S/P/Asecurity · privacy · autonomy — reduce your exposure one small task
at a time working title
The short version
Who are you hiding from?
This site offers a plan: small ordered tasks, reasoned and justified,
and an honest account of potential trade-offs.
BLUF
Answer the three questions below (precursor to the full
Worksheet), then
Build the Floor on the devices in front of you.
It's an hour, nothing on it costs anything, and it closes more than
everything else combined.
Consider
Who is actually after you?For nearly everyone: advertisers, data brokers, and whoever buys
the next breach. Not governments. Plan for them first, starting
with the accounts and apps you use every day. If your adversary is
a specific person, SPA-KUN is for you.
What would hurt most to lose?Usually: the email account (and everything it resets), the phone
number, the photos. Those need the strongest locks.
What are you willing to change?Keep the phone and computer you have if you're comfortable with
them; tune them. Moving your email off the ad company is one
big move that's worth it. The rest are toggles.
Fill in the Worksheet and the Floor steps that
don't apply to you fade back, and are deprioritized.
Why before what. Every task says what it closes before it says what
to click.
Every task is something you can do today, with the phone and laptop
you already have.
Nothing here asks for your data. The checklists save in your browser
and nowhere else.
Every vendor we name gets its trust cost printed next to it. Nobody
pays to be named.
Nothing we recommend requires ongoing payment to us. Where a
subscription is the right answer we say what it's for and what
happens if you stop.
Small bites are fine. Three tasks a week is a pace, not a failure.
Every term we use is defined in the
Glossary. If one isn't,
tell Support.
Exposure triage · every task, ordered by effort against payoff
The full checklist
Every item is a leak you can close. Start at the top: the first
group is mostly toggles and forms, and closes the most for the
least effort. Tick things off as you go; progress is saved in this
browser.
Prices, free-plan limits and feature claims on this page were checked October 2026. They drift; if one looks off, send a correction.
0 / 0 done
Effort — 1 is a few minutes, 3 is an afternoon or an
ongoing habit
Payoff — 3 closes a leak that feeds many others
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Effort
Payoff
Tenet scorecard · the same tasks, scored three ways
Weigh it yourself
Every task from the full checklist, plus the easy fixes it left
out, scored 0–3 against three tenets. Set the weights to match
what you care about and the list re-sorts. Items marked
added aren't on the full checklist.
Security ×1.0
Harder to attack or impersonate you.
Privacy ×1.0
Less known about you, by fewer parties.
Autonomy ×1.0
You hold the keys; no single provider can lock you out or in.
Security — 0 to 3, how much harder it makes you to attack
Privacy — how much less is known about you
Autonomy — how much less you depend on any one provider
Six jobs · where the services fit
Tools, and what they cost you
Almost no privacy tool serves a tenet directly. Each one does a job,
and every job leans on one or two tenets. Name the jobs and the
services sort themselves.
Prices, free-plan limits and feature claims on this page were checked October 2026. They drift; if one looks off, send a correction.
Security
Privacy
Autonomy
Trust cost
the vendor now holds something about you
Job 1
Mask
Put a disposable stand-in between you and every party you
transact with.
Security
Privacy
Autonomy
Your real email, phone and card number are the key that joins
every list you've ever landed on. Masking stops handing them
out. A leak is then contained to one stand-in, and the stand-in
tells you who leaked it.
Email aliases — Proton / SimpleLogin, addy.io, Firefox
Relay, Apple Hide My Email
One address per site. Delete the alias, the spam stops.
Trust cost: relay sees your mail
Security
Privacy
Autonomy
Virtual card numbers — privacy.com, or your bank's own
A card per merchant, with a spending cap and a pause
button. A merchant breach exposes a number that only works
there.
Trust cost: bank link and identity verification
Security
Privacy
Autonomy
Second phone number — Google Voice, MySudo, a VoIP line
The commercial number. Your real one goes only to people.
Yes, Google Voice is Google; it's the free one, and this
is about threat models, not purity. MySudo if that grates.
Trust cost: provider sees calls and texts
Security
Privacy
Autonomy
Job 2
Lock
Make the credentials you can't mask uncrackable.
Security
Privacy
Autonomy
Some things have to be really you: your primary email, your
bank, your carrier account, your tax return. Locking makes those
the hardest things to take over, so a breach elsewhere has
nowhere to go.
Free locks on the accounts that can be opened in your name
without you.
No new party
Security
Privacy
Autonomy
Job 3
Shield
Filter hostile traffic before it reaches you.
