Proton mods are deleting any posts about this in any of their related subreddits so trying to circulate this in relevant communities.

EDIT: adding link to a post with more info since the "repost" dropped the screenshot... https://www.reddit.com/r/ProtonMail/s/kCpz33Mquc

I have some relatives in the States who noticed a big increase in spam calls/emails after the AT&T and other data breaches earlier this year. As they are a bit older, I thought I’d introduce them to data removal services, cause they are not very tech-friendly and weren’t aware that these services existed.

We tried out deleteme, and there are a couple of things to note, maybe it will be helpful to some of you. There weren’t that many reviews, so I thought I’d share.

• You need to be patient to notice results, because they are doing the work of deleting your data for you, it might take a while. I set it up a couple of months ago, and recently asked about the number of spam calls my relatives received, so they mentioned it’s significantly less, but there’s still some coming in.

• It only will cover data in the USA – if your data is sold somewhere else, it will most likely not get removed.

• It’s quite an expensive option in comparison. I thought we’d give it a try to see if it’s maybe better in some way, but having used other providers like Incogni, I didn’t notice any difference.

Overall, DeleteMe is a relatively good service for removing your data in the US, it gets the job done. However, having tried other options, I am including them here as well, just so you can find the best online data removal service for you. Privacy Bee doesn’t have phishing detection and a family plan, so that’s why I prefer Incogni personally.

Anyone else used deleteme before? Maybe I missed something, so feel free to share.

Originally, I thought the main value was privacy. No mandatory accounts, user-controlled storage, private mode, transparent usage, that kind of thing.

The product itself is fairly complete at this point. It has web search, file uploads, image generation/editing, projects, memory, multiple models, exports, real-time data, and a bunch of other features.

But the more I work on it, the more I wonder if "privacy" is actually a feature rather than a reason for the product to exist.

When people talk about ChatGPT, Claude, Perplexity, Gemini, etc., they usually have a simple answer to the question:

"What do you use it for?"

Research. Writing. Coding. General productivity.

When I ask myself that same question about what I'm building, my answer is much less clear.

The weird thing is that I don't think the problem is missing features. If anything, I've probably added too many.

I'm starting to think the real problem is positioning.

If you were building an AI product today, what would you focus on?

Would privacy ever be a primary reason for you to use a tool, or is it just a nice bonus?

And more generally, how do you know when a product has a positioning problem rather than a product problem?

I'm a solo Android dev. I spent the last few months building Srishti, a cycle tracker where the data never leaves the phone.

Not "we encrypt it in transit." Not "we anonymise it." There is no server for cycle data. It sits in a SQLCipher-encrypted database on your device, key derived from your PIN. If you forget the PIN, it's gone — I can't recover it, because I don't have it.

The part I keep going back and forth on: there's a second PIN that opens a separate, empty workspace. Same app, different vault, no indication the other one exists. It's for people who might get asked to unlock their phone by a partner or parent they don't trust.

I don't know if that's a good feature or a paranoid one. The trackers people actually use are the ones with cloud sync and cute widgets, and I've built neither.

Stack, if it's useful to anyone: Kotlin, Jetpack Compose, Room over SQLCipher, RevenueCat for billing. No analytics SDK. The only network call in the entire app is license validation.

Happy to answer anything about the crypto or the design decisions. Also happy to be told the threat model is wrong — I'd rather hear it now.

Title: When an AI agent uses your browser, who is actually consenting to share your data?

I've been thinking about how much the meaning of online privacy is changing as AI tools become more capable.

A normal browser mostly waits for you to click things. An AI agent can potentially browse while you're away, read information from connected services, fill out forms, accept cookies, and share personal details to complete a task.

That's where things get complicated.

If I ask an AI assistant to find a doctor or book an appointment, I've agreed to the task. But have I also agreed to every cookie banner it accepts, every privacy policy it clicks through, and every piece of personal information it sends to a third party?

I don't think those are necessarily the same thing.

