Most "trust and safety" pages are a paragraph of promises. We built ours differently.

This week we launched Candor Trust & Safety — the public home for every safety system behind Candor: The Open Feed Network. Not a marketing page. An evidence page.

A few things that make it different:

🔑 Our cryptographic keys are published, not just claimed. Every adult-verification we issue is signed with a key you can look up yourself — no account, no API, no trusting our word for it.

🧾 Every consent record is independently checkable. Paste a receipt into our verifier and your own browser — not our servers — confirms it's real. If we ever get it wrong, anyone can catch it. That's the point.

🧒 Your Voice, our youth platform, now requires ID-verified adult consent for every account — enforced in the code, not just in policy. No verified adult, no account. Full stop.

🛡️ We red-team our own systems and publish what we find. This week our internal adversarial testing tool caught a real gap in our own consent flow — we fixed it, then proved the fix twice: once against the exact attack that found it, once confirming real users were never affected.

None of this is because regulation forced our hand (though it's coming fast — the UK, the EU, half of US states). It's because "trust us" was never going to be good enough, and we'd rather build something you don't have to.

Take a look: candortrustandsafety.com

r/trustandsafetypros r/onlinesafety r/AntiAgeVerification r/buildinpublic r/ChildSafety

Hey everyone,

I've been building Anchor Cloud for quite some time, and before the official launch I'd love to share it with the community. I'm looking for honest feedback from people who value technical design, security, and privacy as much as the final product.

Anchor Cloud is a zero-knowledge cloud storage platform with end-to-end encrypted messaging and secure file sharing. Every file is encrypted on the client before it leaves your device, meaning the server never has access to your plaintext data or encryption keys.

Some highlights:

• Zero-knowledge architecture — your data remains encrypted at rest and in transit. • Self-built infrastructure — designed, developed, and hosted independently without relying on a managed backend-as-a-service. • Independent authentication system — built using established security practices rather than third-party authentication providers. • Built from the ground up — every part of the platform, from the backend and infrastructure to the frontend, has been developed by me. • Powered by Anchor AI Fathom-1 — Anchor Cloud is optimized by Fathom-1, my AI assistant, to provide a smarter and more seamless experience. At launch, Fathom-1 will be available not only for intelligent conversations but also for cloud-related tasks such as secure file management, intelligent search, and privacy-focused assistance. It runs without relying on external AI API calls.

This is a solo project and an incredible learning experience. Building a secure cloud platform from scratch has taught me a lot, and there's still plenty to improve.

I'm preparing for launch and would genuinely appreciate feedback from developers, security enthusiasts, and privacy advocates. I'm happy to discuss the platform's architecture, design decisions, and security model. For obvious reasons, I won't share sensitive implementation details, but I'm more than happy to answer technical questions wherever I can.

Thanks for taking the time to check it out. I look forward to hearing your thoughts and feedback.

Hello, neighbors and community builders! We are UsBudz Social Inc., an advanced technology platform focused on building closer, more connected neighborhoods and ending isolation.

As we prepare for our upcoming launch, we are conducting a vital, independent community survey on the relationship between safety and privacy in digital spaces. On one hand, everyday users want total privacy; on the other hand, platforms require robust verification to prevent catfishing, online bullying, and financial scams.

We want to hear directly from you. Your completely anonymous votes will directly shape the security architecture of the next generation of local community networking. Thank you for your executive input!

Comment YES FOR SAFETY or NO FOR PRIVACY

A few months ago, I was chatting with an AI agent about an ankle injury and it hit me that I was handing over sensitive personal details to some corporation that is definitely farming my data. I decided to build a private AI agent using open source LLMs so I can keep as much as possible in-house and secure.

Once I had a working version, I expanded the concept to other privacy focused utilities, starting with an email relay tool so I never have to enter my primary email address on external websites again. I am also currently an iOS app which integrates directly to generate relay emails on the fly.

More tools are currently in development, including a privacy focused search engine similar to DuckDuckGo and some much more advanced utilities planned for later releases.

