ZeroTrace AirLeak
Library & Recognized
Cross-session device memory
Single-session captures are useful, but the bigger story usually lives across sessions: "Have I seen this device before? When? What did I learn last time?" The Library and Recognized views are AirLeak's long-term memory.
Two stores, two purposes
AirLeak has two cross-session stores:
- Library — curated, fingerprint-keyed, MAC-rotation-tolerant. The "official" memory of devices you've encountered.
- Recognized — fast localStorage-backed store of every device the desktop has ever observed, with full per-device detail blob.
Both work automatically — you don't configure anything. They just accumulate as you use the unit.
What gets stored
For every device the unit has observed in any session:
- Friendly name
- MAC address(es) — including all rotated MACs grouped by fingerprint
- Class + confidence
- Vendor
- OS major version
- All extracted identifiers (Service UUIDs, appearance, BLE flags, vendor IEs)
- Latest battery readings
- Latest signal strength + best ever
- All probed SSIDs across all sessions
- All sessions in which it was observed
- Your notes and labels
Cross-session detail "wins" — once a field has been observed, it's remembered, even if subsequent observations don't include that field.
The Library page
In the AirLeak sidebar, Insights → Library tab. Each row is one device you've encountered:
| Column | Description |
|---|---|
| Device | Icon + friendly name + class |
| First seen | Earliest observation (in the library's history) |
| Last seen | Most recent observation |
| Sessions | How many sessions it appeared in |
| MACs | How many MACs (fingerprint-merged) |
| Notes | Your labels / free-form notes |
The library is searchable and filterable — same controls as the Devices page.
Click any row to open the full device detail (with cross-session history).
The Recognized page
In the AirLeak sidebar, Recognized. This is the complete localStorage-backed device-history-store, updated instantly every time a new identifying field is observed.
Differences from the Library:
| Library | Recognized | |
|---|---|---|
| Backed by | App's persistent data store | Browser localStorage |
| Update cadence | Every ~5 seconds | Instant on every new field |
| Persistence | Survives app reinstall | Tied to localStorage (cleared with browser data) |
| Cross-machine | If you sync the data folder | Local to this install only |
In practice: Recognized updates faster (you'll see a new device appear within a second of a name being broadcast). Library is the system of record for cross-session queries.
What Recognized lets you do
The Recognized page answers "have I ever seen this MAC / fingerprint before, ever?"
If a Galaxy Watch flashed its name once two weeks ago in a coffee shop and you never saw it again, the Recognized store still has the name. Same for AirTag IDs, OS versions, BLE flags — any field the unit has ever surfaced for a device gets remembered.
Useful for:
- "Is this AirTag the same one I saw at the airport last month?" — search by partial MAC
- "What's the friendly name of this MAC even though the current capture didn't show it?" — instant lookup
- "How many AirTags have I ever encountered?" — filter view
How fingerprint merging works
The library and recognized stores both use fingerprinting to handle MAC rotation. A fingerprint is a stable hash combining payload-stable fields:
- OS major version
- AirPods model ID
- Friendly name
- Service UUID set
- Vendor IEs in WiFi probes
- BLE manufacturer data signature
When two MACs share a strong fingerprint, the library merges them into one device entity. The Linked MACs section of the device detail shows every MAC that's ever rolled up to that fingerprint.
This is what defeats MAC rotation in practice. Modern phones rotate every ~15 minutes; AirLeak follows them through that.
See Single Device View → Linked MACs for what this looks like in the UI.
Marking devices
Open any device's detail page and use the action buttons / labels:
- Mark as own — flags as your device, suppresses logging detail and excludes from privacy stats
- Label — pick from
mine/family/coworker/unknown/suspicious/do_not_log - Free-form note — short text (max 256 chars)
These persist in the Library and apply across all future sessions.
The do_not_log label is special: devices with it are excluded from session exports and the library retains only minimal detail. Use this for medical devices, hearing aids, children's devices, or anything you don't want to accumulate detail on.
Searching the Library
The library's search box matches across:
- Friendly name
- MAC (any of the linked MACs)
- Class
- Vendor
- OS major version
- Notes
- Labels
Substring match, case-insensitive, real-time.
For more complex queries (e.g. "all AirTags I've seen with battery low"), open the Library page and combine search + filter chips.
Filtering the Library
Filter chips on the Library page:
| Filter | Effect |
|---|---|
| Trackers | Only AirTag / Tile / SmartTag / FMDN / Pebblebee / Chipolo |
| Apple ecosystem | Any iPhone / iPad / Mac / AirPods / Apple Watch / etc. |
| Smart home | Smart TVs / lights / locks / IoT |
| With alerts | Only devices that've fired ≥1 alert across sessions |
| Owned | Devices marked as own |
| Suspicious | Devices labeled suspicious |
| Recently active | Last seen within 24h |
Combinations are AND-ed.
Cross-session insights
The Insights page reads from the Library to show:
- Trackers tab — total AirTags, separated AirTags, Tile counts, observed across all time
- Library tab — top devices by sessions seen, average sessions per device
- Privacy tab — owned vs external counts across the library
- Distribution tab — class distribution across all observations
These dashboards aggregate library data, so they reflect everything you've ever captured, not just the current session.
Library size and pruning
The library grows over time. A typical user accumulates 500–2000 devices in the library after a month of regular use.
To prune:
- Delete devices you don't need: open detail → menu → Remove from library
- Bulk-delete devices not seen in N days: Insights → Library → Prune older than ...
- Wipe everything: Settings → Advanced → Clear library (asks for confirmation)
Wiping the library doesn't affect your sessions — those are separate. You can re-populate the library by re-replaying old sessions.
Privacy considerations
The library is local to your machine, but it accumulates personal data about strangers (their device names, probed SSIDs, fingerprints).
Best practices:
- Periodically prune older entries you don't need
- Clear before sharing your machine or data folder
- Use
do_not_logfor sensitive device classes
See Privacy & Legal for the full guide.
Without the library, every capture would feel like meeting strangers for the first time — even if you've seen them before. With it, AirLeak feels coherent: "Oh, that's the same Tile from yesterday's grocery run." The longer you use the unit, the more useful the library gets.