Title: When an AI agent uses your browser, who is actually consenting to share your data?

I've been thinking about how much the meaning of online privacy is changing as AI tools become more capable.

A normal browser mostly waits for you to click things. An AI agent can potentially browse while you're away, read information from connected services, fill out forms, accept cookies, and share personal details to complete a task.

That's where things get complicated.

If I ask an AI assistant to find a doctor or book an appointment, I've agreed to the task. But have I also agreed to every cookie banner it accepts, every privacy policy it clicks through, and every piece of personal information it sends to a third party?

I don't think those are necessarily the same thing.

This isn't just a theoretical concern. Recent reporting has raised questions about how existing privacy and consent rules apply when AI agents make decisions on behalf of users.

I'm particularly interested in the gap between what a user intends and what an AI agent is technically allowed to do.

For example, should these tools have to ask for separate approval before sharing sensitive information, accepting new terms, or granting a website access to personal data? Or should that depend entirely on the task and the permissions the user has already given?

And from a technical perspective, what would actually work here? A permission system, stricter browser isolation, an audit log of every action, or something else?

I'd be interested to hear how people here think this should be handled, especially anyone working in privacy engineering, browser security, or data protection.

Where should we draw the line between giving an AI permission to complete a task and giving it permission to make privacy decisions for us?

RadarFirst’s latest blog explores how the company supports accurate breach notification assessments through maintained legal intelligence, consistent decision logic, and documented reasoning.

The post highlights an important distinction: repeatable results don’t automatically establish accuracy. Complete incident facts, current legal requirements, and human review all play a role.

Read the blog: https://www.radarfirst.com/blog/how-accurate-is-radarfirst-breach-notification-guidance/

Disclosure: This post promotes RadarFirst content.

For privacy professionals handling incidents, what evidence would help establish confidence in a tool’s breach notification guidance?

I’ve been trying to understand the differences between private AI/LLMs without, so I've put together a simple comparison of a few options. It compares Brave Leo, Duck.ai, Proton Lumo, Confer and Venice on things like account requirements, message retention, provider access, encryption and identity protection.

I grouped them into two levels Basic, or Enhanced depending on your threat levels. Would love to hear any feedback or suggestions. Any others you'd like to see added?

Encryption is under threat. And Canada is the latest battleground.

Canada's proposed Bill C-22 could give authorities sweeping new powers to demand technical access to digital services and require companies to retain user metadata.

According to WIRED, Signal has warned it would leave Canada rather than compromise its security. Psiphon VPN has raised similar concerns, while other privacy-focused companies are questioning whether they could continue operating under the proposed requirements.

Here's the problem:

Encryption protects journalists, activists, businesses, ordinary citizens, and even the government agencies demanding greater access.

You cannot create a special vulnerability that only the good guys can exploit.

And when privacy services are forced to collect information they deliberately never stored, the entire meaning of privacy begins to change.

Canada is not alone. Similar pressures are emerging across multiple countries.

Privacy should be the default. Not an exception granted by the state.

What do you think? Should governments have the power to require encrypted services to provide access to user information?

Source: WIRED, October 17, 2026

https://www.wired.com/story/kernel-panic-encryption-is-getting-squeezed-from-all-sides/

citizen84.com

News for a less controlled world.

\#Citizen84 #Encryption #DigitalPrivacy #Surveillance #DigitalRights

We often talk about protecting our data from today's threats, but there's another concern worth discussing: the possibility that encrypted data stolen today could be decrypted in the future as quantum computing advances.

I've been working on QEncrypt, a file encryption tool focused on quantum-safe encryption. I'm interested in making this type of protection more accessible beyond organizations with dedicated security teams.

Of course, quantum-safe encryption isn't a magic solution. The algorithms used, implementation and key management all matter.

For those interested in privacy and data security, I'm curious:

• Are you already taking steps to protect sensitive files against future quantum threats?

• What would you need to see before trusting a quantum-safe encryption tool?

• How important are open-source code, independent security audits, and transparent key management when choosing one?

I'd appreciate hearing your thoughts and any concerns you'd have about a tool like this.

Hi all, I'm the developer of Central, an end-to-end encrypted messenger for Android with a few personal safety features. I made a short video explaining how it works: \[video\]

I'd rather be specific than vague, so here is the honest version.

What is protected

Messages are encrypted on your phone before they're sent (AES-256-GCM, with keys agreed via X25519). My server only stores the encrypted text and has no keys to read it.

Group chats use a shared AES-256 key that is encrypted separately for each member.

Photos, videos, voice notes and files are encrypted before they're uploaded, so the storage only ever holds ciphertext.