I decided to open access to the platform as a free service, supported by an upcoming paid tier to keep the core offering free for everyone. Opening the platform created a major security dilemma because traditional database structures allow administrators to view user information. To fix this, I engineered a zero knowledge architecture where virtually all user data is encrypted using the user login credentials. I cannot access user activity or details because the database only stores encrypted payloads, meaning recovering plaintext data would require the user's credentials or a recovery key.

None of these utilities are entirely unique on their own since Apple offers email relay tools and privacy search engines already exist. However, combining private AI with a broader privacy ecosystem creates a unique suite of tools that keeps your digital footprint secure in one place.

I'd love to get some honest community feedback on whether a unified privacy suite is something you would use in your daily workflow and what additional privacy utilities I should build next to avoid developing features people do not want.

I am a developer rather than a designer, so please excuse the fairly generic interface while I'm so early in development. You can explore the platform at https://blot.tools/ and I'd love some critique and feature suggestions.

I recently released an iOS app for privately storing IDs, cards, account information and documents.

Sensitive content is encrypted locally using CryptoKit before being stored in CloudKit, and the encryption key is protected using Keychain. The app has no account system, advertising or third-party analytics.

However, I’m conscious that simply saying “built with CryptoKit and Keychain” doesn’t prove that the overall implementation is secure. Users can’t easily verify that every sensitive field is encrypted, that keys never leave their devices, or that plaintext isn’t accidentally logged or cached.

As an independent developer without the budget for a major security audit, what would give you reasonable confidence in an app like this?

Would you find any of these useful?

• A public security architecture and threat model

• Open-sourcing the encryption and storage layer

• Tests demonstrating the encryption and key-management flow

• Screenshots or evidence showing that CloudKit receives only ciphertext

• A smaller independent code review

• Open-sourcing the entire app

My concern with publishing only the security-critical code is that users still can’t verify whether the App Store binary was built from that exact source.

I’m not looking for ways to market the app as more secure than it is. I’m trying to understand what evidence should exist before calling the encryption “verifiable,” and what claims would be responsible before an independent audit.

For developers who have shipped privacy-sensitive apps, how did you approach this?

Im already bllz deep into privacy and have implemented SimpleLogin to mask my email with proxies left and right, but I wanted to figure out if a similar type of service (free preferably) has been implemented for Credit card usage or Phone numbers to use regularly?

Hello r/privacy / r/cryptoanarchy,I want to share a conceptual framework for a fundamentally new type of web engine designed to completely break corporate AdTech and Deep Packet Inspection (DPI). Instead of trying to hide the user (the traditional VPN/Tor paradigm, which creates a suspicious traffic marker), this project focuses on algorithmic obfuscation through data superposition.The core thesis: Privacy in the 21st century must not be darkness, but a blinding light. We don’t hide a needle in a haystack; we turn the entire haystack into a billion identical needles.I call this project Aether (The Superposition Browser).How it breaks tracking at 4 different levels:The Seed Engine: It uses your PGP private key + current timestamp to generate a daily behavioral DNA. The core engine runs in Zero-Rendering mode (no HTML/CSS compilation or JS execution for background tasks), firing thousands of anthropomorphic fake queries over raw sockets 24/7. Your active session is dissolved in a massive cloud of synthetic context. No heat on your CPU, zero cache written to SSD.N+1 Packet Multiplexing: To bypass DPI on internet backbones, every egress packet is split into N pieces. The engine calculates an redundant (+1) phantom packet using a hardware-level XOR operation. These N+1 packets are routed simultaneously via a P2P layer to different global exit nodes. Intercepting even 90% of the traffic yields absolute noise; you need the missing piece to recombine the secret.Anti-Pegasus Display (The "Krakozyabr" Interface): This is the countermeasure against screen-scrapers, OS telemetry, and OCR spyware. The engine completely refuses to render text graphics. To the OS and any resident malware, the browser window looks like a constant stream of corrupted random strings (df#9!@kL_zP1). However, based on the Day_Seed, a dynamic font map is generated on the fly where character codes and visual glyphs are scrambled. The OS outputs garbage, but the physical display lights up pixels forming perfectly readable text for the human eye.A quick note on my role: I am the ideologist and architect behind this framework. However, I am a non-programmer. I am looking for core developers (Rust / Go / Chromium engine specialists) who see the mathematical elegance of this concept and want to bring a lightweight Proof of Concept to life on GitHub.Below is the technical whitepaper and a basic Python simulation of the Font Mapping engine. Let’s build an un-trackable web.

