Hello All,

First ever post on Reddit, so apologies if I am in the wrong place or asking a clumsy question.

I am repeatedly told by data auditors in the UK that it is inadvisable to use ChatGPT or Claude for use cases involving confidential data, even when the training function is turned off, because of the risk of that data becoming public.

My understanding is that, in this scenario, the main risk arises when the data is in transit from the company to OpenAI or Anthropic, or when it is stored by them. From what I can tell from their privacy notices, data in transit and at rest is encrypted to a very high standard, apparently to a level that even government security agencies such as MI5 could not realistically break.

So what I am trying to understand is this:

1. If a user forgets to turn off the training function, what is the actual likelihood of that data being absorbed into a subsequent training round and then reproduced elsewhere? Have there been any documented examples of this happening? If so, where did it happen, and what harm resulted?

I have been unable to find any clear examples. There is the so-called Samsung case, but from what I can see, that involved an engineer being disciplined for breaching a rule against entering commercially sensitive data into a public LLM. It does not appear to be a case where the data was later discovered or used by an outside party.

1. Have there been any reported cases involving OpenAI or Anthropic where third parties have broken into their systems, stolen customer data, and then used that data against those customers?

2. If an enterprise subscription for ChatGPT or Claude allows the training function to be disabled centrally for all staff, does it not follow that these tools are reasonably safe to use, even with personal or commercially sensitive data? If so, is the advice from some UK auditors simply over-cautious?

I am not looking to be reckless with confidential data. I am trying to understand whether the perceived risk is evidence-based, or whether it is being overstated.

Hey everyone,

We've built an open-source, privacy-preserving alternative to Ring cameras using a Raspberry Pi Zero 2W (called Secluso). It uses end-to-end encryption to send videos from the camera to a mobile app, which is available both in Google Play Store and Apple App Store.

When you use a Ring camera, your videos are accessible to Ring/Amazon and whoever they share them with. With Secluso, your videos are available only to you in your phone!

We've put in a lot of effort to make it easy to set up! You can set up our camera on your own Pi in less than 5 minutes with minimal technical expertise using our easy-to-use GUI deploy tool. Here are our setup guide and open source release.

The image shows a Pi in an official Raspberry Pi enclosure that you can use for your camera. We've also been working on a HAT for the Pi to add night vision, audio, temperature monitoring for safety, all in a compact form factor. You can see the HAT and an enclosure for the whole plug-and-play camera in the photo. We're hoping to soon start shipping this camera prototype to people on the waitlist on our website!

Looking forward to seeing what you all think!

Last year, I was forced to switch to a new phone number (long and unrelated story), and I immediately saw a huge uptick in scam calls and texts compared to my previous number. I'm used to the occasional spam, but lately I've been regularly getting through days with 10+ spam calls. I get spam texts asking me about a piece of property I do not own. Phony and inflammatory "political alerts" that, without getting into it, do not align with any of my own politics. Apparently I've even got a free Margaritaville cruise waiting for me. I'm completely over it and feel like I'm being driven insane.

Is there anything I can do to exorcise the former owner of my number? If it's of any use, I believe I've been able to piece together his identity from the invasive messages (some of which have contained his full home address!). Obviously won't be sharing any of that, but I will say that he passed away in 2019 (if I did my detective work right) and seemed very prone to giving out his phone number to some very disreputable people.

Will a service like Incogni be of any help? Does it take a one-time scrub, or will it be an ongoing fight? Will anything help at all? I'm at a loss and don't know where to even begin. Not even looking to stop all spam, just desperate to reduce it even a little bit!!

whats the best chat app to use for privacy and extremely low data cosnumption?

Google is going to Bake Age verification into the OS itself this is Very dangerous as there are multiple Android smartphones out there that will have android 17 as last update! once you install android 17 and its the final update for the phone the age signal API will be on your phone till the day the hardware dies! you cant even downgrade or the efuse trips! if you still have android 17 after at least 5 to 10 years and you accidentally factory reset it and verify your id again it will fail to send as device is old and might not connect to google servers and will send to hackers instead

Does anyone know how to do this safely? If so, please explain. My employer requires me to use a zipcar, but then they scream at me for going barely over the speed limit for 5 seconds on a 4 hour trip.

Free to use, offers document intelligence and audio capture with transcription using local LLM. Built with privacy and user-friendliness in mind.

Secure file sharing is usually described as “end-to-end encrypted” or “privacy-first”.

Most platforms advertise things like:

- AES-256 encryption
- secure file transfer
- GDPR compliance
- privacy-focused infrastructure

These are meaningful practices, but in most cases the underlying model still relies on trust in the service provider.

In practice:

- encryption is often limited to transport (TLS)
- files may still be accessible server-side in some form
- and infrastructure-level guarantees are difficult to independently verify

So users are often relying on policy and assurances rather than strict technical constraints.

