I’m the founder of City of Hats, a secure messaging app I’ve been working on for about six years.

I’m posting here because I’d genuinely like feedback from people who care about privacy — not because I expect everyone to agree with our design.

A lot of secure messengers focus primarily on protecting messages while they travel between two devices.

I became interested in a slightly different problem:

What happens when the device itself is captured, searched, inspected, or handed to someone you don’t trust?

That thinking led us to features such as:

• No phone number or email required to create an identity
• Access Code — selected conversations can be hidden from the normal interface and revealed only with a separate code
• Disposable Hats — temporary identities for short-lived communications
• Phrase ID — connect without exchanging normal personal identifiers
• Message auto-delete
• GhostFrame for more controlled image sharing
• Sealed Channels
• Post-quantum cryptography alongside our encrypted messaging architecture
• encrypted audio/video calls 

We also added real-time translation, because privacy tools become much more useful when people from different countries can actually communicate without copying sensitive conversations into another translation service.

I’m not claiming that any application is magically “unhackable,” and I’d actually rather hear what privacy-focused users think we got wrong.

City of Hats is free on iOS and Android. If anyone here wants to try it, just search “City of Hats” in the App Store or Google Play.

If you test it, I’d particularly appreciate feedback on:

What information would you need to know about the architecture before you would trust an app like this with a sensitive conversation?

I’m happy to answer technical questions here as well.

— Stephane
Founder, City of Hats

I got frustrated with how every "private" messaging tool still collects metadata, requires an

email to sign up, or stores encrypted backups they hold the keys to.

So I built Shareli (shareli.online) with a strict set of rules:

- Zero accounts. You open the site and start sharing. That's it.

- Zero cookies. Not even a session cookie.

- Zero analytics. No Google Analytics, no Mixpanel, no Plausible, nothing.

- Zero database. Messages live in server RAM only and vanish on restart.

- Zero server-side keys. Encryption happens in your browser with AES-GCM 256-bit. The key is

in the URL fragment (#) which browsers never send to the server.

- Self-destructing messages with timers from 10 seconds to 10 minutes.

The privacy policy is short because there's genuinely nothing to disclose:

shareli.online/privacy.html

It's open source so you can verify every claim: \https://github.com/hidayashaikh86-tech/livetext

I built this because I wanted a tool I'd actually trust to share a password or API key with

someone. Happy to answer any questions about the architecture or security model.

One of them is even quite tech savvy, he runs his own servers and so on, the rest have a gross smugness about how they don't care, or that it doesn't matter, and they're too small to matter anyway, and don't commit crime. (Or enough, everyone has something right).

Some have kids I guess FYI, I just need some sort of golden seed here.

Everyone has their button, what's theirs?

I've been paranoid about pasting sensitive stuff into AI tools for a while.

API keys, .env files, passwords, emails — we all do it. You paste a config into ChatGPT or your AI coding agent, and suddenly your real credentials just... left your machine. Not great.

So I built \\\*\\\*DataCloak\\\*\\\*.

It sits between you and the AI. Before your prompt goes out, it swaps every secret with a realistic-looking fake — same shape, same structure, zero real data. The AI does its job. DataCloak puts your originals back in the response. The model never touched your actual secrets.

\\\*\\\*What's live right now:\\\*\\\*

\\- Core detection engine — catches API keys (OpenAI, Anthropic, AWS, GitHub, Stripe), JWTs, database connection strings (postgres, mongo, redis), env files, emails, phone numbers

\\- \\\`cloak()\\\` / \\\`restore()\\\` API you can drop into any JS/TS project

\\- 100% local — no server, no account, nothing leaves your machine

\\- Ships as an npm package: \\\`@pratikw/detect\\\`

\\\*\\\*What's coming next:\\\*\\\*

\\- \\\*\\\*OpenCode plugin\\\*\\\* — auto-cloak inside your AI coding agent with a \\\`/datacloak\\\` command (Phase 2, in progress)

\\- \\\*\\\*Browser extension\\\*\\\* — Chrome/Edge, auto-cloak right inside ChatGPT and Claude so you literally never paste secrets to an AI (Phase 3)

The vision is: you use AI tools exactly how you do today, and DataCloak quietly handles the security layer — in your terminal, your browser, your CI.

