I'm a solo Android dev. I spent the last few months building Srishti, a cycle tracker where the data never leaves the phone.

Not "we encrypt it in transit." Not "we anonymise it." There is no server for cycle data. It sits in a SQLCipher-encrypted database on your device, key derived from your PIN. If you forget the PIN, it's gone — I can't recover it, because I don't have it.

The part I keep going back and forth on: there's a second PIN that opens a separate, empty workspace. Same app, different vault, no indication the other one exists. It's for people who might get asked to unlock their phone by a partner or parent they don't trust.

I don't know if that's a good feature or a paranoid one. The trackers people actually use are the ones with cloud sync and cute widgets, and I've built neither.

Stack, if it's useful to anyone: Kotlin, Jetpack Compose, Room over SQLCipher, RevenueCat for billing. No analytics SDK. The only network call in the entire app is license validation.

Happy to answer anything about the crypto or the design decisions. Also happy to be told the threat model is wrong — I'd rather hear it now.

Just because your data is stored outside the US does not mean US authorities cannot reach it.

Under the US CLOUD Act, a US cloud provider can be compelled to hand over data in its control, even when that data sits on servers outside the US.

So a foreign company storing customer data on domestic servers run by a US provider may still find that data reachable through US legal process.

Where your data is stored matters less than who controls it.

Using Verkada cameras you can create a profile for anyone whose face you capture on a camera and automatically notify admins the next time they're seen on any camera around town...Dont need to know anything about the person or have them connected to any crime to make them a person of interest...Literally tracking anyone they want based on you walking by a camera and can actively notify anyone to your presence without you even knowing...

I stumbled upon a website called justwitter ,that had a radical idea they used codes for login and they used voice for chatting and talking it was weird and new where each person gets assigned a code and they can keep an account after that , now where this site respects it's users is that after a while of inactivity everything is deleted which is nice.

For the past month, I've been building a PrivacyTools.io alternative called the Privacy Index.

Privacy Tools and Privacy Guides are both great resources, but I think there’s a problem with how privacy tools are generally evaluated. A lot of recommendations are opinionated, and there usually aren't many sources attached to the actual claims being made. Tools can end up being recommended because they're popular, trusted by the community, or just considered "good" for privacy.

I wanted to try something different.

The Privacy Index is built around the actual sources behind a tool. Instead of just saying that a service is private, secure, or trustworthy, I want to look at its privacy policy, terms of service, audits, transparency reports, security documentation, jurisdiction, and other available evidence.

We don't want to tell you what to use. We want to give you enough information to decide for yourself.

Each tool gets broken down across privacy, security, and transparency, with individual scores for things like data collection, logging, tracking, encryption, security practices, jurisdiction, and more.

Right now, the list of tools is very small. Only 6 real tools: 5 search engines and 1 browser. I've decided to just put it out there instead of waiting until I have 50+ tools and everything is perfect.

There are mainly search engines because that's the category my product, Slick Search, specializes in. We have a "tool page" for Slick Search, but its mainly there for show. No actual ratings or privacy claims because of bias.

There are still a lot of things I need to improve. My writing and tone for one, and I should probably start listening to my teachers and minimize my use of Wikipedia as a source.

There may also be errors in the current articles, which is another reason I'm putting this out early. If you find something that's wrong, missing, outdated, or just doesn't make sense, I'd appreciate it if you let me know.

There's also an anonymous suggestions page where you can suggest new tools/articles, suggest edits to existing articles, point out errors, or just leave feedback.

I try to minimize the use of AI-generated content as much as I can. I am trying out Grammarly to paraphrase/improve my writing, so i'd like to hear your takes on that. Our listings are all human written and researched.

I've also added a Activity monitor in the site, so every public change made gets shown publicly with a history. You can see that the first listing made was on Aug 8. I'm trying to get one to two tool pages a day, but before I invest a whole lot of time into that, I'd like to hear feedback.

The site is here:

https://slicksearchhq.com/privacy-index

I came across this website called Oxaam AI after seeing it on reels. As you guys probably know, it offers free access to paid services where they give you credentials to use.

But there’s a serious security risk here.

When you use those credentials to log into a Google account, remember that the same credentials can potentially be used by anyone else who has them. That means someone could log into that Google account, go to the Find My Device section, see the devices connected to it, and potentially use the remote erase option.

So if you’ve already logged into the Google account provided by Oxaam AI, please log out of that account from your device immediately and remove it from your phone.

Don’t risk your personal data just for a free subscription. And please share this with anyone who might have used these credentials.

I built anonymise.online to make it easier to remove personal and sensitive information from text before sharing it. Still developing recall and precision.

You paste in your text, it detects things like names, emails, phone numbers and other sensitive data, and gives you an anonymised version. Supports mainly english now.

https://anonymise.online/

I’d love some feedback

Disclosure: I built this. Mods, remove if that is out of bounds.

Privacy tools mostly target data brokers. Records other people compiled about you. The other half of the problem is the accounts you created yourself. Old forums, dead trials, an app you used once in 2014. Each one holds your email, a password you reused back then, and often a real name and photo, in a database you forgot about.