Security
Privacy
Autonomy
Masking and locking protect what you send out. Shielding handles
what comes in: trackers, malware domains, robocalls, and the
messaging channel itself.
Filtering DNS — Quad9, NextDNS
Set once on the router and every device is covered. Blocks
known malware and tracker domains before a page loads.
Trust cost: resolver sees domains you visit
Security
Privacy
Autonomy
Browser and blocker — Firefox with uBlock Origin, or Brave
Chrome and Edge no longer run the full uBlock Origin; they
only get uBlock Origin Lite, which blocks less. Firefox runs
the full version. Brave's built-in shields do the job, and
Brave still offers the full uBlock Origin under Settings →
Extensions if you want both.
No new party
Security
Privacy
Autonomy
Call and text filters — carrier apps, silence unknown
callers, 7726
Robocallers ignore the registry; filters actually drop the
calls.
Trust cost: carrier already has it
Security
Privacy
Autonomy
Signal for messaging
End-to-end by default, minimal metadata, and the people
you actually talk to are the only ones who need to follow.
Trust cost: near zero by design
Security
Privacy
Autonomy
Job 4
Clean
Remove what's already out there.
Security
Privacy
Autonomy
The only job about the past. Brokers repopulate, so cleaning is
a subscription whether you pay for it or do it yourself on a
calendar.
File and re-file opt-outs on your behalf. No usernames or
passwords involved; they need your identifiers, not your
logins. EasyOptOuts (~$20/yr) does the same job as the
others for a fraction of the price.
Trust cost: the most complete profile of you
anywhere
The wholesalers the small sites copy from. Doing these
yourself is the do-it-yourself version of the row above.
No new party
Security
Privacy
Autonomy
Platform tools — Google "Results about you", account
deletion via justdeleteme.xyz
Cleaning at the source, one platform at a time.
No new party
Security
Privacy
Autonomy
Job 5
Own
Hold the keys yourself, so no provider can strand you.
Security
Privacy
Autonomy
The job commercial services barely touch, because a business
can't easily sell you independence from businesses. It's also
the counterweight to jobs 1 and 4, which each add a vendor who
knows you well.
A domain of your own, with your email on it
Your address stops belonging to a provider. Leave your
provider tomorrow and the address comes with you.
Trust cost: registrar, and the mail host you pick
Security
Privacy
Autonomy
Local models — LM Studio, Ollama
Anything personal goes to a model on your own machine.
Nothing leaves.
No new party
Security
Privacy
Autonomy
Scheduled exports — Google Takeout, Apple, Meta, Proton
A copy you hold is the only one a lockout can't take.
No new party
Security
Privacy
Autonomy
Open-source, exportable tools — Bitwarden, Signal,
Standard Notes, Ente Photos
Not self-hosting yet; just choosing tools you
could leave with your data intact.
No new party
Security
Privacy
Autonomy
Job 6
Watch
Know when something changes.
Security
Privacy
Autonomy
Everything above decays. Watching is the loop that tells you a
new breach landed, a broker repopulated, or someone tried to
open something in your name.
Breach alerts — Have I Been Pwned notifications
Free. Rotate the password the day the alert arrives, not a
year later.
Trust cost: they hold your email to alert you
Security
Privacy
Autonomy
Bureau alerts and USPS Informed Delivery
You see credit inquiries and incoming mail before anyone
else can act on them.
Trust cost: they already have it
Security
Privacy
Autonomy
The six-month recheck
Search your own name; re-run the breach check; skim the
alias list for ones that went noisy. A calendar reminder,
not a product.
No new party
Security
Privacy
Autonomy
Every mask and every cleaner is a new party who knows you
privacy.com needs a bank link and identity verification. DeleteMe
needs the most complete profile of you that exists anywhere. You
trade exposure to many strangers for trust in one vendor. That
trade is usually worth it, and Job 5 exists so it never becomes
the only option. The why lives on the trifecta page.
Reference · the why behind the scorecard
What each goal costs the others
a frictive trifecta
Security, privacy and autonomy are three different goals, not three
names for one. Each is reachable on its own. Reaching for any one of
them costs you some of the other two, and that friction is the
interesting part. This page maps the costs. It's also why the
scorecard has three columns instead of one.
Three different goals
Security — how hard it is for someone to attack or
impersonate you.
Privacy — how little is known about you, and by how few
parties.
Autonomy — how much you hold the keys yourself; whether
any single provider can lock you out or lock you in.
One move, three directions. Add your phone number as the second
factor on your email account. Security goes up: a thief
now needs your phone as well as your password.
