This idea was inspired by one of my favourite comedian's recent show, no matter how much comedy there was that incident shouldn't happen to anyone, and it shouldn't become less of a concern just because the gender is different.
Nobody tells you where to look for help. What we get instead is a search engine, a pile of government pages with elongated filling of forms, and the knowledge that you should probably post screenshots somewhere. Then you give up, because it is 11pm and you are scared, exhausted and feel lost.
Hence I wanted to build a site which could help people remain aware and have control over their identity online through my website - ReclaimYourNet.
It aims to primarily protect people, especially women from cyber bullying and harassment by providing them a one single website which understands what their specific problem is and tells them which relevant sites (universal, country specific, state specific) they can use to register complaints or take down morphed pics.
The agent runs completely local preserving the identity of the user. The local model works out what kind of harm it is and how urgent it is based on which it gives out its recommendations and recommended sites; a TinyFish web agent then goes to the live web, finds the official portal for every route — including the police station with jurisdiction over your own city — reads the real form as it exists today, and fills it in. You review every value through a monitor on our website and approve it to be submitted, the agent then returns a reference number, and an agent keeps checking whether the content actually came down. it keeps watch and notifies you if it actually came down or has resurfaced.
One description of what happened. Every report you need to file, on the right portal, with the right evidence, and with proof that you filed it.
Live: https://reclaim-your-net.vercel.app
What it does
You type one sentence - or dictate it:
"Someone made a fake Instagram account using my photo and my college ID and is asking my friends to send me 500 rupees as a gift. They also posted my phone number on the page."
How it proceeds:
- Triages it with a small, local, explainable model. Not a black box: it tells you that "money" contributed +2.1 to financial fraud and "photo" +1.4 to image misuse, and it masks your phone number in every shared summary.
- Plans the routes - platform, cybercrime portal, bank fraud cell, police FIR, Google URL removal, pre-emptive takedown services - each with the reason it applies and its deadline, and it tells you what you are missing.
- Finds the live portals with a TinyFish web agent. Not a hard-coded list of URLs: at the moment you file, the agent searches the live web for the current official reporting page, per country, and scores the results for officialness.
- Reads the real form. The agent opens the actual page and returns the fields it has today - labels, required flags, dropdown options, what evidence it wants - through a JSON schema.
- Shows you every value it is about to type, with anything sensitive masked, and waits for you.
- Files it, stops before Submit, and asks again. You get the reference number.
- Tells you it worked - a green badge that says "Filled 3 of 3", plus the agent's own summary of what it put in each field. You do not have to take it on trust, and you do not have to watch a browser to check.
- Proves it - every page read, every reference and every submission goes into a SHA-256 hash chain you can export as a PDF case file.
- Follows up - a monitor re-checks the reported URL every six hours and tells you whether the content actually came down.
The part I am actually proud of
Nothing about the world is hard-coded.
The obvious implementation is a JSON file of "Instagram reports go here, cybercrime.gov.in is here, here is the form schema". It is also wrong within a month, because portals move, forms change, and the details differ per country.
So the channel catalogue in the code is only a fallback. The real work is done by a web agent that goes and looks:
// apps/api/src/pipeline/orchestrator.ts const goal = [ 'You are helping a victim file a report. Read a real reporting form exactly.', `Start page: ${targetUrl}`, '1. Open the page. Follow any link to the reporting / complaint / abuse form.', '2. If you hit a login wall, do NOT log in. Set has_form to false.', '3. For EVERY field record: label, name, required, kind, and for a dropdown', ' the visible option values.', '4. Record the report categories and any evidence the form asks for.', '5. Do NOT type into the form. Do NOT submit anything.', ].join('\n'); const spec = await runAgent(onEvent, { url: targetUrl, goal, outputSchema: ARCHAEOLOGY_SCHEMA, // TinyFish validates the schema first }); And when you approve, the same agent types the values and submits:
const submitGoal = [ 'The form is now filled. Click the final Submit button exactly once.', `Current page: ${targetUrl}`, 'Read the confirmation text and capture any reference number or case id.', ].join('\n'); The best part for the demo is that TinyFish hands back a live stream of the agent's own browser. I embed that streaming_url in the app, so you literally watch the agent open the portal, find the right form, and type into it. It is the difference between "an AI did something" and "I can see exactly what it did".
Jurisdiction is not a detail
A FIR can only be registered by the police station with jurisdiction over where you live. If you type "Gurugram", the agent finds gurgaon.haryanapolice.gov.in/cyber-crime - the district's own page - instead of a generic national portal. A hard-coded list can never do that, and it is the difference between a useful pointer and a dead end.
The part I am not proud of (yet)
The first version of the classifier was a Naive Bayes model, and it was fundamentally wrong for multi-label problems. A generative model has to treat every token as evidence against every class it does not own, so "a fake account using my photo asking for money" produced:
financial_fraud p=0.024 <- technically the top label The fix was to move to a discriminative model - one-vs-rest logistic regression - and to stop pretending that a 223-example hand-labelled corpus can be pushed much further. The honest numbers, from a reproducible 5-fold cross-validation (npm run eval):
| Metric | Value |
|---|---|
| Macro F1 | 0.62 |
| Macro precision | 0.50 |
| Macro recall | 0.83 |
| Top-1 label correct | 89.7% |
I tuned it to over-predict, on purpose. In this domain a missed label means a missed reporting route, and an extra channel costs a victim 20 seconds while a missing one can cost them their money.
Things I learned building it
- A missing reporting route is worse than a useless one. The single most valuable screen is not the list of things to do, it is the list of things you have not covered.
- "Pre-emptive" beats "reactive". Take It Down, StopNCII, Takedown and RemoveHer let you register a photo before it is misused and have it pulled down later - including AI-morphed copies. Almost nobody knows these exist. ReclaimYourNet surfaces them at the moment they are useful.
- Split "fill" from "submit". Two approvals instead of one, and the agent never gets to decide on its own what gets sent in a victim's name.
- Make the model say no. The agent fills everything it can and only leaves a genuinely required field empty. That gap is shown to the user, not hidden. The blank field in the UI is a feature.
- A serverless platform forgets between requests. My first deployment returned 404 for every case. The fix was to stop treating the server as stateful: the client carries the case, and each agent run is one request that stays open and streams its events back on the same connection.
- Never store what someone told you. There is no account and no database. A report lives in the memory of the app and dies with the tab. The only copy that outlives the session is the PDF you download yourself.
- Measure the credits. TinyFish Search and Fetch are free within the daily allowance; the Agent is $0.016/step; a Monitor is $0.005/run. A full report costs about $0.30-0.60 (Rs 25-50), which is what makes a Rs 499/month Pro tier work.
Try it
Live: https://reclaim-your-net.vercel.app
Or run it yourself:
npm install cp .env.example .env # add TINYFISH_API_KEY npx cloudflared tunnel --url http://localhost:4000 # so the cloud browser can reach you npm run dev The demo forms are clones of the real ones, so the agent can be driven end-to-end without touching a live platform. The repo has the architecture, the evaluation script, the pitch deck and a timed demo script.
What I would build next
Authenticated filing (a TinyFish browser profile + vault so the agent files on logged-in platforms as you), and a public channel graph so every case makes the next one's routing better.
Built for KriticalHacks 2026 (AssetMerkle x IGDTUW, with TinyFish).
