1What it measures
Every request the page makes while it loads and scrolls, the cookies it ends with (lifetime, HttpOnly, and whether your server or a script set them), events fired twice, Meta event ids, Google Consent Mode parameters, CNAME-cloaked tracking subdomains and the weight of tracking scripts.
2What it can't see
Server-to-server delivery (Conversions API, Measurement Protocol) never passes through the browser, so it's reported only when it leaves a trace, such as a cookie set by your own server. Your Trakero dashboard shows what each platform actually received.
3Safe by design
The browser runs in a fresh private context for every scan, can reach only public addresses on ports 80 and 443, presses nothing but a consent banner's accept button, and is closed when the scan ends. We don't store the address or the page.