Unlisted will send deletion requests to 970 data brokers — locally, for free

⚡ The gist in 5 seconds

• The Unlisted project from the brightsongwrath/personal-data-deletor-osint repository sends data deletion requests to 970 brokers.
• It runs locally on Windows 10 and 11: a single zip, Main.exe, no installer and no admin rights required.
• The machine can't handle web forms and captchas — you still fill those in by hand.

🔍 What happened

On GitHub, someone published Unlisted — a desktop app that prepares and sends data brokers letters demanding they delete your record. The list of 970 companies was compiled from the California state registry and two open lists. By default, only your name and email go into the letter; phone and address stay out of the request unless you add them yourself. The README explains why: a broker who doesn't have that data would learn it from your own request.

The mechanics are simple. You see every text before it's sent, and the letters go out from your own mailbox, spaced out over time — so your email provider doesn't flag the batch as spam. The app then tracks deadlines: one month under GDPR, 45 days under CCPA, and a reminder to a delinquent broker is one click away. Every 90 days the check repeats, because brokers keep putting people back into their databases. Replies are parsed by meaning: "deleted," "fill out a form," "send ID," "refusal." Links leading away from a broker's site are flagged separately. The output is a PDF report with send dates, ready for a complaint to a regulator, plus breach checks via XposedOrNot or your own Have I Been Pwned key. A separate mode searches for your nicknames across a list of 462 sites from the Sherlock project and filters out sites that "find" absolutely everyone.

🧠 Our take

The point of the project is the price tag. Ready-made deletion services charge roughly $96–129 a year for doing largely what you're already entitled to for free. California proved this in practice: more than 500,000 people signed up for the state deletion tool in its first eight months. Our read is that it was exactly this gap, not a love of open source, that drove the author to build it.

What it changes. Until now, the choice was between "pay and don't think" and "sit with a 900-row spreadsheet." Unlisted tries a third way: automation without a subscription and without someone else's server that you upload your data to in order to get it deleted. The logic is airtight — you write to brokers from your own email, you read the replies yourself, the letter database sits on your disk. For someone already paying for deletion, it's not a replacement: the forms and captchas, the most tedious part of the job, remain on you.

Who wins: those willing to spend an evening and figure it out. Who loses — in our assessment, not paid services as a whole, but their bottom tier, where you pay for letters. The real risk lies elsewhere: a tool with five commits from a single author is asking for access to your mailbox. You'll have to take it at its word — or on faith.

⚠️ What we don't know

The main weakness is the source and its maturity. Everything we know comes from the README and repository files: five commits, no independent audit, no description of how exactly the app reads your mail or what it does with OAuth tokens. The claim that "Main.exe is signed, so Windows runs it without a warning" can only be verified by running it — we didn't check the signature ourselves. The "AI" in the README navigation gets a single word, with no details. And yes: 970 addresses is a list of companies, not proof that each one will respond.

Forecast: by the end of the quarter, Unlisted won't have an independent code audit, but there will be at least one fork automating web forms — that's exactly where the project's biggest gap lies.

Disclaimer: a single source — the README and repository files; no independent verification of the app's operation, nothing officially confirmed.

Source: GitHub — brightsongwrath/personal-data-deletor-osint