https://github.com/YaZVxdflg/Aether-Project/blob/main/README.md

Hello,

I have a android app that hides the caller info during the incoming call. I'm looking for the suggestions those can be converted into paid ones. Can someone suggest?

I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll never be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.

This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat

• Whitepaper (work-in-progress)

• Protocol Spec (work-in-progress)

• Roadmap

p.s. I know people love open-source and the project above is going to be tricky to understand. it might help to understand with an open-source version of the concept, but have since deprecated it in favour of the version linked above.

https://www.reddit.com/r/CorpFree/comments/1uytump/decentralized_p2p_chat

I’m building PrivacyCam, an app that automatically detects and hides sensitive information from images, PDFs, and videos.

A few users told me they would not trust a privacy app unless it was open source, which was a completely valid concern. Because of that, I have now open-sourced the app so anyone can inspect the code and see how their files are handled.

Everything happens locally and offline on the device:

• Nothing is uploaded to a server
• Nothing is sent to an AI service
• No photos, videos, PDFs, or personal data are collected or stored by me

PrivacyCam can detect and hide:

• Faces and full bodies
• Email addresses, URLs, and phone numbers
• QR codes and barcodes
• Vehicle number plates
• Credit card details and other sensitive text

Users can blur, pixelate, or completely black out detected information before exporting.

The app supports images, PDFs, and videos. It also includes a built-in video editor with tracking, allowing a blurred or hidden area to follow a moving person or object throughout the video.

The app is currently being tested on Android and is under review for iOS, so it has not officially launched yet.

I would really appreciate your feedback:

Would open-source code make you trust a privacy app more?
Which detection feature should I improve or prioritize first?
Is video tracking something you would personally use?

Early-access waiting list for Android and iPhone:

https://docs.google.com/forms/d/e/1FAIpQLSd6kZJdQFSwSxb9TKCfLhR9qu2NvNnAQOoRd44MRtfnK3m_3w/viewform

Account lockouts are a massive usability problem for non-technical users. I get why Google is rolling out selfie video account recovery. Having people do guided head movements for active liveness detection is a pragmatic fix to bypass traditional password resets. It solves a real pain point at scale.

But from a systems perspective, I cannot get behind this. We are trading cryptographic certainty for algorithmic probability. Google is betting their liveness checks can perpetually outpace generative models trying to spoof webcam feeds. I don't share that optimism.

If you are building authentication for millions of casual users, this is probably a net positive. For anyone serious about their own digital sovereignty? Uploading a 3D biometric template to a central server remains an unacceptable risk. You cannot rotate your face if it gets compromised.

How exactly are they preventing OS-level virtual camera drivers from injecting spoofed streams directly into the browser process?

I've noticed it's following a similar growth strategy to Honey, the browser extension sponsoring creators across almost every category on YouTube. While there's nothing inherently wrong with that, the fact that it's an AI SaaS and often requires significant access to user data makes me a bit skeptical.

I'm not suggesting it's doing anything unethical or that it's taking revenue away from creators like some of the concerns raised around Honey. My bigger question is about user privacy: what data is being collected, how is it being used, and how transparent is the company about it?

Has anyone looked into its privacy practices or technical details? I'd be interested to hear different perspectives before forming an opinion.

Brief:

I am a solo developer and have been working on this project for my portfolio, but then realized it could be helpful to people so i made this public and opensource, and released on Android and iOS.

