remove-your-data

Files (32)

• qa.yml · .github/workflows/
• .gitignore
• AGENTS.md
• CHANGELOG.md
• CLAUDE.md
• CONTRIBUTING.md
• LICENSE
• NOTICE
• README.md
• SKILL.md
• STATUS.md
• PRIVACY.md · docs/
• dashboard.png · docs/
• roster.png · docs/
• settings.png · docs/
• pyproject.toml
• brokers.md · references/
• dead-urls.md · references/
• jurisdictions.md · references/
• search.md · references/
• dashboard.css · scripts/
• landscape.html · scripts/
• registry_pull.py · scripts/
• ryd.py · scripts/
• schema.sql · scripts/
• erasure-request.md · templates/
• paper-log.md · templates/
• regulator-complaint.md · templates/
• test_landscape.py · tests/
• test_registry_pull.py · tests/
• test_ryd.py · tests/
• test_serpapi.py · tests/

SKILL.md (first lines)

# Remove your data

Free, first-party takedown of people-search listings and data-broker records.
Log every step so a regulator, letter service, or attorney can use it later.

This is an operations playbook, not legal advice.

Canonical repo: https://github.com/k7cfo/remove-your-data — send improvements as PRs, do not publish a fork. Boot: `AGENTS.md`.

## About and why

Data brokers collect, scrape, and sell names, phones, addresses, relatives, and inferred profiles. People-search sites publish that dossier to anyone who types a name.

Paid "delete my data" services (Incogni, DeleteMe, Optery, and the rest) mostly submit the same free opt-out forms this skill files, then charge a subscription because brokers **re-scrape and re-list**. Recurrence is the product.

The conflict is structural:

- The industry that publishes you also sells the mop.
- PeopleConnect owns Intelius, TruthFinder, Instant Checkmate, and US Search — they sell the reports and run the suppression center.
- Some people-search companies historically sold both access to your record and a paid way to hide it.
- Even when the removal brand is a separate company, it profits while the leak stays open. You paying them does not bind the broker to a higher standard than the free legal request.

This skill does not pay those services. It exercises the person's own rights (CA DROP, CCPA/CPRA, GDPR Art. 17, and the site's official opt-out), keeps a legal log, and repeats on a clock because listings come back.

If they already pay a removal service: do not buy more. Do not blindly re-file every private broker it claims to cover. Still file the **public indexed** people-search sites yourself — those are what Google shows, and paid plans often leave them up.

## Hard rules

- Do not start searching or filing until the **roster** has a primary person with residency.
- If they live in California, run CA DROP before grinding public forms — **one DROP per person**, never a spouse on the same request.
- Do not file for a roster person whose `consent_basis` is `unconfirmed`.
- Do not impersonate. Consent is `self` (primary), `parent_of_minor`, or `authorized_agent` (they asked you to).
- Do not opt out other-state / other-country people who share the same name.
- Do not collect anyone's email or site password. If a verify link lands in a mailbox you must not open, they click it.
- Do not reuse one email across two roster people (Open Data USA: one address per person; Gmail plus-aliases collapse).
- Do not retry Cloudflare Turnstile / datacenter-blocked forms in a loop. Log `blocked`, move on.
- Do not call a listing gone from curl Cloudflare/timeout alone. Recheck in a real browser or alternate fetch. Hourly CF after a recent live reading is opacity, not a drop. After a clean origin 404, later CF/JS 403 on that URL and on a known-live control the same hour is site-wide opacity, not a reappear — wait for 200 with matching identifiers.
- Do not promise a listing is gone because a confirm page said so. Recheck the public URL.
- Do not store PII in this git clone.
- Do not recommend paying Incogni / DeleteMe / Optery / similar.
- Do not file opt-outs or SERP hides against roster `keep_host` / `keep_url` (LinkedIn, news, personal site, interviews). Default: skip articles, LinkedIn, and other non-broker coverage even without roster rows.
- Do not loop hosts in `references/dead-urls.md`. Load `STATUS.md` with the queue. `defunct` = skip.
- One clean filing plus verify per listing. Recheck later instead of spamming the form.

## 0. Harness capability

This playbook does not require Python, a browser tool, a mailbox API, or a cron. Those help. Missing one is not a stop.

**Detect first.** Before intake, list what this host already has: `python3`, a writable folder, a browser you can drive, search, a mailbox you can read, a scheduler. Do not install software they did not ask for. If you can list tools yourself, skip intake Q8 and record the list. If you cannot tell, Q8 is that one question.