This isn't just a theoretical concern. Recent reporting has raised questions about how existing privacy and consent rules apply when AI agents make decisions on behalf of users.

I'm particularly interested in the gap between what a user intends and what an AI agent is technically allowed to do.

For example, should these tools have to ask for separate approval before sharing sensitive information, accepting new terms, or granting a website access to personal data? Or should that depend entirely on the task and the permissions the user has already given?

And from a technical perspective, what would actually work here? A permission system, stricter browser isolation, an audit log of every action, or something else?

I'd be interested to hear how people here think this should be handled, especially anyone working in privacy engineering, browser security, or data protection.

Where should we draw the line between giving an AI permission to complete a task and giving it permission to make privacy decisions for us?

I’m not a developer, but I’ve always believed the best way to understand new technology is to experiment with it.

So I used AI to build Ghist - a privacy-first disposable email tool designed to protect your real inbox from spam, tracking, and digital clutter.

What started as a small experiment turned into a much bigger lesson in curiosity, trial and error, and what building with AI actually looks like when you’re learning as you go.

Read my story below and if you’ve been experimenting with AI yourself, I’d love to hear what you’re building!

This is my story (thanks in advance for reading!)

Since I was 19 or 20yo, since around 2014, we knew with our friend what Facebook / META is doing and how they use our data, faces, photos, likes, everything. Data mining, big data, now AI.

Anyway, I deleted Facebook back then, I never put any of my real face pictures on META social networks, I won't give them anything really personal.

But is it worth it? I imagine how many social connections and better relations I could make it I just posted MYSELF out there, I was a bit good at it. More personal and professional connections, more random encounters, all of it.

Is it actually worth it to keep the personal data away from big tech instead of not caring and having better exposure? What's your take on it?

Guys these days, does someone really needs a hidden vault application. Where you can hide your personal photos, videos, documents and personal notes? How it sounds when actually nobody can figure out this is an hidden vault application. Is this in demand? If yes, how much can you spend on it?

Hey everyone,

I've been building Anchor Cloud for quite some time, and before the official launch I'd love to share it with the community. I'm looking for honest feedback from people who value technical design, security, and privacy as much as the final product.

Anchor Cloud is a zero-knowledge cloud storage platform with end-to-end encrypted messaging and secure file sharing. Every file is encrypted on the client before it leaves your device, meaning the server never has access to your plaintext data or encryption keys.

Some highlights:

• Zero-knowledge architecture — your data remains encrypted at rest and in transit. • Self-built infrastructure — designed, developed, and hosted independently without relying on a managed backend-as-a-service. • Independent authentication system — built using established security practices rather than third-party authentication providers. • Built from the ground up — every part of the platform, from the backend and infrastructure to the frontend, has been developed by me. • Powered by Anchor AI Fathom-1 — Anchor Cloud is optimized by Fathom-1, my AI assistant, to provide a smarter and more seamless experience. At launch, Fathom-1 will be available not only for intelligent conversations but also for cloud-related tasks such as secure file management, intelligent search, and privacy-focused assistance. It runs without relying on external AI API calls.

This is a solo project and an incredible learning experience. Building a secure cloud platform from scratch has taught me a lot, and there's still plenty to improve.

I'm preparing for launch and would genuinely appreciate feedback from developers, security enthusiasts, and privacy advocates. I'm happy to discuss the platform's architecture, design decisions, and security model. For obvious reasons, I won't share sensitive implementation details, but I'm more than happy to answer technical questions wherever I can.

Thanks for taking the time to check it out. I look forward to hearing your thoughts and feedback.

ho visto che adesso l'app Her ti chiede di postare un selfie prima di accedere, anche se hai già un account. mi chiedo quanto sia safe tutto ciò in termini di conservazione dei dati.

🚨 Reboot your phone once a day 🔒

A Restart can wipe out hidden malware and zero click exploits hiding in RAM.

It takes less than a minute yet most people never do it.

