed. Cites a USENIX 2022 study finding 2,950 of the top 100,000 websites leak form data before submission. | Two-part popup: confirmed leaks (red, “sent without your permission”) and active trackers present on the page (amber), shown in real time. |
wearehere — the consolidated extension
wearehere bundles all eight tools above into a single install, per the consistent cross-reference in every individual tool’s README (“All extensions run entirely on your device and work on Chrome and Firefox”). No dedicated README for it exists in this wiki’s source folder, so this page does not claim any feature beyond what the eight individual tools already document.
This wiki’s relationship to wearetosed
This wiki briefly ran its own risk-scoring formulas adapted from wearetosed’s approach for both datasets; that system was retired 2026-06-21 and its dataset-specific documentation pages have since been removed entirely, rather than kept as a historical record, to avoid any residual suggestion that this project maintains a scoring formula of its own. It does not. The only risk-severity numbers shown anywhere in this project are wearetosed’s and ToS;DR’s own real, independently-computed scores, shown on the companion website’s critic panel where real data exists (CLAUDE.md §9.2).
What this project does keep, in wearetosed’s spirit rather than as a scorer, is scripts/legacy/reconstructed_tagging_regex.py: a plain, auditable, case-insensitive regex filter that identifies which PGAv2 risk-term keyword (if any) is present in a passage — the same transparent, no-black-box philosophy wearetosed itself is built on, applied to this wiki’s own 22-keyword vocabulary rather than wearetosed’s six categories. It never assigns a score. See methodology.md §4 for the full writeup.
See also: methodology.md · Related Work