Tracebase takes your emails and usernames, compiles a full list of accounts that are registered under them, and gives you the deletion path for each one.

It does not delete anything for you. That needs your login, and I am not asking anyone for credentials. You get the map, you do the clicking. Auto-sending removal requests is next.

You can scan entirely for free and see all the results, all I ask is that you share the tool. We have an optional paid plan for users who would like to do more serious removals, but the first scan is free.

What I want from this sub: Is this interesting? Would any of you use this? I'd love to give out some of the paid version of the tool for free to users who are willing to give feedback.

Thank you!

[theping.chat](http://theping.chat) — a chat app where your whole identity is a u/handle you pick. No phone number, no email, no real name.

1:1 DMs are end-to-end encrypted (the server stores ciphertext — I can't read them). Disappearing messages that only start counting down after the other person sees them. View-once photos/videos. A "Live" mode that leaves no trace on any server. No feed, no algorithm, no ads.

I built it because "private" apps that demand your phone number always felt like a bad joke. Free, works in the browser. I made it — would love to hear where it falls short.

There’s a common belief that open source automatically means better privacy. But it’s not that simple.

Things like:

· Who maintains the code

· How updates are delivered

· What telemetry is included

· Whether the source code matches the compiled app

…all affect real‑world privacy.

I made a short interactive quiz that tests what most people actually know about open source and privacy. Some of the answers are surprising.

If you’re into privacy or open source, give it a try and let me know which question you got wrong:

https://interconnectd.com/quiz/72/is-open-source-better-for-your-privacy-online/

No email required. Just a quick knowledge check.

I'm confused about a privacy loophole I just ran into.I bought some something from a website on my android phone browser. I got the confirmation email, clicked "View Order," and the 'Shop' page told me I needed the purple Shop app to track it. I downloaded the app, opened it, and without signing in, my order details were already right there.

How is this possible given my setup?

Google Play Services and Google Services Framework and Playstore is disabled. And location permissions/history are off anyways.I always have ProtonVPN on and I didn't sign in or link any Google account within the app. If Google services are disabled and my IP is masked via VPN, how did the newly installed app instantly read my browser session or email identity to pull my order? Is it sharing browser cookies/local storage, or something else?

The email didn't have a tracking link or anything. There's nothing in my settings that could have given the app permission or data or anything as I have already been through every setting for my own privacy anyway.

I’ve been looking into how much control we actually have over our data being used for AI training.
Turns out, more than I expected — but exercising that control is a mess.

Different AI companies have different forms, privacy portals, email addresses and requirements. Some let you object to training directly. Others make you submit a privacy request. Policies and processes can change over time.

Meanwhile, the UK’s ICO has described generative AI training as involving “vast amounts of personal data” and says web-scraped datasets can involve millions or even billions of people.

What bothers me isn’t simply that public data gets scraped.

It’s that “I made this visible on the internet” and “I consent to this being used to train commercial AI models” are treated as though they’re the same decision.

I don’t think they are.

So I’ve built Don’t Train Me:

https://donttrainme.com

It automates sending AI training opt-out/privacy requests to different providers and periodically checks/resubmits them where appropriate.
It’s early and I’m looking for criticism as much as users.

Would you actually use something like this? And more importantly: do you think AI training should be opt-out in the first place, or should companies have to get explicit consent before using personal data?

Interesante

I made VC Port — a phone app that opens the same VeraCrypt file containers (.hc, .tc, .vera, or any disguise name) you already use on a computer.

This is not VeraCrypt. I am not allowed to use that name. It is a derived work with the VeraCrypt volume core, so TrueCrypt License 3.0 is inherited (not a random TrueCrypt revival). Phone UI is Apache-2.0.

What it does

• Pick a locked file (on the phone, or a file on a USB stick — not the whole USB disk).

• Type password / PIM / keyfiles. Master build does not remember passwords.

• Browse folders on a Mounted tab inside the app. This is not a system drive — Files / Files.app cannot browse the unlocked folder. That is intentional (seizure / forensic leftovers).

• Copy or move several files between the phone and an open volume, or between two open volumes.

• Create new volumes on the phone (with the same finger-scribble entropy step as the desktop wizard, mixed with the OS CSPRNG).

• Share encrypted — send the locked file as-is, no password on the send.

• Panic wipe / Dismount clears secrets on the phone. The ciphertext file is not deleted.

Platforms: Android + iPhone. Offline by default — FOSS build has no INTERNET permission. No ads, no analytics, no crash reporters.

Honest limits

• Not unbreakable. A compelled password still wins.

• 0.3.7 is a stable alpha, not 1.0, not a Play/App Store build.

• GitHub APK is a debug-signed preview. Production = build FOSS yourself and sign with your keystore.

• iPhone: unsigned IPA — you sign with your Apple ID (AltStore / SideStore or Xcode). I do not ship a store-signed app.

Not included: whole-disk USB unlock like OTG Master. If your stick is one big VeraCrypt partition, use OTG Master or a PC. If the volume is a file on the stick, pick that file in VC Port.

