Free while we’re in preview

Get TraceGuard

Checks every laptop's cache and history trails against a written policy.

The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.

One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.

Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.

One file — no installer
Runs on your machine, offline
Source code published below

Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, TraceGuard is included in every plan along with the rest of the range.

The question is who, not what

Its siblings clean a single machine. TraceGuard is the layer above them. Each machine runs traceguard scan --home ~ --machine laptop-07 --out laptop-07.json, you gather the files, and traceguard audit --dir ./reports --policy policy.json prints which machines pass, which fail, which rule each one broke, and how much data the fleet is exposing in total.

A policy is JSON with four rule types: max_bytes, max_files, max_age_days and forbidden, each carrying a severity, applied to any of eight built-in trace categories from browser cache to crash dumps. Exit 2 means a non-compliant fleet, which is a different thing from exit 1 meaning a broken run.

No agent, and no delete key

No daemon, no server, no sockets, no network code whatsoever. Somebody moves the JSON files by share, ticket attachment, USB stick or git. That manual hop is the shipping reality, stated rather than papered over with an implied backend that doesn’t exist.

TraceGuard opens files read-only and never writes inside a scanned home directory. Remediation belongs to CleanVault and EraseProof. Splitting them means a compliance report can be produced by someone holding no destructive rights at all. Reports aren’t signed, so don’t treat one from untrusted hands as proof of anything.

Reading on the job itself

How to securely delete files (and when not to bother) On a spinning hard disk, overwrite the file and it is gone. On an SSD you cannot reliably overwrite anythin...

The rest of Privacy Eraser

Getting rid of things properly. Overwriting files for good, clearing the traces programs leave, proving it happened, and auditing a fleet.

PrivacySweep

Simple Ready

Overwrites files with random data, removes them, and records what it destroyed.

CleanVault

Vertical Ready

Knows that Firefox hides your history in places.sqlite. And a hundred places like it.

EraseProof

Pro Ready

Shred by policy on a schedule, and keep a ledger that proves it happened.

Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams

A working CLI prototype of fleet privacy-posture reporting: each machine produces a scan report, and TraceGuard evaluates them all against a written policy — size, count, age and forbidden-category rules with severities — to show which machines fail, on which rule, and how the fleet is trending. It only reports; remediation is left to CleanVault and EraseProof, and it never modifies anything it scans. Networked agents and scheduled audits are on the roadmap.

Naming status

Working name only — brand verdict **RENAME** (High). Collision: TraceGuard. Rename before launch.

What it draws on

Existing paid software whose best ideas shaped this program: O&O SafeErase, east-tec Eraser, Folder Lock, CCleaner Professional.

Command line

There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.

traceguard 1.0.0 - fleet-wide privacy posture reporting (Techlosoft Privacy Eraser).

USAGE
  traceguard scan   --home <root> --machine <name> [--out <report.json>] [--json]
  traceguard audit  <report.json> [more.json ...] [--dir <reports-dir>]
                    --policy <policy.json> [--fail-on low|medium|high] [--json]
  traceguard policy --example
  traceguard help | -h | --help

COMMANDS
  scan    Measure one machine's privacy traces under --home and emit a report.
          For each built-in category it records file count, total bytes and the
          age in days of the OLDEST artifact. All paths resolve relative to
          --home, so scans are reproducible and testable.

  audit   Ingest one or many machine reports, evaluate each against a written
          policy, and print a per-machine compliance table plus a fleet rollup
          (pass/fail counts, most commonly violated rule, total exposed bytes).

  policy  Print an example policy file to stdout with --example.

SCAN FLAGS
  --home <dir>      Scan root. Required.
  --machine <name>  Machine label recorded in the report. Required.
  --out <file>      Write the JSON report to this file. Use "-" for stdout.
  --json            Print the JSON report to stdout instead of a summary table.

AUDIT FLAGS
  --policy <file>   Policy file to evaluate against. Required.
  --dir <dir>       Also ingest every *.json file in this directory.
  --fail-on <sev>   Lowest severity that fails a machine: low, medium or high.
                    Default: high.
  --json            Emit the full audit result as JSON instead of a table.

POLICY RULE TYPES
  max_age_days   no artifact in the category may be older than <limit> days
  max_bytes      the category must not exceed <limit> bytes
  max_files      the category must not exceed <limit> files
  forbidden      the category must be entirely absent (limit ignored)

...

Recorded from the shipped binary, not written by hand.

Windows (amd64) macOS (Apple Silicon) macOS (Intel) Linux (amd64)

Source

Every file the program is built from:

console.go · console_test.go · guided.go · main.go

SHA-256 checksums · build instructions & scope notes · full build plan

TraceGuard

Preview