Tomasz Janusz launches Privacy Thing for per-domain browser fingerprinting controls

Why it matters

Fingerprinting defenses are moving into browsers, but Janusz is testing demand for visible, per-domain control. Privacy Thing must now turn technical depth into trust and adoption.

Tomasz Janusz has released the first public preview of Privacy Thing, a Chrome and Firefox extension that gives users per-domain control over browser data commonly used for fingerprinting.

On his project page, Janusz says websites can combine signals including geolocation, language, time zone, screen resolution, Canvas, WebGL and device information into a browser fingerprint. He presents Privacy Thing as a way for users to decide what values individual websites can see.

That thesis shapes the product. Instead of treating geolocation, locale and device characteristics as isolated switches, Janusz built a system for presenting websites with a more coherent browser environment. Privacy Thing covers 53 properties, methods and constructors across 13 categories, according to its project documentation, including Canvas, WebGL, Audio, Navigator, Screen, Client Hints, WebRTC and three classes of web workers.

Janusz brings an operator's background to the project. He says he has worked in technology for more than 20 years across web development, cloud architecture, IT security and engineering management. In 2017, he was CTO of Indoorway, a Warsaw project that combined mobile sensors, beacons, mapping and software development kits to track movement inside buildings. Indoorway's system had already been piloted in an Electrolux factory, according to Polish startup publication MamStartup.

Profiles coordinate browser signals by domain

Privacy Thing's core workflow starts with profiles and domain rules. A user can create a regional profile containing coordinates, location accuracy, a variation radius, primary language, language list and time zone, then assign it to a website or hostname pattern.

Janusz calls the alignment system Refract. The extension coordinates values returned through the Geolocation API, navigator.language, navigator.languages, Date and Intl, while also adjusting the Accept-Language header.

The Chrome Web Store listing also describes X-Ray, a diagnostics panel that records when a website accesses supported surfaces. It can show reads involving location, language, screen properties, graphics, audio, WebRTC and workers, along with the profile applied to the page. The Firefox listing says X-Ray is a practical view of browser areas Privacy Thing can recognize and control, rather than a complete record of everything a website does.

This visibility is central to the product. Fingerprinting protections built into browsers generally operate as background defenses. Privacy Thing instead gives users a site-level control panel and a record of supported data access, turning an opaque privacy mechanism into something that can be inspected and configured.

The hard part happens before the page loads

Changing an API after a website has read the original value is too late. Janusz built a dedicated runtime that applies the chosen profile while navigation is still underway, before page scripts can capture the underlying browser data.

The runtime must also reach execution contexts beyond the main document. Modern sites can run code inside frames, dedicated workers, service workers and shared workers. Janusz says Chromium and Firefox launch page code and deliver data in different ways. He says he separated shared product behavior from adapters for each browser's constraints and set up Playwright testing against real Chromium and Firefox builds.

The engineering challenge extends beyond changing a few visible settings. Privacy Thing has to alter browser behavior early enough to matter, consistently enough to avoid creating contradictory signals and carefully enough to keep complex sites running.

Project pages give differing source-code descriptions

Janusz draws firm boundaries around what Privacy Thing can promise. The extension cannot change a public IP address, encrypt traffic or replace a VPN or proxy. Its Chrome Web Store listing says websites may rely on IP addresses, account data, sessions and other information beyond the extension's control. Privacy Thing makes no guarantee of anonymity or undetectability.

Trust will still depend on verifiability. Janusz's portfolio labels Privacy Thing "Open Source" and the same project page lists the source code as "coming soon." The available materials leave prospective users without a clear account of where the reviewable source is published or whether users can inspect it today.

A granular entrant in a mature category

Privacy Thing enters a field where larger products already provide fingerprinting defenses. Brave's fingerprinting-protections docs describe browser-level defenses, including site- and session-based randomization of values used for fingerprinting. Mozilla expanded Firefox's native fingerprinting protections in 2025. The Mozilla listing for CanvasBlocker says the extension can block protected JavaScript APIs or alter their outputs to impede fingerprinting.

Privacy Thing's distribution remains at preview scale. The Chrome listing showed four users and one rating on July 31, while the Firefox listing showed 15 users. Those figures describe an initial release, rather than established demand.

Janusz's wager is that native browser protections leave room for a product built around explicit, per-domain control. Privacy Thing lets a user see which supported signals a site requests, choose the values it receives and keep related regional data consistent. The technical foundation is unusually broad for a solo preview. Clarifying the source-code publication and proving that ordinary users can manage 53 fingerprinting surfaces without breaking their browsing will determine whether that foundation becomes a durable privacy product.