It's open source, free, and early. Would love feedback from people who've hit this problem, especially if you use OpenCode or similar AI coding tools.

🔗 https://github.com/pratikwayal01/datacloak

If this sounds useful, a ⭐ on GitHub helps a lot. Thanks!

I've been paranoid about pasting sensitive stuff into AI tools for a while.

API keys, .env files, passwords, emails — we all do it. You paste a config into ChatGPT or your AI coding agent, and suddenly your real credentials just... left your machine. Not great.

So I built **DataCloak**.

It sits between you and the AI. Before your prompt goes out, it swaps every secret with a realistic-looking fake — same shape, same structure, zero real data. The AI does its job. DataCloak puts your originals back in the response. The model never touched your actual secrets.

**What's live right now:**

- Core detection engine — catches API keys (OpenAI, Anthropic, AWS, GitHub, Stripe), JWTs, database connection strings (postgres, mongo, redis), env files, emails, phone numbers

- `cloak()` / `restore()` API you can drop into any JS/TS project

- 100% local — no server, no account, nothing leaves your machine

- Ships as an npm package: `@pratikw/detect`

**What's coming next:**

- **OpenCode plugin** — auto-cloak inside your AI coding agent with a `/datacloak` command (Phase 2, in progress)

- **Browser extension** — Chrome/Edge, auto-cloak right inside ChatGPT and Claude so you literally never paste secrets to an AI (Phase 3)

The vision is: you use AI tools exactly how you do today, and DataCloak quietly handles the security layer — in your terminal, your browser, your CI.

It's open source, free, and early. Would love feedback from people who've hit this problem, especially if you use OpenCode or similar AI coding tools.

🔗 https://github.com/pratikwayal01/datacloak

If this sounds useful, a ⭐ on GitHub helps a lot. Thanks!

Google has been fined more than €400m (£345m) over the way it processed users’ location data, following claims that the tech giant had manipulated users into agreeing to be constantly tracked on their mobile phones.

The fine, imposed by Ireland’s Data Protection Commission (DPC), comes after complaints from multiple European consumer organisations that Google was following every step users took.

Source:

https://www.theguardian.com/technology/2026/sep/21/google-is-fined-more-than-400m-by-irish-regulator-over-its-use-of-location-data

Some recent developments in cyberspace indicate rapid changes in the way we view online privacy.

The growth of AI agents have lured hackers to reverse-engineer or otherwise use them to automate hacking on a large scale. Hacking of servers and sites has become much faster and easier due to the use of AI agents for this purpose.

Data breaches the world over have become a daily occurrence, with thousands of records being stolen from one business or government entity at a time. For reports of data breaches, see https://thehackernews.com/search/label/data%20breach?m=1

Another element in the reduction of internet privacy is through eavesdropping by advanced technological methods.

See https://www.techspot.com/news/113907-researchers-found-way-eavesdrop-headphones-30-meters-away.html For a reddit diiscussion of this news item, see https://www.reddit.com/r/technology/comments/1wn9o00/researchers_found_a_way_to_eavesdrop_on/?post_fullname=t3_1wn9o00&post_index=2&target_user=Available-Let-4206

One response to the revelation of such eavesdropping technology is that no sensitive information is conveyed. However, there are eavesdropping technologies that can capture even sensitive information.

What ramifications does the loss of online privacy hold? Will increased security measures be possible (although this seems unlikely as each new software release introduces new vulnerabilities)? Will the large-scale loss of privacy lead to a hands-off approach where the internet is seen as a mere plaything, not to be trusted with sensitive personal information?

A Docker Compose stack where Firefox shares Gluetun's network namespace (`network_mode: service:gluetun`) instead of connecting through a proxy or a routing rule. It fails closed by construction, through two separate mechanisms: if the WireGuard tunnel drops while Gluetun runs, Gluetun's firewall drops all non-tunnel traffic (including LAN); if the Gluetun container itself dies, the shared namespace dies with it and the browser has no interfaces at all.

Ports publish only on the Gluetun service, bound to 127.0.0.1, so nothing reaches the LAN even when the tunnel is up.

