Where a Digital Footprint Check Gets Its Data

Most people never ask where the numbers in a footprint report come from. A score of 72 and a dozen high-risk tweets appear, and the instinct is to start deleting from the list. Which files were read, and whether anything was uploaded along the way, tends to be an afterthought. The data sources behind a digital footprint check are quite specific: a handful of files inside the X archive package, plus rule-based judgment on top. Understanding that chain is what tells you how much weight a report deserves.

Four parts follow: what gets read, what gets ignored, where the data travels, and why the counts do not match what X shows.

The files that actually get read

After extraction, the data folder holds around twenty files. A check does not read all of them, only the ones tied to tweet content and account history.

File	What it holds	Role in the report
tweets.js	Every historical tweet, timestamps, engagement counts	Primary source for the score and risk list
like.js	Like history	Signals interest patterns and topic exposure
direct-messages.js	Direct message history	Detects contact details shared in private threads
phone-number.js / email-address-change.js	Linked contact details and change history	Supporting evidence for contact exposure
ip-audit.js / account-creation-ip.js	IP records for logins and account creation	Timeline verification and region inference

tweets.js does the heavy lifting, carrying text, timestamps, likes and reposts for every post. The other files cross-check it. If one stretch of tweets.js is dense with location mentions, and ip-audit.js shows logins from the same city during that period, the location signal is far stronger than tweet text alone. The internal structure is described in what tweets.js in an X archive actually is.

Which file feeds which part of the report

A report reads as one verdict. Taken apart, every block has a different origin.

Report block	Main source	Method
0-100 health score	tweets.js	Weighted by item count and share per risk category
Risk item list	tweets.js	Pattern matching for phone numbers, emails, addresses, locations
Sensitive topic flags	tweets.js	Dictionary and context rules, false positives included
Account activity timeline	tweets.js + ip-audit.js	Aggregated by timestamp
Contact exposure surface	tweets.js + DMs + account files	Cross-file comparison

How the score is weighted is a separate subject. Broadly, contact details carry the most weight, sensitive topics sit in the middle, and location depends on density. The algorithm is laid out in how the health score is calculated, so it is not repeated here. The useful part is that a problem in one block stays inside that block. It does not contaminate the rest of the report.

Fields that get ignored, and why

Unread fields fall into two groups: those unrelated to privacy risk, and those that would actively distort the analysis.

• Ad engagement records. Unrelated to what you posted, and they only inflate item counts.
• Follower and following lists. Volume swamps signal, and they involve other people's data, so they are left out.
• Device tokens and personalization settings. Nothing here helps decide whether a tweet carries risk.
• Language tags on tweets. Language is re-detected during parsing, since stored tags drift.

Ignoring fields has one side effect worth knowing. Report item counts come out lower than people expect. That is filtering, not under-reading. To confirm the read scope for yourself, open the file manifest in your archive. The walking route is in how to read an X archive.

Where data leaves your device

This is the most common question, and the least acceptable place to be vague.

• Parsing stays local. Extraction, file reads, rule matching and scoring all run on your own device. Tweet text does not cross the network.
• Results stay local. The score and list are held in a local data structure and are not submitted to a server.
• Only deletion needs authorization. Removing tweets has to call the platform API, and that step requires an authorized connection. It uses delete permission and does not involve uploading archive content.

The dividing line sits between reading and writing. On-device versus cloud processing is really a question of where that line falls. The architecture is described in local versus cloud processing. If you also want to confirm the report stays in your hands, the sharing side is covered in exporting and sharing a footprint report.

Why report counts differ from what X shows

A mismatch is normal. Sorting the causes keeps you from misreading it as missing data.

• Time gap. The archive is a snapshot from the moment you requested it. Later tweets are absent.
• Deleted content. The archive keeps tweets you removed afterwards, which no longer appear on X.
• Reposts and quotes. Counting rules differ from the page display, and the gap can run into hundreds.
• Media-only tweets. Posts without text produce no text matches but still show up on the timeline.

With those causes in hand, the right comparison becomes obvious. Match archive entry totals against the tweet total on X, never against the risk list, which has already been filtered. When the two disagree, check the snapshot date first, then whether deleted tweets are included.

Knowing where the data comes from turns a report from a number into a chain you can question. The check at digital-footprint-health.shop is free from the homepage, parses your archive on your own machine, and never uploads tweet text. To see the output shape first, review what a footprint report contains. Cleanup scope and cost are on the pricing page, and the rest of the method write-ups sit in the blog index.