Privacy goes down: one more company holds your number,
and numbers get matched and resold. Autonomy goes down:
lose the number in a carrier dispute and the account goes with
it. None of that is a mistake. It's the shape of the problem,
and every task on this site sits somewhere inside it.
The triangle
Drag the point. Where it sits is a lean, not a score: the three
bars always add up to the whole, so moving toward one corner
means moving away from the others. The frictions live on the
edges. Convenience sits in the middle and pulls everything
toward it.
This is a ternary plot: the same picture soil scientists use for
sand, silt and clay. Three parts that always add up to the
whole, so there is no position that is all three at once. The
percentages are a way of talking about a lean, not a measurement
of anything.
The three frictions
Each corner is easy on its own. Each edge is where a real choice
has to be made. Move the point toward an edge above and the
matching friction lights up here.
Security vs Privacy edge 1
Proving it's really you means someone has to know who you
are. Identity verification, bank links, recovery phone
numbers, credit bureaus: the strongest locks are built from
the most personal data.
Where you'll meet it: privacy.com's virtual cards contain
merchant breaches, and need a bank link and an identity check
to issue. Passkeys are the rare exception that adds security
without adding knowledge.
Privacy vs Autonomy edge 2
Most privacy tools work by putting one trusted party between
you and everyone else. That reduces who knows you from
hundreds to one, and makes that one very important.
Where you'll meet it: a data-removal service needs the most
complete profile of you anywhere in order to remove you from
everywhere else. An email alias relay sees every message it
forwards.
Security vs Autonomy edge 3
Holding your own keys means nobody can reset them for you.
Self-hosting means you are the one patching at 2 a.m.
Independence from providers is also independence from their
security teams.
Where you'll meet it: a local AI model leaks nothing, and
gets no safety updates unless you install them. A domain of
your own is portable, and a lapsed renewal loses your email
entirely.
Why convenience wins by default
Nobody chose to be in sixty broker databases. Every step there
was the path of least resistance: the same email, the same
password, the "sign in with" button. The frictions above are why
no single product fixes it. Every product sits on one edge and
gives something up on another, and the easiest option on any
screen is the one that gives up a little of all three.
The conveniences the tasks on this site ask you to trade, so the
ask is honest:
One password you can remember, used everywhere.
"Sign in with Google" or "Sign in with Apple" instead of a new account.
One email address for everything, so nothing needs sorting.
Codes by text message instead of an app you have to install.
Passwords remembered by the browser, wherever you're signed in.
Backups where the provider keeps the key, so you never have to.
Location left on, so maps and photos just work.
The free tier of everything, paid for by what it learns about you.
Each one is a real convenience. The tasks say what you get for
giving it up, and the scorecard lets you decide whether that's a
fair trade for you.
Choosing your priorities
Most people are a blend, and the weights on the scorecard are
meant to be moved. Three leans that show up often, each with the
weights that fit it:
Been impersonated
Someone got into an account, or opened one in your name.
Locks first: the password manager, second factors that
aren't your phone number, a credit freeze. You'll accept
that a few companies know exactly who you are, because
that's what the locks are made of.
Harassed or doxxed
Someone is looking for you. Being hard to find matters more
than being hard to break into: broker removal, aliases, a
second number, location off. You'll accept a trusted party
in the middle, because doing it all alone takes longer than
you have.
Locked out by a platform
A suspended account took your email, your photos, or your
livelihood with it. You want the keys: your own domain, your
own backups, tools you can leave. You'll accept being the one
who has to keep it all patched and renewed.
The middle isn't neutral. It's where the defaults have been
choosing for you. Picking a lean, even a small one, is the first
choice that's yours.
How the scorecard uses this
Every task carries a score on all three goals, so the trade-offs
are visible per task instead of argued in the abstract. The
Tools page prints the trust cost of each service for the same
reason. Your weights are your answer to this page.
The rest of this site assumes the services will still be there and the
question is how much to trust them. This page assumes they won't be,
for an hour or a year, and asks what of yours keeps working.
BLUF
Plan so that any single thing going away is an inconvenience rather
than a catastrophe: the power, the internet, the phone number, the
account, the company. You don't need to survive all of them at once.
You need to have thought about each one once.
Decide what "crumbling" means for you
Consideration: which failures are likely enough to plan
for, and which you can leave to the people they'll actually
happen to.
Outage — power, internet, cell. Hours to days.
Near-certain over a few years anywhere.
Lockout — account suspended, phone lost, password manager
unreachable, 2FA device dead. The most common one and the least
planned for.
Price shock — the subscription triples, the free tier
ends, the device gets bricked by a policy change.
Hostility — a breach, a data demand, a platform that
turns on its users.