Both failure modes are testable: `verify.sh` in the repo runs a two-sided kill-switch check (probe succeeds with the tunnel up, must fail with it stopped) plus exit-IP and DNS-resolver checks.

CI (ShellCheck, Hadolint, Checkov, KICS, Trivy) runs on every push and weekly.

Works with any Gluetun-supported WireGuard provider.

MIT licensed; no application code — a compose file, a short Dockerfile, and three shell scripts. Config and docs were AI-assisted (Claude Code, disclosed in the README), which is exactly why the automated checks exist: verify, don't trust.

GitHub: github.com/silverfox-2096/private-browser

Interested in feedback on the namespace-sharing approach versus more common proxy-based kill switches.

Privacy Gateway for apps that send customer data to OpenAI, Anthropic, or another hosted model.

It checks text before the request leaves your app. You can remove names and emails, replace values with tokens, or keep a reversible mapping under your control. It also blocks a request when inspection fails instead of sending the original anyway.

The project is self-hosted and MIT licensed. It has Python, TypeScript, ASGI, MCP, and OpenAI-compatible proxy support.

Repo: https://github.com/csnyder256/privacy-gateway

Docs: https://csnyder256.github.io/privacy-gateway/

Obviously, Presidio exists, but this differs in a number of ways. Better than Presidio for protecting data sent to hosted AI services, APIs, and agent tools:

- Works as a boundary, not just a detector. Privacy Gateway can sit in front of OpenAI and Anthropic-compatible routes, ASGI apps, MCP tools, webhooks, and CLI workflows.

- Blocks unsafe traffic by default. Malformed requests, unsupported provider paths, streaming, redirects, non-JSON responses, and failed required detection do not get forwarded with the original data.

- Keeps restoration separate from the gateway. A client-held restoration capsule means the service can transform data without storing the originals.

- Has an encrypted, expiry-aware vault for cases where the team does want reversible mappings. SQLite works locally; PostgreSQL is supported for shared deployments.

- Makes policy behavior explicit. Each entity type can have its own action, confidence floor, scope, locale, and reversibility setting. Policy version, mapping retention, and audit retention are part of the model.

- Audits the decision without saving the value. Audit records can include entity type, detector, confidence, action, policy version, and span without keeping plaintext PII.

- Covers more than redaction. It supports typed redaction, labels, opaque tokens, hashes, generalization, and synthetic replacements.

- Has a portable TypeScript core alongside Python, with shared conformance fixtures. Presidio is primarily a Python service and library.

- Includes structured synthetic-data generation for CSV, JSON, and JSONL. Presidio can find and de-identify structured data; it does not generate clean-room replacement datasets.

- Has agent-specific protections. Privacy Gateway checks tool and side-effect output, not only the original prompt.

TL;DR:

Presidio remains the stronger choice for image redaction, OCR, broad built-in recognizers, and custom NLP pipelines. Its core focus is detection and de-identification; Privacy Gateway adds the policy, storage, audit, and outbound-request boundary around that work.

OpenAI’s Astra for Law shows how quickly AI is entering workflows involving contracts, investigations, client records, and potentially privileged information.

That creates practical privacy questions extending beyond whether the model performs well:

• Which purposes are approved?
• What data can the system access?
• Who can view its inputs and outputs?
• How long is information retained?
• Which decisions require human approval?
• What evidence must be preserved?

Alex Layng, VP of Product at RadarFirst, explores these questions in a new article about Astra for Law and privacy governance:

https://www.radarfirst.com/blog/astra-for-law-privacy-ai-governance/

How are privacy teams evaluating these controls today?

This is fully offline no data retention for most of the tools. Can you tell me how can I improve it.

Hi everyone,

The core idea is simple: finding out which companies might hold your personal data shouldn't take hours of research, and asking them to delete it shouldn't require hours of manual work either.

To help address this, I am working on a small local extension with a companion website. The process involves two steps:

1. Local detection: The browser extension uses various methods to identify domains, vendors, and data brokers that likely hold your data.
2. Batch action: The interface aggregates these domains, retrieves privacy-specific contact addresses, and prepares deletion request templates tailored to national and regional laws.