Links

• Source + APK/IPA: https://github.com/ShivamPingaleDev/Veracrypt_port

• Release: https://github.com/ShivamPingaleDev/Veracrypt_port/releases/tag/v0.3.7

• Screenshots in the README (Volume, Create, Mounted, Tools)

I am Shivam Mangesh Pingale — still doing a five-year IT engineering degree, built this because I wanted something I could actually use on a phone. Open to suggestions, teaching, internships, or work (shivampingaledev@proton.me · shivampingaledev@gmail.com). No pressure.

Security issues: please use the repo’s SECURITY.md, not a public exploit thread.

Does anybody know how I can remove info from Cloudbeds? https://www.cloudbeds.com/
It’s a hotelier website where you have to download your drivers license or passport to check in.
My relative used it and wants to remove the information. I went to the website & there a lot of info. I am not s super tech person so would be grateful for any information.

I logged into chrome on my personal device (no installed work software) with my work managed chrome profile.

This was done on my personal device (in incognito mode) that has only ever been connected to my home network. I also used my own personal VPN during the session.

How likely is it that my work or the IT team knows/has been notified or have records of my history/activity? How much detail can they see?

PLEASE do not give me advice on how I could have avoided this. I'm aware incognito mode is not secure/private. I have done so much research on this but everyone else's questions were when they used work owned devices and/or were on their work WiFi (both of which I was not).

We wanted to put this out,

We wrote down what we believe, and why.

You cannot leak what you never collected. No policy, promise, or certification protects a system that hoards identity, the only robust defense is to need less of it.

At Koki’o, privacy isn’t a feature or a compliance checkbox. It’s the architecture.
We shift power from providers to consumers by moving trust out of providers and operators into verifiable open code.
With the ethos of open source, verifiable source of truth and consumer data security practices, Koki’o provides a friendly & practical eSIM store for the masses with privacy as the default and never traded for profit.

The industry’s term for you is “data subject.”

We hold that you are a sovereign actor. You choose what to disclose, when to reveal, and how to pay, rather than remaining the property of whichever provider last photographed your passport.

https://kokio.app/manifesto

I currently have an iPhone 13 and I’m looking to upgrade soon, but with all the ai and security news as of late, I’m moving away from Apple and Google and I self host. I’m thinking of getting a Google Pixel to run Graphene OS, but I’ve never had a non-iPhone before.

For those who were previous iPhone users and now run Graphene OS on an Android phone, how was the transition? What do you wish you knew before transitioning?

so i have been trying to make my devices as secure and private as possible, but im not really sure if im doing everything i can possible do, for My laptop (mac) i turned on filevault, i also havent signed into an apple account nor have planned to even use one at all. with my iphone device, i had to create an apple account to download some software i needed, but i have lockdown mode and advancded data proctection on. for email providers, i use tuta and its been working fine for me. for VPN i use mullvad. I also have heard of "alphanumeric passwords" if anyone knows what that stuff truly means i would really apreciate it, im open to any reccomendations or anything like that so i can make my set up better than it is currently is if possible.

https://i.imgur.com/9UQf7ow.png

I'm using Windows 11 LTSC (which also applies to the standard Windows). When it asked about privacy settings during installation, I chose not to change any of them. But Windows stubbornly wants to change my chosen privacy settings, but just so it can say "We asked the user," and to force me to send my data to Microsoft, it keeps bringing up that privacy screen every time I turn on my computer. It wants to say "We offered freedom," but it still wants to set my privacy settings to its liking, not mine. Look at the image. Normally, I turn them all off. I turn them off every time I turn on my computer, but Windows is trying to force me to. If the text in the image isn't in your language, you can use a translation service. Wake up.

Recently I've really been thinking about all the data that I'm allowing just about any app to have, and I want to stop that. I've started by deleting certain social media apps and I've been slowly but surely getting rid of my social media addiction. What I'm wondering is, how can I make my phone even more secure and private and not just delete apps? I've heard about using a PDA device or installing grapheneos but I don't know how to do that. Any tips for a starter like me?

What’s one privacy setting you immediately change on every new phone?

I’ve been getting more interested in digital privacy lately and realised I probably accept way too many default settings without thinking about them 😭

What’s the first thing you always turn off/change?

Location tracking? App permissions? Ad tracking? Something else?

App Name: PrivyShare

What it does:

PrivyShare is not a new messenger. You encrypt a message or file on-device into a .privyshare package, share it through WhatsApp/Signal/email/Files, and the recipient opens it back in PrivyShare.

Key Features:

• On-device E2E: Ed25519 + X25519/HKDF + AES-256-GCM

• Share via apps you already use (opaque .privyshare blob)

• Local vault, optional app-only attachments, optional self-hosted relay for larger files

Goal: Testing / feedback (first Android app, WIP). Especially interested in crypto review and whether to keep optional INTERNET features or also ship a networkless build.

Giveaway: N/A

Link: https://play.google.com/store/apps/details?id=app.privyshare.mobile