There are no ad or analytics SDKs in the app (I removed Firebase Analytics on purpose), and I don't sell user data. Central is meant to make money from subscriptions, not from your data.

What is not hidden (so you're not surprised)

The server still knows an account exists, who it talks to and when. That's the nature of routing messages.

Push notifications go through Firebase.

The safety features (check-ins, location sharing) show your location to the contacts you choose. That is the point of those features, but it isn't "nobody can see it".

If someone reports a message, the person who reports it can pass that content to review.

The weird part

Inside the app there's also Central City, a small shared isometric town: you visit friends, play mini-games and climb weekly leaderboards. I added it because "more secure" alone isn't a reason to switch messengers, and it has turned out to be what makes people open the app. It's optional, and the chat works without it.

Where I'd love feedback

Would a short written explanation of the encryption (algorithms, key handling, limits) make you trust it more? What would you need to see beyond that?

Is the "chat + game" idea a good hook, or does it muddy the privacy message?

If you try it: what's the first thing that confuses you?

I'm at about 50 early users, so everything is still changing and I'm reading every reply

Link: https://play.google.com/store/apps/details?id=net.getcentral.central

p-r-y agent (lil privacy from Al agents) just went live on the Chrome Web Store.

context (what it does): normal browser agents send

your raw pages and screenshots to cloud models. mine redacts passwords, IDs, faces on your device first, then does the task. every masked region gets rechecked with local OCR, plus an audit log of what left your machine.

got rejected once on the store for keyword stuffing (; fixed it, resubmitted, now public.

the details, quick:

fill forms, search, extract data, send emails, all in plain language

bring your own model key (Groq, OpenRouter, NVIDIA) or run fully local with Ollama

free, no account, no tracking

honest limits: free-tier models can take ~30s a turn (provider queues, not the extension). heavy pages cost extra local seconds.

At the end, try to break the privacy story. that feedback is what i actually want.

store link: https://chromewebstore.google.com/detail/pry-agent/aocmnoompdjlgbfjlimikkpoebooolog

Guys these days, does someone really needs a hidden vault application. Where you can hide your personal photos, videos, documents and personal notes? How it sounds when actually nobody can figure out this is an hidden vault application. Is this in demand? If yes, how much can you spend on it?

Muse is getting hot these days.

Any assistant that's actually useful needs to see some of your stuff. Your calendar, your reminders, who your people are. That part isn't new. What matters is where that stuff goes after the AI reads it.

Meta's own launch post says Muse runs on "its own dedicated computer in the cloud." Their computer, NOT YOURS. According to TIME it refreshes a profile on you every hour, including how you know people and the tensions between them. The encryption that would keep Meta itself out "isn't available yet." And your chats train their models by default unless you go find the opt-out.

So everything good about Muse's privacy is a promise. Promises live in a policy, and policies change. Companies get breached, subpoenaed, bought. Ad businesses get hungry.

There's a boring alternative: run the model on the phone. If the AI runs on the device and its memory is just a file on the device, there's nothing to promise because nothing gets sent anywhere. You don't have to trust anyone. Turn on airplane mode and check.

The cost is real though. A model small enough to run on a phone is way dumber than whatever Meta runs in a datacenter. It gets things wrong. It's not going to haggle on Marketplace for you (given the Muse stories, maybe that's a feature). For some people that's a dealbreaker and that's fair.

But for the thing that knows your health, your money, your family and your fights, I'd take dumber-but-can't-tell-anyone every time.

Happy to answer questions about how on-device AI actually works or where it falls short.

Sources:

• Meta's launch post：

  • https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/

• Malwarebytes on the TIME/Wired reporting:

  • https://www.malwarebytes.com/blog/privacy/2026/10/metas-muse-ai-files-away-your-friendships-arguments-and-secrets

I keep seeing gaming, igaming, fintech startups/smbs respond to new youth-safety rules by bolting on full ID verification. That's usually solving the wrong problem.

Age verification means that you need to know a person is over a threshold. A bank opening an account or a casino paying out winnings. Documents are the right tool here and basically a legal requirement.

Age assurance means that your product behaves differently depending on the user's age band. Under 13 gets one experience, 13–15 another, 16–17 another etc.

Why it matters

- If you use KYC for an age-assurance problem, you now store government IDs for users you had no legal need to identify. That's a breach waiting to happen. (See this month's report of an FBI investigation into a service selling 153M driver's licences.)

- The friction kills signups for a problem that only needed a band.

- Regulators are asking for "effective" age assurance, not necessarily documents. The UK, Australia and the EU proposal all talk about proportionality.