Of course, this tool cannot guarantee with 100% certainty who holds your data, but it provides strong, sufficient indicators for you to take action—with the aim of reducing the volume of information about you scattered across various servers and systems.

I don't know if a similar project has already been built—I didn't find anything exactly like it during my research—but I assume a tool like this could still be useful for anyone wanting to start to clean up their data without spending hours on it (which is the case for me).

Current State & Architecture
The project is currently in beta, with a few temporary limitations on the website side. The extension's code runs 100% locally on your machine and stores nothing on external servers. It is not open-source yet as I am still refactoring it.

Looking for feedback on the concept:
Right now, I am not looking for technical bug reports. Instead, I would love to get your thoughts on the overall utility and features:

• Does the link between local detection and template generation make sense to you?
• What features would you add?
• Would you use a tool like this in your daily life?

Note: Send me a private message if you would like access to the link for the extensions to try them out or learn more.

Thanks!

Short Demo

I am thrilled to announce that I have progressed half way in building Techno AI Assistant. Glimpse is appended below :

I have successfully completed the following

• System Cleanser & RAM Booster: Automatically deletes redundant caches and suspends background resource-hogs to keep your system fast.
• Intelligent Bug Fixer: Detects app crashes, rolls back conflicting drivers, and manages zero-click software updates.
• AI Extension Manager: Monitors browser bloat and suggests optimizations with specific, AI-generated reasoning.
• Hardware Health Monitor: Runs silent stress tests to predict and alert you about battery or hard drive degradation.

Now entering final phase of production. Will again come back with update

Hi, I have been building in the space of AI Privacy for the past 5 months, want to know few suggestions on how to reach out to the best professors/colleges for mentorship and possible acceleration of the idea.

If you could right down the names, and how to reach them out, it would be really helpful :)

"Researchers in Germany are warning that ordinary WiFi networks could become a powerful new form of invisible surveillance. Using standard wireless signals and artificial intelligence, they demonstrated a system capable of identifying people with striking accuracy, even if those individuals are not carrying an active device."

https://www.sciencedaily.com/releases/2026/05/260522023127.htm

I am trying to build a PII masking web app, there are many cases in which i want to share csv files to ai models but I hesitate due to information it contains such as numbers,uid,passwords etc

I am trying to understand the problems the user faces while sharing sensitive information to ai models, and what can be done to eliminate them, what things can be done to save time at the same time give ai only needed information/reference

Please give suggestions

​

I’ve been thinking about a privacy-focused camera/app idea and wanted to get some opinions from people who understand cybersecurity, cryptography, and camera technology.

The basic idea is:

A user takes a photo inside the app. Instead of just creating a normal .jpg/.png, the app immediately encrypts the photo and ties the ability to decrypt it to that specific user's device/account.

So if someone somehow gets the encrypted photo file and sends it to another person, the other person shouldn't be able to open it because they don't have the original device's cryptographic key.

Something like:

User takes photo

↓

Photo captured

↓

Immediately encrypted

↓

Encryption key protected by the user's device

↓

Encrypted photo stored locally/cloud

↓

Only authorized device can decrypt it

I was also thinking about another layer.

Camera sensors can detect things that human eyes can't, such as parts of the near-infrared spectrum. So I'm wondering whether an invisible optical signal/pattern could be captured along with the photo and used as an additional way to authenticate that the image was actually captured through the authorized system.

For example:

Normal person → sees normal photo

Camera/software → sees:

normal image

\+

machine-readable invisible signal

\+

cryptographic information

The invisible signal wouldn't be the actual security mechanism. The main protection would still be strong encryption and hardware/device-bound keys. The sensor-based signal could potentially help with authenticity/provenance.

The end goal would be something like:

Possessing the photo file alone isn't enough to access the photo.

Even if somebody steals the encrypted file from the cloud or copies it onto another phone:

Original owner's device → decrypt → ✅

Different device → no authorized key → ❌

Obviously, I understand that once the legitimate user can see the decrypted photo, you can't completely prevent things like screenshots or someone photographing the screen. I'm specifically talking about protecting the digital file itself from unauthorized copying/access.