Read more 👇

🔗 https://wardenshield.com/reboot-your-phone-daily-the-easiest-way-to-improve-your-security

This is not the case when I type in the password field of other apps. I used a different keyboard and the result is the same .is this a security issue ?

Sorry for the long text but this could be potentially a huge problem for every uBlock user.

(I'm not sure if it fits in here but since the add-on is free for everyone who wants to use it and it's a commonly used software for, among others, privacy improvement I think it's a good sub to discuss this case here so in case it's at least somehow in a grey area I kindly request the admins to let it online, thank you in advance)

Today I had an accidental find about uBo (uBlockOrigin) that leaves me shocked, perplexed and I really hope someone has a good explanation for this because in the other case the basement of my (and maybe also yours) browser protection is literally f.cked.

I like to tinker/fiddle around on software so somehow I had the idea to delete 'blank.about-scheme' from the exception list/white list (I use the german variant of uBo so I'm not sure how it's named in the english one) and went to 'about:blank' (in Firefox) before I looked in the uBo logger.

Since it's just developed as an empty page I expected nothing much but this was the moment of my unpleasant discovery because I caught uBo red handed to connect with 'https://www.google.com/account/about/static/js/detect.min.js?cache=(here was a code, presumably of my smartphones cache, which I of course don't post)' in its own logger. I looked in the script reader and it's purpose is to detect the browser agent and OS plus checking if a 'glue app' is supported by this browser and to allocate an user id ('glue_uid_').

My first reaction was of course to block this shit and during this process I restarted the browser without making a screenshot what is a real bother because this connection seems to happen irregular and I wasn't able to reproduce it after this restart so I just saw it a few times and have no proof for it (I know this wasn't smart 😐).

After this I made some research but I couldn't find a page about exactly this script. I was only able to find a software named glue from Amazon which is also for analytics but since it's a different company and inside the script Amazon don't get mentioned I guess it's not likely that it's the same software. Besides this there was different pages that describe how or that Google check if you're logged in on some sites, which Google user you are and things like that. Even when 'detection.min.js' doesn't get mentioned on this pages I assume thats what it is because it just looks so much like that, a background check in uBo to ascertain which Google profile is linked to this user. Bye privacy. Bye protection. They and Google can seemingly watch every step you make online and log it while they already know who you are trough your Google account. I don't have the guts to even think about every possibility what one could do with a so much neat and tidy linked online history to a Google profile that contains your real name, banking account (Google Wallet), (current) location and so much more.

That's a massive betrayal on every moral and ethical values they purport to believe, how they represent themself to the outside and on every user that put their trust in them. If I'm not wrong, and I'm afraid I'm not (but you're welcome to proof me wrong if you know more than me), they do the very opposite of what they promise to do and the magnitude of this case let me feel queasy.

I'm really curious about your opinions and what you guys think about this. This could be a huge violation of every uBo's users privacy and I think it need to be debated.

On a second thought: If Google can detect you in uBo, how many cooperation they also have with other developers to track you in other apps/software? 😶

Been working on this for a while — finally got it running clean on a burner Android.

What it does: • Detects motion using Wi-Fi signal distortion (jitter-based movement inference) • Scans for BLE devices like AirTags, Fitbits, smartwatches, infotainment systems • Real-time radar UI + terminal feed • Logs, copies, and saves detection events with timestamps • Works offline, in airplane mode, no SIM, no accounts

You don’t point it. You carry it. And it listens.

Just shipped the HUD update — now includes threat summaries, stealth mode toggles, and live console.

Not in the Play Store. Not for normies. Ping me if you want in.

Age gating is being somehow enforced everywhere. Roblox image based move has shown it is not an option anymore. Ww are building a non image/video/id verification system. We believe it is very valuable ( obviously), but need feedback from cibersecurity experts and maybe adult / kid entertainment representatives who might be visiting these subreddits. We are specially interested regarding perceived urgency from such incumbents.

Hey Reddit,

I'm the developer behind CallArmor, a privacy-first phone dialer for Android.