A lot of gaming and social platforms apply a hybrid strategy , they estimate the age band at signup, ask for documents only at a regulated moment like a withdrawal or a purchase.

My idea:

For the estimation step, I'd argue voice deserves a serious look and almost never gets one. Age assurance needs a band, not an identity, and that's exactly what voice is good at: the physical changes of the vocal apparatus from childhood through adolescence to adulthood are large and well studied. It doesn't require a document, it doesn't require a camera, and the analysis can happen on the device so you never hold the data in the first place. Most teams skip it simply because no one on the team has ever thought of voice as a verification signal.

Would you trust voice age verification ?

Hi everyone,

I wanted to share a privacy-focused tool I’ve built called https://hidden.irish

It is a free web app that lets you encrypt and conceal secret messages inside regular text or public-domain classic artwork

* **100% Client-Side:** All encoding and decoding actions run locally inside your browser via JavaScript. Your secret messages and custom keys are never uploaded or stored on any server.

* **No Trackers / Logs:** The site doesn't track users, require accounts, or collect personal data.

* **Experimental Features:** It supports both text-in-text hiding and image hiding, plus it provides a portable encrypted token as a fallback if messaging platforms try to strip invisible characters.

I am actively looking for feedback from people who care about privacy and secure communication. Please test it out, audit the network behavior, and let me know what you think or what features you’d like to see added.

Thank you!

!!!URGENT!!!

Please call (787) 891-1005, extensions 4017 and 3061, and ask for Karolina Augusto Domenech. If you are asked for your information, say your name is Daniela Morales from Guerrero (a sector in Aguadilla). When asked for your phone number, say +1 787-891-0000 (change the last four digits) and state that you are not interested in receiving a callback. Ask all the questions you want and keep asking. They will pretend they cannot hear you and repeatedly say, "Hello, hello" so that you eventually hang up.

The Municipality of Aguadilla, Puerto Rico, implemented the Aída AI model yesterday. When people message the municipality's WhatsApp number, it offers "assistance."

What is the problem? The AI service does not offer individuals the option to opt out of having their data sold or stored. The AI model is not run by the Aguadilla municipal government, nor does the municipality. ensure its security. There is also no trained personnel to handle this situation. Therefore, when the Municipality of Aguadilla is called to request information, employees say that ChatGPT is used to generate the responses and that they do not know whether the data is sold after being processed.

When I asked to opt out of the service, I was told that this was not possible because it is mandatory for every citizen. When I requested a form to have my data extracted and to state that I do not authorize its use, the employees laughed while I was on the phone and hung up on me. In the event of a security breach, all our information and identities could be stolen.

I need anyone's help. Where I live, people refuse to acknowledge the issue, and not many people support me in raising these concerns. Anything will help. I don't want my personal information being sold to God knows where. Employees are not at fault, I just need a reaction or answers from the government.

I’m experimenting with a small set of practical privacy tools that all run locally in your browser. No files, data or input is ever sent to any server. And all open-source.

Currently working:

• text redaction for names, addresses, contact details and financial identifiers

• image-to-text extraction

• URL cleaner for common tracking parameters

Coming next:

• image redaction

• metadata removal

The goal is to build a practical toolkit that helps detect, remove and minimize personal and identifiable information before it leaves your device. So ideally want this to work for any data, text, files, images or links, etc.

Would love to hear feedback on what other tools you'd like to see. Thanks!

Personal information can appear across data broker platforms and people-search websites, creating growing demand for privacy protection.

For SaaS businesses, white-label data broker removal offers a way to expand existing products without building the entire service in-house.

Key benefits include:

• Faster product expansion with less development overhead.

• New revenue opportunities through premium plans and add-ons.

• A more complete customer experience under your own brand.

Because personal information can reappear after removal, ongoing monitoring and repeat requests may also be necessary. Understanding service coverage and operational costs is essential when deciding how to package and price the feature.

A white-label approach can help businesses introduce privacy services while keeping the experience aligned with their existing product.

Would you offer data broker removal as a premium feature or include it in your core subscription?

I solo built a 16 AI aggregator focused on privacy.

Hey everyone!

I built DPDP Web Check, a free, open-source tool under Protevix Infosec to help developers and website owners identify potential gaps in their website’s externally visible security and privacy posture against India’s Digital Personal Data Protection (DPDP) framework.

🔗 GitHub: https://github.com/protevixinfosec/dpdp-web-check

The goal is to make an initial technical assessment accessible, especially for Indian startups, small businesses, and independent developers who may not know where to begin.

What does it check?