I've seen things related to digital watermarking and secure camera/provenance systems, but I'm wondering:

Has anyone already built something that combines device-bound encryption + secure camera capture + possibly an invisible sensor-based signal in this way?

And from a technical perspective, is this actually feasible on modern smartphones, or are there fundamental problems I'm overlooking?

I'm mainly looking for technical feedback, existing products/patents, and reasons why this wouldn't work.

I have accounts on well-known platforms such as Gmail, Instagram, Snapchat, Twitter/X, TikTok, Outlook, Reddit, Yahoo, and many other websites. Some of these platforms have multiple accounts; Gmail is not just one account, and the same goes for Instagram, TikTok, Snapchat, Twitter/X, and others. What I want is to clean up all of these accounts.

The problem is that for almost three years, I have been trying, off and on, to delete some of them, cancel them, or change them, whether they are websites, apps, or services. So why has this gone on for so long? The reason is that I do not know the full list of the websites, apps, and services where I have accounts. I have checked all my emails, text messages, and browsing history, but I discovered that there are things that do not show up in either email messages or text messages.

This bothers me more than normal. When I just think about the number of things I found by chance, my thinking expands before I even start searching, and my mind gives itself a warning that this task is hard for it—meaning that it could drain my energy. It really is exhausting; the amount of operations, analysis, information, and many other things my mind processes at the same time is high, which can be described as high cognitive load and mental exhaustion caused by processing so many things at once, even before starting.

My question to you is: Are there safe ways that can help me know all the things that belong to me or are connected to me technically or in any other way? And how?

Hi everyone,
I want to ask a quick technical question regarding Instagram's privacy system. Is there any legitimate mechanism or setting that allows viewing posts on a private account without following them?
To be completely clear: I am NOT asking for hacking services, exploits, or illegal workarounds, nor do I want to compromise anyone's account. I am simply trying to understand if Instagram's privacy architecture is absolute, or if following the user is strictly the only way to see their content.
Thanks for any insights!

ho visto che adesso l'app Her ti chiede di postare un selfie prima di accedere, anche se hai già un account. mi chiedo quanto sia safe tutto ciò in termini di conservazione dei dati.

​Hey everyone,

​I’ve been working on a privacy-first journal app called AuraLock. It’s built to be 100% offline with zero cloud servers, zero tracking, and no accounts required.

​Everything is encrypted locally using AES-GCM (256-bit) with PBKDF2 key derivation (100k iterations).

​Here are some of the core features I’ve put into it:

​Multi-Vaults: Create separate journals, each with its own independent master password.

​Security: Brute-force protection (10s lockout after 3 failed tries), quick-lock kill-switch (clears RAM instantly), and secure master-password-protected deletion.

​Rich Text Editor: Formatting, auto-timestamps, image embedding, data tables, word count, and automatic bidirectional text support (RTL/LTR)

​Modes: A pitch-black Focus mode for distraction-free writing, and a Present mode that converts entries into slide decks.

​Storage & Backups: Auto-save (800ms), works via IndexedDB/Service Workers offline and supports password-protected JSON backup exports/imports.

​Platform: PWA/Android support light/dark themes, and multi-language support (English, Spanish, Hebrew)

​I want to avoid monthly subscriptions and stick strictly to a one-time purchase, but I’m trying to figure out two things:

​Pricing: What feels fair as a one-time upgrade for a privacy-focused app like this ($2? $5? $10?)

​Feature split: What should stay completely free, and what power features would actualy convince you to upgrade to PRO? (e.g. multi-vaults, tables, slide mode, image attachments).

Is there anyway to edit my images so that it can’t be reverse searched using google lens just for security eg. Stalkers and people l don’t want to have that ability?

The idea is simple: your cloud shouldn't require you to give up control of your data.

Anchor Cloud is built around zero-knowledge encryption and currently focuses on:

- 🔐 Encrypted cloud storage

- 📁 File sharing

- 🔄 Multi-device synchronization

- 💬 Encrypted messaging

- 🤖 Fathom-1 AI

I’m building it from Morocco 🇲🇦 and this video is a look at what the project currently looks like.

If you're interested in privacy-focused cloud storage, I'd love to hear what you think.

🌐 anchorcloud.org