CleanVault
Knows that Firefox hides your history in places.sqlite. And a hundred places like it.
Free right now — no account, no card
Preview
1 interface design, then a screenshot of it running. Drag, scroll or use the arrows.
Free while we’re in preview
Get CleanVault
Knows that Firefox hides your history in places.sqlite. And a hundred places like it.
The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.
One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.
Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.
- One file — no installer
- Runs on your machine, offline
- Source code published below
Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, CleanVault is included in every plan along with the rest of the range.
It tells you where to look
PrivacySweep overwrites a path you name. EraseProof runs a policy against paths you name. CleanVault is the one that knows where the traces are.
It ships a catalog of the actual locations privacy artifacts live on Windows, macOS and Linux: Chrome and Edge cookie jars and Login Data, Firefox places.sqlite and sessionstore inside a randomly named profile directory, Explorer’s thumbcache_*.db, Safari binarycookies, PSReadLine console history, ~/.local/share/recently-used.xbel. cleanvault scan --home ~ resolves all of it and reports which entries exist, how many files and bytes each holds, and how sensitive it rates them.
Auditable by design
Every catalog path is relative and resolves against --home. Point that at a copy of a profile, a mounted image or a throwaway tree and check the numbers with find and du. Nothing outside the catalog is ever a candidate, so your Documents folder can’t be swept up by accident.
clean moves files into a quarantine directory and writes a manifest of every move. There is no delete path anywhere in the program.
Quit your browser first
It doesn’t yet detect a running browser, and moving a live profile database can corrupt the profile. Also: whole files only, no row-level history deletion.
Reading on the job itself
- How to securely delete files (and when not to bother) On a spinning hard disk, overwrite the file and it is gone. On an SSD you cannot reliably overwrite anythin...
Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams
A working CLI prototype of the trace-scanner engine: a built-in catalog of 41–45 privacy-artifact locations per OS (browser caches, cookie and history stores, thumbnails, crash dumps) resolved against a --home root, so it finds the traces rather than erasing a path you already knew. Everything is quarantined, never deleted — verified that planted personal files survive untouched. Selective row-level edits inside the SQLite stores are on the roadmap.
Recorded session
Naming status
Working name only — brand verdict **RENAME** (High). Collision: CleanVault. Rename before launch.
What it draws on
Existing paid software whose best ideas shaped this program: O&O SafeErase, east-tec Eraser, Folder Lock, CCleaner Professional.
Command line
There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.
cleanvault 1.0.0 - find and quarantine browser/app privacy traces.
USAGE
cleanvault <command> [flags]
COMMANDS
catalog Print the built-in artifact catalog.
scan Resolve the catalog against a home root and report what exists.
clean Quarantine matched files (DRY RUN unless --apply).
help Print this help.
CATALOG
cleanvault catalog [--os windows|darwin|linux] [--json]
SCAN
cleanvault scan [<home-root>] [--home <root>] [--os ...] [--system <root>]
[--min-sensitivity low|medium|high] [--json]
CLEAN
cleanvault clean [<home-root>] [--home <root>] --quarantine <qdir> [--os ...]
[--system <root>] [--min-sensitivity low|medium|high]
[--json] [--apply]
COMMON FLAGS
--os <name> Catalog to use. Default: this machine (linux).
--home <root> Root that home-scope catalog paths resolve against.
Default: the current user's home directory.
--system <root> Root for machine-scope entries (e.g. Windows
Prefetch). Omitted by default, so those entries are
skipped.
--min-sensitivity <lvl> Ignore entries below this level. Default: low.
--json Machine-readable output.
--apply clean only. Without it nothing is ever moved.
-h, --help This help (exit 0).
SAFETY
cleanvault never deletes. clean --apply MOVES files into the quarantine
directory, preserving each file's path relative to its root under
<qdir>/home/... or <qdir>/system/..., and writes a manifest describing every
move. Restore by moving files back. Only paths produced by the built-in
...Recorded from the shipped binary, not written by hand.
Source
Every file the program is built from:
console.go · console_test.go · guided.go · main.go
SHA-256 checksums · build instructions & scope notes · full build plan