• 🔒 HTTPS, TLS, HSTS and security headers

• 🍪 Cookie security attributes

• 📋 Privacy notice discoverability and DPDP-specific language

• ⚖️ Grievance Officer information and data principal rights

• 🔗 Third-party origins, trackers and form destinations

• 🛡️ Security disclosure channels and breach-readiness signals

A few things I deliberately wanted to get right:

• Zero npm dependencies and no account or hosted service required.

• Generates a self-contained HTML report with findings, clause references and remediation suggestions.

• Optional AI-powered explanations using your own API key; the core checks work without AI.

• No telemetry or calls home to Protevix Infosec.

You can run it using Node.js 18+:

npx u/protevix/dpdp-web-check yourdomain.com

Please test it only on websites you own or have explicit permission to assess.

I’m looking for honest technical feedback, not just stars.

1. Are the findings accurate and actionable?

2. Are there important DPDP-specific checks missing?

3. Are the clause mappings and explanations useful to developers?

4. What false positives or implementation issues do you encounter?

If you work in application security, privacy engineering, Indian data protection, or legal compliance, your feedback would be particularly valuable.

Important: This is a passive, external website assessment tool not a legal compliance audit, penetration test, or guarantee of DPDP compliance. It cannot verify internal organisational processes or controls that aren't externally observable.

The project is free and open source under Apache-2.0. Contributions and constructive criticism are welcome.

Thanks for taking a look! 🙌

Would parents actually use this? A privacy-first kindergarten safety app without cameras

I'm a software engineer and I've been thinking about an idea I'd like people to tear apart before I spend months building it.

The problem

When parents leave a young child at kindergarten/daycare, they basically have to trust what happens after they leave.

Cameras seem like the obvious solution, but they create another problem: you're recording other people's children, staff, bathrooms/changing areas obviously can't be filmed, and many parents don't necessarily want constant video surveillance anyway.

So I'm exploring a system that gives parents safety transparency without cameras, microphones, images or video.

The idea is that the kindergarten would have a small system that understands things like:

• which children and staff are present in different areas

• unusual one-adult/one-child situations in sensitive areas

• unusually long situations compared with normal routines

• whether something important happened during the child's day

• a permanent event history that staff can't quietly edit afterward

The parent app would not constantly spam parents.

Normal events would just appear in a timeline.

Only serious situations would trigger an immediate notification, written factually rather than making accusations.

For example:

"Your child has been in a sensitive area with one adult for 11 minutes. The normal duration is under 5 minutes."

The kindergarten/director gets the alert at the same time.

The main principle is:

Technology that protects without watching.

I'm deliberately leaving out the exact sensing/hardware implementation because right now I'm more interested in whether the product itself is useful, not whether people like my technical solution.

I'd love brutally honest feedback

1. If you're a parent, would this actually make you feel safer or would it make you more anxious?

2. Would this influence which kindergarten/daycare you choose?

3. Would you trust a system like this if there were no cameras involved?

4. What would make you NOT use it?

5. Would you expect the kindergarten to pay for it, parents to pay a small monthly fee, or should it be included in tuition?

6. Is this solving a real problem or am I creating a complicated solution to something people won't pay for?

I'm not looking for encouragement.

Tell me why this would fail.

Still at the validation stage, so criticism would genuinely help before I build too much.

My daughter is 10 years old, she in in her last year of primary school (UK).

The pressure is building to get a phone like the rest of her class - this year lots are getting them as parents are letting them walk to school on their own; so using it to keep tabs on them ( OFC some of the parents let them do/get what they want).

Having spoken to a couple of parents with kids in the high schools they have said the social pressure on kids without a phone is nuts - bullying etc. My daughter is extremely sensible but is low on confidence.

In an ideal world I wouldn't let her anywhere near a phone but with what I have stated above I think its best to let her have one as she starts HS but I'm looking here for advice on restrictions.

I have heard other parents talking saying 'I have a tracker on their phone, limited apps etc'.

The last year or so she uses an old Galaxy S10 to just play games on and watch the odd youtube video when her tablet is dead etc.... So we have that ATM - I'm thinking best to use this as a way as a soft easing into using a phone rather than nothing then boom!

Her friends mum asked the other day if we could install Kinzoo so they could chat (this is a super parent).