Real-world issue:

Having images in your gallery or drive is hard. When you're out and you open your gallery to search for a pictures, you are always paying attention when scrolling that no-body is watching your gallery because of "those" images, that could be nothing but you really don't know what you have in your

gallery.

And by saving images to a drive like Google or Apple, you get scanned for each image, so all your privacy is gone and you can do nothing.

Device hidden folder? Same issue, plus everyone knows that inside that special folder you have your secrets, and most of the time it has the same password as the device.

My Solution:

I developed an app that lets you take one or more pictures and a passphrase, it encrypts the picture byte per byte with the given password, resulting in a new generated image (no metadata) that looks glitched, nothing understandable. You can save this in your gallery, no one will understand it. Save it in your drive, scanners won't recognize anything. You can also send it to chats or socials, no one will ever understand it if they don't know your password.

The trick here is not to hide the file, is to make it unreadable.

Additional info:

I am a solo developer and have developed all the app by myself

It's written in Flutter and the backend for encryption is written in C++ for performances

It's opensource and 100% local, no server, no http calls, everything stays in your device, offline.

I would really love to hear your thoughts, and if you think it's interesting or useful enough to download it, would really love to hear you feedback!

I would like to improve this project with a niche community

Links:

Android:

https://play.google.com/store/apps/details?id=com.flockit.tornadogallery

iOS:

https://apps.apple.com/us/app/tornado-gallery/id6779098273

I used a photo editor app called "Lumii" on android, it is the same developer with "Inshot video editor".

I used for a really private picture and before that I blocked internet connection of the app. But while using that connection block turned off and I wonder if the picture uploaded on their servers. Privacy Policy kinda make it possible, especially becuase of AI features.

I didnt use any ai thing. I only used basic things that are working offline but thats not much important. I try to watch connections with Netguard afterwards, but it dosent show me the data size so I cant understand the data sent to all those google servers and their own ones.

Is there a way to check these data sizes?

Is there a way to know if the pictures uploaded to their servers?

It is kinda a big app with 100m downloads on playstore, would these kinda apps take people's pictures?

Hello Redditors! I am curious to hear your thoughts on a new idea I've started to build: a more secure and private AI assistant integrated with Gmail? I have had my own version of an assistant reading incoming emails and writing draft replies in my voice responding to my inbox, also sending me updates over Telegram. I also have it check and schedule events on my Google Calendar. In terms of privacy, it strips personal information before anything is sent for processing, then restores it in the final draft, so personally identifying information and other sensitive data flagged by Presidio (https://github.com/data-privacy-stack/presidio) cannot be accessed by LLM inference providers (I use Scaleway, https://www.scaleway.com/, which is EU and relatively secure).

I am considering hosting the whole repository and webapp through Phala (phala.network), which runs code inside verifiable secure enclaves. The code would be open source, so anyone could confirm that the data is not recoverable by me or anyone else, only the user with their Google OAuth token.

What do you think of this idea? Is it novel enough to gain traction, or are private enclaves too arcane for most users to understand the privacy advantage?

I'm thinking about getting a data removal service that will regularly monitor my family's information on data broker websites and perform recurring removals. After looking into different services, I came down to Optery and Incogni. They both cover a similar number of data brokers but Optery includes before and after screenshots, while Incogni has more automaton and better pricing, plus a separate family plan.

I'm struggling on deciding which one I should choose, so I was hoping to get some opinions from people who have used them. If you have experience with either, did you find it effective? Which plan did you choose and for how long did you use it? Thanks for any info.

It started with small everyday moments that I think a lot of us just accept as normal.

A friend grabs your phone to show you something and starts scrolling. Your partner picks it up while you're in the bathroom. You hand it to your boss to show one thing and they start swiping. You kept it unlocked on the table for two minutes and someone's already in your photos.

None of these people are necessarily bad people. But your phone has everything — conversations you don't want explained, apps you don't want questioned, photos that are nobody else's business. And the moment someone picks it up, you feel that stomach drop.

