Cleaning up your digital footprint, explained
Your digital footprint is everything about you that exists online: accounts, posts, the data that companies and data brokers collect, and the apps that still have access to your email or cloud storage. Digital sanitization means reducing that footprint and securing what is left, so that a leaked password, a phished login or a curious stranger can do as little damage as possible. This free checklist turns that into concrete tasks with links, adapted to where you live.
Why start with your email account?
Almost every "forgot your password?" link ends in your mailbox. Whoever controls your email can reset your bank, social media and shopping accounts. Protect it first with a strong unique password and multi-factor authentication (MFA), preferably a passkey or an authenticator app, and check the recovery phone number and address. Then do the same for your Apple, Google or Microsoft account, which often holds your passwords, photos and backups.
Passkeys, MFA and password managers
A password manager makes unique passwords for every site realistic, and warns you about reused and breached ones. MFA adds a second step so that a stolen password alone is not enough. Passkeys go further: they replace the password and the code with a cryptographic key on your device, can't be phished and can't be reused on a fake site. Apple, Google, Microsoft and a growing number of banks and shops support them.
Forgotten app connections and sessions
Every "Sign in with Google", "Sign in with Apple" or "Connect to Facebook" gives an app access to some of your data, and that access usually stays until you revoke it. Old sessions on sold laptops or hotel computers can also stay signed in. The connected-apps module links straight to the permission pages of Google, Microsoft, Apple, Meta, X, LinkedIn, GitHub and others. Check them twice a year.
Your phone, your SIM and SIM swapping
Your phone receives sign-in codes and holds your accounts. Turn on automatic updates and theft protection (Stolen Device Protection on iPhone, Theft protection on Android), set a SIM PIN and ask your mobile provider for a PIN or extra checks before your number is moved to a new SIM. That makes SIM swapping, where a criminal takes over your phone number to receive your codes, much harder. People at higher risk can turn on Lockdown Mode (iPhone) or Advanced Protection (Android).
Data brokers and your rights under the GDPR
Data brokers collect and sell profiles with names, addresses, interests and contact details. In the EU and the UK the GDPR gives you strong rights against them and against any company that holds your data:
| Right | Article | What it gets you |
|---|
| Access | Art. 15 | A copy of your data, where it came from, who received it and how long it is kept |
| Erasure | Art. 17 | Deletion of your data, for example when it is no longer needed or you withdraw consent |
| Objection | Art. 21 | An absolute stop to direct marketing and related profiling |
Companies must answer within one month, which can be extended by two months for complex requests. If they don't answer, you can complain to your data protection authority: the GBA/APD in Belgium, the Autoriteit Persoonsgegevens in the Netherlands, the ICO in the UK. For search results, the "right to be forgotten" lets you ask search engines to delist outdated or irrelevant results about you. The Request letters tab writes these requests for you in English, Dutch or French.
Credit freezes and their European equivalents
In the United States a credit freeze at Equifax, Experian and TransUnion is free and stops anyone from opening credit in your name; Californians can also use the state's free DROP platform to ask every registered data broker to delete their data in one go. Europe works differently: there is no freeze, but you can check the credit registered in your name. In Belgium that is the National Bank's Central Individual Credit Register, in the Netherlands BKR, and in the UK your statutory credit reports, with Cifas Protective Registration as an extra after identity theft.
Calls and mail you didn't ask for
| Country | Phone | Addressed mail |
|---|
| Belgium | Bel-me-niet-meer / Ne-m'appelez-plus (dncm.be) | Robinson list (robinson.be) |
| Netherlands | Bel-me-niet Register | — |
| United Kingdom | Telephone Preference Service | Mailing Preference Service |
| United States | National Do Not Call Registry | — |
How the password check keeps your password private
The check uses the Pwned Passwords service of Have I Been Pwned, which holds a very large collection of passwords from real data breaches. Your browser turns the password into a SHA-1 hash and sends only the first five characters of that hash. The service answers with every breached hash that starts with those characters, and your browser looks for a match itself. This is called k-anonymity: neither the password nor its full hash leaves your device, and padding hides how many results came back.
Social media and AI training
Your birthday, employer, friends list and old posts are exactly what scammers use for convincing phishing and for guessing security questions. Lock down profile visibility, review tags and location sharing, and decide whether platforms such as LinkedIn, X and Meta may use your posts to train their AI models; each offers a setting or an objection form.
Keep it clean: a maintenance schedule
| Every 6 months | Every year |
|---|
| Connected apps and sessions, breached and reused passwords, data breach check, backups and a test restore, people-search sites (US), search for yourself | Security and privacy checkups, recovery details, app permissions, router firmware, ad settings, accounts you no longer use |
Private by design
Everything runs in your browser. Your checklist progress, letters and account inventory stay in local storage until you reset them, and you can save them to a file. The only network request is the anonymous password-hash prefix when you use the password check.
More free tools