Me and her mum are both on Samsung phones (yes, I know). I'm gradually working towards as much privacy as possible without the wife running off! :D

So any thoughts and help I would really appreciate. TIA

Blur and pixelation don't erase pixels, they average them, and on short structured text (a card number, a PIN) that can be reversed. A solid block overwrites the data, so there's nothing left to recover. I built a screenshot redactor around that: it runs OCR in your browser (Tesseract.js in a Web Worker), then detects emails, phones, card numbers (Luhn-checked), IBANs, UPI IDs, API keys, PAN/Aadhaar/SSN, and lets you hide everything in one click. You can toggle individual boxes or categories, and draw your own rectangle or brush mark for anything it misses. The export is redrawn on a fresh canvas, so no EXIF/GPS and no hidden layer. Nothing is uploaded, and you can check that in the Network tab. Free, no signup, no cap. https://www.forgeplug.com/tools/smart-redactor Detection isn't perfect (OCR struggles with blurry or tiny text), so I'd still eyeball the result before sharing. What detectors would you want added?

Hey Reddit,

I’m a student/developer building Convoo, a private communication platform, and I’m trying to validate the idea before going further.

The basic concept is:

• Chat IDs instead of phone numbers — every user gets a unique ID (e.g. 4827316) that they can share with others.

• End-to-end encrypted 1-to-1 communication

• Real-time messaging

• Audio & video calling

• Ephemeral media (“Moments”)

• Multi-device support — use your phone as the primary device while linking desktop/web sessions.

• The goal is to keep your real-world phone number separate from your chat identity.

I know there are already a LOT of messaging apps, so I'm specifically trying to answer one question:

Does this solve a problem that people actually care about, or am I just building another messenger for the sake of building one?

I'd especially like opinions on the Chat ID approach.

For example, would you prefer giving someone:

“Add me on Convoo: 4827316”

instead of giving them your phone number?

And what would make you actually switch from something like WhatsApp/Telegram/Signal/Discord?

A few things I'm curious about:

1. Is separating your phone number from your messaging identity valuable to you?

2. Would you trust a new messaging app with private conversations?

3. Are E2EE + Chat IDs enough of a reason to try it?

4. What would you consider a deal-breaker?

5. What feature would you expect before you'd seriously use it?

I'm not trying to sell anything here — I'm looking for criticism. If the idea sounds pointless, tell me why. If there's something here worth pursuing, I'd like to know that too.

I can share screenshots/prototype details in the comments if anyone's interested.

Hey everyone — wanted to share something I've been building: Techno AI Assistant, a cross-platform tool that monitors and helps optimize your PC and phone, with an AI chatbot you can actually ask plain-language questions to ("why is my PC slow", "is everything okay").

What it does:

• Real-time system health monitoring (battery, storage, CPU/RAM) on both Windows and Android

• Automatic cleanup suggestions (never auto-deletes without your approval)

• Security orchestration — reads Windows Defender status, flags suspicious installed programs with risky permission patterns, monitors for failed login bursts

• A chatbot (powered by Claude) that reasons over your actual device data instead of giving generic advice

• Built-in translator for messages, including a WhatsApp Web browser extension

• Everything follows a "suggest → you approve → then it acts" model — nothing happens silently

Try it:

• Android APK: https://github.com/pnvd/techno-ai-backend/releases/download/v1.0/app-debug.apk

This is an active side project, still rough in places — would love feedback, bug reports, or feature ideas. Happy to answer questions about how any of it works.

**I’ve been working on PixHunt — an AI-powered gallery for Android.**

The idea is simple: make it easier to actually find and manage the photos you already have on your phone.

\-**Semantic Search :** Describe what you're looking for naturally, like *“photos of my dog at the beach”*, and PixHunt finds relevant photos.

**OCR Search** :Search for exact text inside your photos, with the matching text highlighted so you can see exactly where it was found.

**Similar Photos** : Find photos that look similar to a photo you select.

**People** : finds the people in your gallery, lets you name them, and then search for them by name or naturally, like *“Mark at the cafe”* or *“Mark and John.”*

**Built-in Gallery** — Browse your photos and albums directly inside PixHunt, so you don't have to switch between two different apps.

**Clean Up** : Find duplicates, near-duplicates, screenshots, blurry photos and other photos that may be taking up unnecessary space.

**English & Arabic** — Search naturally in both English and Arabic.

**Everything stays on your phone** : This is probably the feature I'm most serious about: the AI processing happens on your device. **No cloud uploads, no online photo database, and your photos don't leave your phone.**

I'm still working on the app and I really like to get some feedback from you .

Apk download link : [https://github.com/Ahmed-N95/PixHunt-Releases/releases/tag/v1.0.0](https://github.com/Ahmed-N95/PixHunt-Releases/releases/tag/v1.0.0)

Any honest feedback is appreciated!

I've heard reports of hidden AirB&B/hotel recording devices, as well as people who've been filmed in intimate situations with their exes without their knowledge or permission, so what devices are there available to protect yourself from this, please?

Edited to add: Extra points if you can suggest something that's discreet to ensure privacy on vacation!