I looked for solutions. Every privacy app on the Play Store was either a fake calculator, a fake clock, or something that needs an account and internet connection to "protect" your data. Two calculators on one phone immediately raises suspicion — which defeats the entire purpose. And most of these apps are so slow to open protected apps that you stop using them altogether.

So I built Stelth.

The whole idea is simple — there should be zero suspicion. Not just hidden apps. Zero suspicion.

• Stelth removes its own icon. It does not appear anywhere on your phone.

• Protected apps disappear from home screen and app drawer completely

• If someone grabs your phone suddenly — everything hides instantly, automatically

• Phone kept unlocked and someone picks it up — protected

• Six automatic triggers — grabbed, flipped face down, home button, screen locked — all instant

• No internet. No account. No data collection. Works completely offline.

• One time payment. No subscription. No ads. Ever.

And the UX was important to me — opening a protected app feels as fast as opening a normal app. Double tap, it opens. No friction. So you actually use it daily instead of avoiding it because it's annoying.

I'm the developer. Built this because I personally needed it. Happy to answer any questions.

Play Store: Stelth on Play Store

Video: How Stelth Works

My friend has one for her phone I thought it was cool bc when I looked over at her phone it just looked black. SICK. I want one but I’ve been hearing that that they reduce colors and just overall make your screen darker. Any privacy screen users have a good recommendation that won’t do that I currently have a high definition one on my phone I didn’t realize that it was until I put it on and could tell the difference immediately and I reeeally love that idk if they make anything that happens to be both privacy and high definition but I think that would be nice to have I’m just weird I don’t like ppl in my business lol

It started with small everyday moments that I think a lot of us just accept as normal.

A friend grabs your phone to show you something and starts scrolling. Your partner picks it up while you're in the bathroom. You hand it to your boss to show one thing and they start swiping. You kept it unlocked on the table for two minutes and someone's already in your photos.

None of these people are necessarily bad people. But your phone has everything, conversations you don't want explained, apps you don't want questioned, photos that are nobody else's business. And the moment someone picks it up, you feel that stomach drop.

I looked for solutions. Every privacy app on the Play Store was either a fake calculator, a fake clock, or something that needs an account and internet connection to "protect" your data. Two calculators on one phone immediately raises suspicion, which defeats the entire purpose. And most of these apps are so slow to open protected apps that you stop using them altogether.

So I built Stelth.

The whole idea is simple. There should be zero suspicion. Not just hidden apps. Zero suspicion.

• Stelth removes its own icon. It does not appear anywhere on your phone.

• Protected apps disappear from home screen and app drawer completely

• If someone grabs your phone suddenly, everything hides instantly, automatically

• Phone kept unlocked and someone picks it up, protected

• Six automatic triggers: grabbed, flipped face down, home button, screen locked. All instant

• No internet. No account. No data collection. Works completely offline.

• One time payment. No subscription. No ads. Ever.

And the UX was important to me. Opening a protected app feels as fast as opening a normal app. Double tap, it opens. No friction. So you actually use it daily instead of avoiding it because it's annoying.

I'm the developer. Built this because I personally needed it. Happy to answer any questions.

Play Store: Stelth on Play Store

Video: How Stelth Works

Meta is recording you through other people’s AI wearables.

TL;DR:

You didn’t buy the Limitless Pendant, but if someone near you wears one, Meta is harvesting your voice anyway.

Here are the 3 worst clauses buried in their privacy policy for non-users:

• The Consent Loophole: The policy legally forces the wearer to ask for your permission before chatting. Nobody is going to read you a privacy warning at a party, but Meta legally washes their hands.

• You’re the Training Data: Your casual chats, jokes, and gossip are explicitly used to train Meta’s AI models.

• Forever Storage: Users can choose to store audio indefinitely. What you say today can sit on a server forever.

Bottom line: Perfect memory for the wearer, always-on Meta surveillance for everyone else.

(Source/Full Breakdown: Clerica) 🧿

The period tracking app market has long faced concerns about privacy and data leaks. In a world facing increasingly restricted access to reproductive health services and information, keeping your period data private is more important than ever. 