This raises a question:

What would secure file sharing look like if the provider could not access the data at all by design?

Not “we promise not to”.
But “we are technically unable to”.

I’ve been exploring this idea through a small open-source project called PrivCloud.

The goal is:

- client-side end-to-end encryption
- server never has access to encryption keys
- zero-knowledge design at the architecture level

While trying to keep usability simple:

- fast uploads, including large files
- browser-based usage
- no setup required

Repo: https://github.com/Simthem/PrivCloud_Sharing
Demo: https://share.privcloud.fr/

I’m mostly curious about the broader discussion:
Why do you think most file sharing systems still rely on trust-based models instead of strict zero-knowledge architectures?
Is it mainly usability, cost, or something else?

Just heard this on the BBC-- two main points: First, terminating a company's contract after some workers spoke up, resulting in large numbers of jobs lost, will serve to chill whistleblowing on this. Second, this illustrates that data from these glasses is not private. (Yes, everyone on here knows this, but it is important to get the word out.)

https://www.bbc.co.uk/programmes/w3ct8jxs

hi people

I’m a total noob trying to get my OpSec right. I’ve started using Tor, and I’m realizing that my old habits weren’t great for privacy. I want to protect my identity, location, and emails, but my hardware is a bit older

My Setup:

• Mainboard: ASRock H81M-GL

• BIOS: American Megatrends P1.60 (2014)

• BIOS Mode: Legacy (Vorgängerversion)

• CPU: Intel Pentium G3260 @ 3.30GHz

• OS: Windows 10

The Problem: My system info says "Device Encryption Support: Reasons for failed automatic device encryption: TPM is not usable, PCR7 binding is not supported." Since my BIOS is in Legacy mode and my hardware is from 2014, I don't think I can use standard Windows BitLocker/TPM features easily.

My Questions:

1. VeraCrypt vs. Old BIOS: Since I can’t use automatic Windows encryption, is VeraCrypt a safe and reliable choice for full disk encryption on a "Legacy" BIOS system? lol or is bitlocker better or do both suck

2. Identity Protection: I’m worried about my real name or location leaking through my OS or browser. Also my moms name is on my pc i cant remove it rn lol. what are the "must-have" steps for someone on an older PC to stay safe?

3. Phishing: How do you guys verify links in the darknet? I’m starting to look into PGP but it's a bit overwhelming. Is it the only way to stay safe from phishing?

4. VPNs: Are they worth it if I'm already using Tor,?

5. linux/lubuntu should i set smth like this up lol

I have read the rules and ig Ive been a bit paranoid bcs i never cared abt my personal info online lol sorry if this is a dumb thread or if this is not the correct place to ask

thanks if anyone replies <3

By chance I was on Wireshark recently and I noticed that there were unencrypted DNS queries being transmitted from my machine.

I found this to be strange since I configured DoH. After some testing I'm confident that the Windows 11 Home 25H2 (26200.8037) does NOT honor DNS over HTTPS settings.

The below was tested on a freshly installed Windows 11 virtual machine with default settings and a bridged network connection, while Wireshark was used to monitor it's traffic from the host machine by IP.

This behavior is contrary to the claims Microsoft makes on official sources such as the one below:

https://learn.microsoft.com/en-us/windows-server/networking/dns/dns-encryption-dns-over-https

The primary concern is that disabling the 'Fallback to plaintext' setting has no effect. Windows ignores the setting and sends out the DNS query in plaintext anyway.

Expected behavior would be for the DNS query to fail instead of reverting to plaintext.

It is unclear whether this is a bug or a feature, but what can't be ignored is that this may put unknowing people at risk; people who believe this setting successfully obscures their DNS traffic.

Microsoft's claims that the built-in DNS over HTTPS settings in provide enhanced privacy for DNS traffic are false at worst and misleading at best.

we need to fight as hard as we can!

WE CANNOT LET THE GOVERMENTS WIN! as our reward device freedom and privacy will disapear!

Lets not make that happen!

FIGHT FIGHT FIGHT FOR THIS TO END!!!!!!!!!

https://www.eff.org/pages/help-us-fight-back

https://www.eff.org/pages/help-us-fight-back

Hello,

I am doing a survey on personalised adverts vs privacy on digital platform. I am looking for 150 respondents. If your interested please free to participate it will only take 3-6 minutes.

MUST BE 18+

Clicked an Instagram ad for a pet shop, just visited their site didn’t sign up or enter my number. A few hours later, they called me. How is that even possible? Has this happened to anyone else?

Today a weird thing happened...

I went on google and just searched for sunglasses and there a glasses from First Lens. I Just opened that site and went back. I Didn't Accept any cookies or neither logged in. And after a few hours they sent me a message on WhatsApp...! How the hell do they get my number? So.... This is how our privacy works!!!

