01. Data minimization
The simplest privacy improvement is often to disclose less. Review profile fields, app permissions, public posts, and optional data requests. If a service does not need a detail to provide its function, consider withholding it.
02. Separate contexts
Separate browser profiles and distinct accounts can reduce accidental cross-linking between activities. However, reused usernames, profile photographs, writing patterns, payment details, and personal disclosures can reconnect otherwise separate contexts.
03. Cookies and identifiers
Cookies and similar storage can help websites maintain sessions, but they can also support tracking. Review browser privacy controls and understand that clearing cookies does not erase server-side records or account-linked activity.
04. Metadata matters
Metadata can reveal timing, device characteristics, relationships, and usage patterns even when message contents are encrypted. Consider what information is exposed by file properties, photographs, and communication patterns.
05. A sustainable routine
Use a password manager, enable multi-factor authentication where appropriate, update devices, review permissions, and periodically close accounts you no longer need. Privacy is best treated as an ongoing practice rather than a one-time setting.
06. Data minimization is more reliable than secrecy alone
Privacy improves when fewer parties receive personal data in the first place. Review app permissions, browser site permissions, account profile fields, advertising settings, and connected services. Disable access that is not needed for the service’s core function. Avoid uploading contact lists or location history unless there is a clear benefit and a reason to trust the recipient.
07. Separate identity, device, and network controls
Network tools address only one part of privacy. A tracker may recognize a logged-in account even when the network route changes. A browser may expose a distinctive combination of language, screen, extensions, and behavior. A compromised device can reveal data before encryption or after decryption. Effective privacy therefore combines account hygiene, browser configuration, endpoint security, and careful disclosure.
08. A practical monthly review
- Check which apps have location, microphone, camera, contacts, and file access.
- Remove unused accounts and revoke old third-party app permissions.
- Use a password manager and unique passwords; enable multifactor authentication where supported.
- Review recovery email addresses and phone numbers, since they can link otherwise separate accounts.
- Check whether cloud backups contain sensitive files and whether their access controls are appropriate.
09. Privacy claims need context
Terms such as “anonymous,” “private,” and “zero knowledge” are often used without a precise threat model. Ask what data is collected, for how long, who can access it, whether it is shared, and what independent evidence supports the claim. A privacy policy is a statement by the provider, not proof that its systems behave as described.
Primary reading: Electronic Frontier Foundation: Privacy and NIST Privacy Framework. Last substantive review: 11 November 2026.