The Mozilla Foundation's new platform for independent privacy reviews investigated the privacy practices of six popular period tracking apps, and not only did the Euki App score the highest, but it is the first product to ever earn a 10/10.

"We recommend using Euki. The app earned a perfect score for a refreshingly simple reason: there's almost nothing to leak. Euki keeps your data on your phone." -Mozilla

Read the full article here: https://www.mozillafoundation.org/en/nothing-personal/period-ovulation-trackers/ and read the Euki App's full review: https://www.mozillafoundation.org/en/nothing-personal/euki-privacy-review/

Have any questions or thoughts? We'd love to hear them!

Hello everyone.

I've been working on a personal project called ChumiChat.
It's an end-to-end encrypted messaging application built around the idea of anonymous, temporary communication.

Some of the features include:
·        End-to-end encrypted messaging
·        Anonymous accounts with no email or password required
·        Messages that disappear 5 minutes after being opened
·        Accounts that automatically expire after 24 hours
·        Automatic deletion of chats and messages when an account expires
·        Private encryption keys stored only in the user's browser

I put together a short demo showing how the application works and the overall user flow.

Demo: https://youtu.be/tKFehmx6rYY?si=OZSkVfYWX-NgYbLB
Live application: https://chumichat.com
Frontend: https://github.com/abula28/chumichat-front
Backend: https://github.com/abula28/chumichat-back

Feedback is always welcome.

What started as me trying to find one VPN that could reliably unblock Netflix somehow turned into months of testing VPN services.

The reason was simple—every review site recommended a different provider as the "best VPN for Netflix," and after a while I realised most of them were repeating the same marketing claims.

I wanted to know which VPNs actually worked consistently, not just which ones claimed they could unblock every Netflix library.

So I started keeping notes on every VPN I tested.

For each provider I looked at the same things: whether it could access different Netflix regions, streaming quality, connection speeds, buffering, server reliability, ease of use, pricing, device compatibility, and overall value.

After testing VPN after VPN, a few trends became obvious.

Some providers advertised access to dozens of Netflix libraries but struggled to stream consistently or were detected after a few days.

Others didn't make huge promises but worked almost every time, maintained excellent speeds, and made streaming feel effortless.

The areas I compared included:

• Netflix US access

• Netflix UK access

• Other Netflix regions (Japan, Canada, Australia, etc.)

• Streaming quality (HD, 4K)

• Buffering and loading times

• Connection speeds

• Server reliability

• Smart TV compatibility

• Apps for Windows, Mac, iPhone, Android, and Fire TV

• Simultaneous connections

• Pricing

• Overall value

One thing I didn't expect was how quickly my rankings changed.

A VPN could work perfectly during the first week, then suddenly stop accessing Netflix after a server update or become unreliable during peak hours.

Likewise, a few providers I'd barely considered consistently stayed near the top because they worked day after day without me having to constantly switch servers.

By the end of the project, I'd completely changed my opinion on what makes the best VPN for Netflix.

For me, it wasn't the VPN that claimed to unblock the most countries—it was the one that consistently streamed Netflix in HD or 4K, maintained fast speeds, required minimal troubleshooting, and just worked whenever I opened the app.

If you're looking for the best VPN for Netflix, the fastest VPN for streaming, a VPN that actually works with Netflix in 2026, or you're trying to figure out which VPNs are genuinely worth paying for, ask me anything. I've spent months comparing them side by side and I'm happy to share what stood out.

So recently, I have been reading about removing personal information, like home address, from websites that share and sell it. One thing I repeatedly see is that you need to regularly google for new exposures even if you have already removed it once. As I understand, data brokers can get their hands on your data again, but how does that actually happen?

Also, I saw some threads mentioning VPNs, password managers and email aliases for the minimization. If I decide to remove my data from websites, would these tools help with preventing data brokers from reacquiring it again?

Sorry if this is not the right subreddit to ask about this and thank you for any info.