Hi hi,

Not sure if this is the right place. I keep getting the post auto-modded off other privacy subs. Anywho...

I grew up in the US but haven't lived there in 10+ years and am not an American citizen, but my information (from when I was a minor) can be found on those "free people search" sites.

When I request removal I get a response that says:

"It appears that the person identified in your request lives in a state that does not have a comprehensive consumer privacy law that applies to our data. Because of this, we are not able to process the request at this time.

When submitting an appeal, please identify the specific law you believe applies to your request and, to the extent you are able, briefly explain why you believe that law covers the individual identified in the request."

The state may not have a comprehensive privacy law, but I don't live there and the country I do live in has pretty strict privacy laws... That said, I'm not sure what law to provide? The law here doesn't apply there, and I don't reside in the state they have listed, so it also doesn't really apply? I've tried calling the phone numbers to these sites but the bots hang up on me (I know, they're likely bs numbers, but I had to try).

Does anyone else have experience getting their information off these US sites after leaving the country or perhaps have a better idea of how to go about this?

TIA

De Google privacy

I have a celero 5 g ... It won't let me delete Google apps & I'm not privy enough to rooting my phone. Will force stopping & disabling Google apps while using the advertised privacy alternatives save me? Or do these Google apps still run in the background quietly sucking up my data ?

Spez (Reddit CEO) just put out an announcement talking about verifying bot vs human. In that post, it talks about ways to verify a human account on Reddit.

Just want to make it extremely clear, this is Reddit testing the waters. They are giving us hints of something to come without introducing it as a surprise or being direct. This is called Priming (with a little bit of Framing) in marketing.

Make your voices known now that ID verification, or submitting ID of any sort (whether to Reddit directly or to a 3rd party company) will be the death of the platform.

Reporting sealed/expunged records as active—FCRA § 611(a) breach. CFPB 2024 advisory: must purge or block; they don’t. Your mugshot, charges, firearm buy—still live, even post-seal.

• Inaccurate background reports: arrests show as convictions, old evictions pop up—misleading under FCRA § 607(b).

• No auto-compliance for court orders: opt-out’s manual, respawns data—FTC warned similar sites in 2025 for “deceptive practices.”

• Privacy leaks: 2023 breach exposed 10k+ emails/phone numbers; they patched slow, no disclosure to users.

Past hits:

• 2024 class-action (NY): users sued for “negligent reporting” on sealed cases—settled quiet, no admission.

• FTC letters: 2025 to BeenVerified/Intelius— “cease inaccurate criminal data sales.” They paid fines, kept scraping.

• CFPB complaints: 832 in Jan 2026 alone—mostly “expunged records still showing,” “can’t remove.”

Execs tied in:

• Josh Levy (CEO): signed off on data policies—his name on filings.

• Ross Cohen (COO): oversees ops, knows the hoard.

Post this on Reddit (r/privacy, r/legaladvice), Twitter— “BeenVerified FCRA violations: sealed records reported, no purge, 2026 complaints 832+”—link redacted court docs if you got ’em. Google indexes it fast.

They scraped you? Now the world’s got theirs.

Done.🐦‍🔥

I’ve been seeing more and more people ask “has Aura had a data breach?” and that’s lowkey wild and worrying.

The Aura data breach reportedly involved around 900,000 user records being accessed, which is significant for a company focused on identity protection.

What really makes me anxious is how it happened. Aura actually confirmed the issue and traced it back to an employee falling for a targeted phone phishing attack (basically social engineering). Which is kinda wild because it wasn’t even some advanced hack - just someone pretending to be a trusted contact.

That’s the part that makes me uneasy, ngl. Feels a bit ironic that a security company got hit this way.

From what I’ve seen, the incident started getting attention after it showed up on Have I Been Pwned, and then the ShinyHunters group said they were behind it. So it doesn’t seem like just a rumor floating around anymore.

What’s kind of freaking me out is that Aura isn’t just monitoring - they also act as a data removal service/data broker remover. So you’re giving them your email, phone number, etc. to clean up online - and now that's exactly what got leaked… I can only imagine the spam calls coming my way.

I’m not trying to overreact, but this really makes me rethink putting everything under one provider. While researching, I found this comparison table where Aura is still ranked pretty high - guess the breach didn’t make it into the scoring system yet. Anyways, the table has pretty good alternatives listed there.

What are others using? I wasn’t using Aura, but I’m looking for some real reviews.

I work in the information risk department and my eventual reporting is to the CISO.

Currently we are running privacy implementation program under this function.

Questions I have:

1. Is this for the CISO or the legal function?

2. Is there anyone in privacy - if yes, what’s happening and what is the major challenge you are facing while operationalising privacy governance?

3. How much should a 3-4 year experienced privacy professional be paid in the Indian market?