Skip to main content
In Progress security

Expunge

Privacy automation platform — plugin-based data broker opt-out system with anti-bot bypass chain, browser extension, Celery workers, and real-time WebSocket logging.

Python FastAPI Celery Redis PostgreSQL Playwright SvelteKit FlareSolverr WebSocket

Links

Source Code

Timeline

Started
May 2026
3+
Broker Plugins
6
Anti-Bot Layers
5 services
Architecture
Pre-release
Status

The Problem

Data brokers collect and sell personal information without consent. Opting out requires visiting dozens of sites, each with different forms, CAPTCHAs, and anti-bot protections. Manual removal is tedious and must be repeated as data reappears.

The Solution

Expunge automates the entire opt-out process with a plugin architecture that handles each broker’s unique requirements, bypassing their anti-bot measures automatically.

Architecture

5-service Docker Compose stack:

  • expunge (FastAPI) — API server, plugin orchestrator, WebSocket hub
  • worker (Celery) — background task execution for opt-out workflows
  • postgres — person records, scan history, schedule tracking
  • redis — task queue, pub/sub for real-time log streaming
  • flaresolverr — Cloudflare bypass for protected broker sites

Anti-Bot Bypass Chain

Brokers deploy progressively sophisticated protections. Expunge escalates through 6 layers:

  1. Playwright Stealth — undetectable browser automation
  2. 2Captcha — automated reCAPTCHA/hCaptcha solving
  3. FlareSolverr — Cloudflare challenge bypass
  4. Human-in-the-loop — challenge panel for manual intervention
  5. Cookie import — session reuse from authenticated browsers
  6. Browser extension HTML fetch — DataDome bypass via real browser context

Plugin System

Drop-in Python plugins that auto-discover on startup:

# plugins/core/truepeoplesearch.py
class TruePeopleSearchPlugin(BrokerPlugin):
    name = "TruePeopleSearch"
    async def search(self, person): ...
    async def opt_out(self, listing): ...

UI / Frontend

SvelteKit frontend with:

  • Glass-morphism design, animated backgrounds
  • Real-time log streaming via WebSocket → Redis pub/sub
  • Responsive mobile layout with bottom navigation
  • Scan progress visualization with step-by-step detail

Chrome Extension

Companion browser extension that:

  • Auto-syncs cookies from broker visits
  • Opens tabs on demand for manual verification
  • Sends page HTML back to bypass DataDome JavaScript challenges
  • Communicates with API via CORS-enabled endpoints

Results

  • Successfully automates opt-out from TruePeopleSearch, FastPeopleSearch, and Spokeo
  • DataDome bypass proven working via extension HTML fetch
  • Scheduled re-scans ensure removed data stays removed
  • Will be open-sourced at v1.0