For each gap, **one** offer (1:1), then degrade:

1. Get it — only if they want: Python 3.10+ for `ryd.py`, a browser MCP / Playwright, AgentMail, the host’s scheduler.
2. Use what you have.
3. Coach the human: you give the URL and the exact fields; they click; they read back request id / screenshot / “verify email arrived”. If an unsent press-Send draft is superseded by an already-sent residual, close the pending-send row; do not recreate or nag Send; they can trash the orphan draft.

| Need | If you have it | If you do not |
| --- | --- | --- |
| `python3` + `scripts/ryd.py` | SQLite workspace, `/roster`, dashboard | Paper log: copy `templates/paper-log.md` outside the clone. Same facts, no dashboard. |
| Writable folder | `$WORKSPACE` with evidence | Coach lines. They paste a notes file back next session. |
| Browser you can drive | You file the official form | Coach: official URL, fields already on the listing, what success looks like. They paste the confirm back. One Turnstile attempt still — they must not loop either. |
| Search | Query pack in `references/search.md` | They paste listing URLs / SERP they already see. Do not invent URLs. |
| Mailbox you can read | You complete verify/OTP | They click the link. You never ask for their password. |
| Scheduler | Host cron / heartbeat / systemd | Exact re-invoke phrase + next due date. No daemon. |

Do not fake a filing from a homepage curl. Do not refuse the job because the harness is “too small.” File pass / verify pass / allowlist / dead-urls still apply.


## 1. Roster — source of truth

Aliases, addresses, phones, and family members live in the workspace, **not** in chat memory. SQLite + `/roster` when Python works. Otherwise `templates/paper-log.md`. Every later pass **reads the roster** and scans each consented person separately.

```bash
python3 scripts/ryd.py init --workspace "$WORKSPACE"
python3 scripts/ryd.py serve --workspace "$WORKSPACE"
# http://127.0.0.1:8765/roster
python3 scripts/ryd.py add-ident --workspace "$WORKSPACE" --person-id 1 --kind alias --value "Janie Public"
python3 scripts/ryd.py add-person --workspace "$WORKSPACE" --name "Alex Public" --relationship child --consent parent_of_minor
python3 scripts/ryd.py pack --workspace "$WORKSPACE"
```

On first invocation, if the roster is empty or the primary has `intake_complete=0`, run **intake 1:1**. Ask **exactly one** question, then **stop** and wait. Do not paste this list. Do not bundle a second question, a menu, or “anything else?” in the same turn. If the answer is unusable, rephrase **that** question once — still nothing else.

Resume the next unanswered item on the next turn. If they volunteer later answers early, store them and skip those numbers; still ask the next gap, one at a time.

Prefer `/roster` only after they have a primary person **or** they ask to paste long lists (many aliases, old addresses). Chat 1:1 for the required set.

Primary person, required, this order:

1. Legal name
2. **Where they live** (country; US/Canada/Australia: state/province). California → DROP first, after intake — do not start DROP mid-questionnaire.
3. Current city / postal. Street if they want address matching.
4. Phones that show on listings (or “none”)
5. A mailbox **they** can open (verify/OTP). Each family member needs their **own** address.
6. Cadence (default 7 days if they skip)
7. Anonymity: `dedicated` / `personal` / `max`
8. Tools this host already has (skip if you already listed them in §0)
9. Sites to **keep** (`keep_host` / `keep_url`): LinkedIn, news, personal site, interviews — or “defaults”

Then, still 1:1: aliases, prior addresses, extra phones, family. Optional: DOB / MAID / VIN only if DROP or a form needs them. They may say “skip” or “I’ll use /roster”.

After Q2 you know residency; still finish Q3–Q9 before searching or filing. Write `person` + `identifier` as soon as you have name + residency (so a crashed turn does not lose it). `intake_complete=1` only after Q9. Confirm they are not asking you to impersonate.

Family: add as **another `person` row**, not extra identifiers on the primary. Set `relationship` and `consent_basis`:

| consent_basis | Meaning | Scan? |
| --- | --- | --- |
| `self` | Primary subject | yes |
| `parent_of_minor` | User is the parent; child is a minor | yes |
| `authorized_agent` | That adult asked the user to file | yes |
| `unconfirmed` | Listed but not authorized | **no** |

Family members also get their own 1:1 intake (name, consent, own verify email) — still one question per turn.

On every later run:

1. `SELECT * FROM person WHERE active=1 AND consent_basis != 'unconfirmed'`
2. For each: `ryd.py pack --person-id` (or `identifier` where `scan=1`) → search pack
3. File listings onto **that** `person_id`. Own DROP. Own verify email. Own clocks.

From k7cfo/remove-your-data, AGPL-3.0.

More from k7cfo/remove-your-data