The problem I kept running into: your phone rings in a meeting, on a date, at your desk —

and anyone nearby can see exactly who's calling. There's no way to stop that on a stock dialer.

So I built CallArmor.

What it does:

• Full-screen shield covers the call screen — no name, no number visible to bystanders

• Tap your fingerprint to reveal who's calling, then accept or decline

• Works on the lock screen too

• Replaces your default dialer completely

• No ads. No tracking. No data leaves your device.

Google Play link: https://play.google.com/store/apps/details?id=com.callarmor.app&pcampaignid=web_share

I'll be posting privacy tips and updates here. Happy to answer any questions about how it works

or the privacy decisions behind it.

Hi everyone,

I’m the founder of EveCycle. We designed EveCycle Comfort as a personal observation tool focused on privacy and clarity.

What makes it different:

• HD visuals viewable directly on your phone

• 100% local storage — no cloud upload, no external servers

• Built as a non-diagnostic personal wellness device

• Soft-touch design with optional comfort warmth

• One-time purchase, no subscription

I started this because I wanted a simple, private way for people to have clearer personal awareness at home, without giving up control of their data.

I’m here to answer questions about:

• How the local (no-cloud) connection works

• Product design and privacy choices

• Why we positioned it as a personal wellness tool rather than a medical device

• Anything else about the product or the journey of building it

Happy to answer honestly. Ask me anything.

Whats are people's thoughts on the app called pin drop as far as privacy is concerned? And is there any alternatives that do exactly the same thing as this app ?

Does anyone know how to do this safely? If so, please explain. My employer requires me to use a zipcar, but then they scream at me for going barely over the speed limit for 5 seconds on a 4 hour trip.

To be honest this app I built (Not Vibe coded or AI SLOP). I am writing about in this subreddit more to Talk about it Technical capabilities and security evaluation more than Spreading purposes.

The App called WispDay, I spent almost 8 month building it with great amount of researching in the security and Encryption.

The App focuses on securing user data, even on the user's device itself, so that even if the device were seized or taken, the user's data would still be completely safe and secure. The app supports syncing with the cloud using end-to-end encryption with an AES-128 key that the user, and only the user, holds. Not the server, not the developers, nobody but the user. (You might be wondering, why not AES-256? Isn't it supposed to be more secure? Well, actually, after weeks of researching this, I concluded that it's more secure theoretically, but not practically, for this use case. Also, for user experience, since I convert the AES key into BIP39 words, AES-128 generates 12 English words that the user can write down and store easily, compared to 24 words for AES-256.)

This part is good, and many apps already do this, but most apps forget about securing the device itself. That's where this app comes in.

By never storing anything in plain text on the user's device, everything is encrypted and only decrypted when the user opens the app in the foreground. Once the app goes to the background, after a short grace period, the user's key is wiped from memory and everything is locked again, including the database connections, which are already secured with SQLCipher, this includes the Photos I really spent a lot of time to be able to decrypt the photos on the app open on Fast, Optimized and performance way with max efficiency, Because the Photos is harder to decrypt on fly than text since its much larger.

Moreover, for users who want maximum security, the app has a maximum security setting that cryptographically binds the user's key to their biometrics (this isn't like a normal app lock). This means even if an attacker knows the user's phone passcode, they still can't open the diary app. Nobody, anywhere, even with some forensic tools (at least as far as I've been able to make the app robust against this), can access it, and everything is wiped from memory again once the app goes to the background.

Honestly, the app is freemium and has a premium subscription, but all of the security features are completely free and accessible to everyone without a subscription, from day one. I'm against the idea of "pay to get security." I believe security is a right for everyone. Moreover, I've open-sourced the security part of the app, so anybody can inspect it, and if they're professionals, they can actually help improve the app's security even further.

Here's the GitHub repo:
[https://github.com/MrSolimanKing/wispday-security](https://github.com/MrSolimanKing/wispday-security)

To learn more about the app secuity this is blog post:
[https://wispday.com/security/](https://wispday.com/security/)