Open-source personal data removal pipeline. Automated opt-out submission, confirmation tracking, and continuous defense against quiet data-broker re-listings.
OpenOptOut is a free, self-hostable privacy automation platform built for two audiences from the same codebase:
- Families — Single system with role-based access so parents can manage their children's data and spouses can coordinate removals together.
- Institutions (libraries, schools, credit unions, non-profits) — White-label branding, SSO/LDAP/SIP2 authentication, patron self-service, PostgreSQL for scale, database encryption, and privacy reporting.
Our Mission: OpenOptOut is a stopgap. Having to hunt down brokers and beg for your own data is proof of a broken system. You should own your personal records by default. Read our full mission statement and library advocacy notes in
docs/about/mission.md.
- 🛡️ Encrypted Identity Vault — Store all name variants, aliases, emails, phone numbers, and addresses in a zero-knowledge, encrypted vault.
- 🔍 Automated Broker Discovery — Scan broker databases to pinpoint where your personal listings appear before filing removals.
- ⚡ Pluggable Removal Engine — Execute opt-outs via declarative specs or sandboxed gRPC plugins with corporate parent-company batching.
- 📬 Email Confirmation Tracking — Monitor a dedicated inbox via OAuth 2.0 or IMAP to match and verify incoming broker removal confirmations automatically.
- 🔄 Continuous Re-Check Defense — Automatically re-verify and re-submit requests on a scheduled cadence so brokers cannot quietly re-list you.
- 🏛️ Built for Scale & Institutions — Multi-branch partitioning with SIP2/ILS library card login, OIDC/SAML 2.0 SSO, distributed Redis priority workers, and PostgreSQL.
- ♿ WCAG 2.2 AAA Accessible — High-contrast themes, dynamic font scaling (100%–150%), reduced motion safety, skip links, and full keyboard/screen-reader support.
- 🔒 Defense-in-Depth Security — SQLCipher full-database encryption, Fernet field-level encryption, ephemeral memory zeroization, and container sandboxing.
| Family Dashboard | Identity Vault |
|---|---|
 |
 |
| Status overview across all family members | Store name variants, addresses, phones, emails |
curl -fsSL https://raw.githubusercontent.com/rlnunez/OpenOptOut/main/install.sh | shThe installer automatically detects your environment:
- Uses Docker Compose if Docker is installed and running.
- Installs natively (systemd + nginx, no containers) on Debian/Ubuntu systems without Docker.
- Safe to re-run: updates an existing checkout without overwriting
.envconfiguration. - To specify explicitly, use
| sh -s -- --dockeror| sh -s -- --native. Seeinstall.sh --helpfor details.
# 1. Clone repository
git clone https://github.com/rlnunez/OpenOptOut.git openoptout
cd openoptout
# 2. Create environment file (or use ./install.sh to auto-configure security keys)
cp .env.example .env
# Auto-generate security keys with random lengths (128..256 hex chars) and lock permissions:
# chmod 600 .env
# The system automatically generates and secures secret.key (0600 permissions).
# Upon first sign-in, the Setup Wizard presents a top-level mode switch:
# - Express Setup: Zero-touch defaults for home users (SQLite, local/managed HTTPS, deferred email).
# - Advanced Setup: Granular control (PostgreSQL, custom reverse proxies, mail transports, branding).
# The master SECRET_KEY is showcased with masked verification, 1-click clipboard copy,
# and an interactive entropy mixer for custom randomness.
# 3. Start containers
docker compose up -d
# 4. Open http://localhost in your browser
# The first registered user automatically becomes the Super Admin and enters the Setup Wizard.For real production deployments accessible over a network, always enable HTTPS before inviting users. See docs/admin/https.md.
OpenOptOut uses Playwright Firefox for memory hygiene and zero-disk-leak automation:
- Family / Small Community (Standalone): 1 vCPU, 1 GB RAM (2 GB recommended), 10 GB disk, 512 MB tmpfs.
- Library / Institutional Worker Node (4 slots): 2–4 vCPU, 2–4 GB RAM, 15–30 GB disk, 1 GB tmpfs.
For empirical benchmark data, multi-slot scaling profiles, and capacity formulas, see docs/admin/hardware-sizing.md.
OpenOptOut documentation is organized by reader audience and powered by MkDocs:
- 🏠 Documentation Portal — Master hub with full-text search across all guides.
- 👨👩👧👦 User & Family Guide — Setting up family email aliases, private SearXNG search, discovering opt-out forms, and removal verification monitoring.
- ⚙️ Administrator & Operations Guide — Automated HTTPS (Caddy/Traefik/Cloudflare), native bare-metal install, PostgreSQL, SSO/SAML, encrypted backups, and auto-rollback updates.
- 💻 Developer & Contributor Guide — System architecture, declarative broker interpreter runtime, broker add-on authoring, and security scanning.
- 📜 About & Governance — Our Mission & Principles and plain-language Privacy Legislation advocacy.
- 📋 Active Roadmap & Completed Milestones (Archive) — Active/planned initiatives and frozen historical milestone archive (through v0.11.0).
- 📝 Changelog — Semantic release notes and historical tracking for all completed roadmap items and updates.
- ♿ Accessibility Conformance — WCAG 2.2 AAA conformance statement, high-contrast themes, and typography scaling.
- 🔒 Security Policy — Vulnerability reporting, cryptographic controls, and memory hygiene.
We welcome community contributions, particularly:
- Security & Architectural Reviews — Review our sandboxing, cryptography, and auth architecture (see
CONTRIBUTING.md). - Broker Selectors & Plugins — Map new broker form selectors or build gRPC plugins to expand coverage (see
broker-plugins/README.md). - Accessibility Enhancements — Verify workflows with screen readers and assistive devices (see
ACCESSIBILITY.md). - Bug Reports & Test Cases — Help strengthen reliability across platforms.
All community members and contributors are expected to uphold our CODE_OF_CONDUCT.md.
GNU Affero General Public License v3.0 (AGPL-3.0). Copyright © 2026 Robert Nunez.
You are free to use, study, modify, and self-host this software. If you run a modified version as a network service, you must make your modified source code available to users of that service. See LICENSE for the complete license terms.
OpenOptOut builds on the work of volunteers and other open-source projects. See CREDITS.md for who they are and how their work is used.
Disclaimer: OpenOptOut submits opt-out requests on your behalf but cannot guarantee compliance from third-party data brokers. Re-check your listings periodically. OpenOptOut is not a legal service and does not provide legal advice.