Physical — fire, flood, theft, a move at short notice.
Rank these for where you live and how you live. The rest of the
page is ordered for the average ranking; reorder it for yours.
Communications
Consideration: how you reach people when the primary path
is gone. Full treatment on
ACT; this is the
personal-infrastructure slice.
A PACE plan — Primary, Alternate, Contingency, Emergency
— written down, shared with the people it names, and rehearsed
once. The usual shape: phone call or text → Signal over Wi-Fi →
a radio → a meeting point.
Your phone number is a rental. Don't make it the root of
your identity: it shouldn't be the only recovery path for
anything that matters (see Identity below).
A paper contact list — the ten numbers and addresses
you'd need, in the go-binder and in your wallet.
A path that needs no company — FRS/GMRS handhelds for the
block, a LoRa mesh node for the neighborhood, an amateur license
if you'll use it. Pick one and be fluent in it.
Offline messaging on the phone you already have — Signal
needs the internet; when the tower and the Wi-Fi are both down
you need an app that talks phone-to-phone. Briar (Android, open
source) does, over Bluetooth, local Wi-Fi or Tor. It went into
maintenance mode in July 2026 — security fixes only, still safe,
not growing. We don't know of an iOS equivalent we'd vouch for.
Power
Consideration: how many hours your phone, laptop and router
run after the wall stops. Measure it before you guess it.
Know your watt-hours. Phone ~15 Wh, laptop ~60,
router+modem ~10 W continuous. A 20,000 mAh bank is ~70 Wh; a
small LiFePO₄ station is 250–1,000 Wh. Do the division once.
Three tiers — a pocket bank always charged, a station
that runs the router for a day, and a way to refill the station
(a folding panel, a car, a neighbor's generator).
A UPS on the modem and router — the cheapest single
upgrade; an outage that spares the ISP's plant but not your wall
becomes a non-event.
12 V habits — USB-C PD and 12 V cigarette-socket adapters
for everything you'd want to run off a station or a car.
Chemistry and storage — LiFePO₄ for anything that sits;
check charge quarterly (see Drills).
Connectivity
Consideration: a second path to the internet, and a useful
device when there's no path at all.
Own the router. The ISP's box is theirs; yours can run
the DNS filter, the VPN, the local services, and stays when the
contract ends.
A second path — a phone hotspot on a different carrier
from your home line, a neighbor's link over the mesh, a shared
satellite terminal on the block.
Offline references — maps (CoMaps / OsmAnd), an
offline Wikipedia and medical reference (Kiwix), the manuals for
your own gear as PDFs. Downloaded, not bookmarked.
Local-first software — tools that work without a server
and sync when one appears: notes, passwords, files. If the app
shows a spinner with no internet, it isn't yours.
Local models — an LLM on your own machine is the offline
version of the thing you'd otherwise ask a cloud.
Data
Consideration: which copy survives each failure in section
01.
3-2-1 — three copies, two media, one off-site. The one
people skip is the copy that is unplugged; ransomware
and a lightning strike both take everything that's connected.
Encrypt the off-site copy and keep the key somewhere the
copy isn't. VeraCrypt (free, open source, any OS) for a plain
drive; Kopia if you want scheduled, deduplicated backups with a
GUI.
Scheduled exports from the clouds — Google Takeout,
Apple, Meta, Proton. A lockout can't take a copy you hold.
Test a restore. A backup that has never been restored is
a hypothesis.
Decide what's irreplaceable — photos, documents, keys,
the password vault — and give those the full 3-2-1. Everything
else can be re-downloaded.
Identity and access
Consideration: can you get back into your own life if the
phone is gone and the primary email is locked?
Recovery codes on paper for email, the password manager,
and anything with 2FA. In the go-binder, not in the vault they
unlock.
Two hardware keys — one carried, one stored. A single key
is a single point of failure with extra steps.
An exportable vault, and an export. Bitwarden or
KeePass-format copy on the unplugged drive, refreshed with the
backups.
No phone number as the only reset path — a SIM swap is
the common way accounts anchored to a phone number get taken.
Swap in a key or an authenticator everywhere the option exists.
A domain of your own — an address you can move between
providers is the identity equivalent of owning the router.
Copies of ID — encrypted scans in the vault; paper in the
binder.
Documents and records
Consideration: what you'd need to prove, claim, or contact
in the first 72 hours, on paper.
The go-binder — insurance policies and numbers, lease or
deed, vehicle title, the prescriptions list, the contact list,
recovery codes, a printed copy of the PACE plan.
Medical basics — allergies, medications, doctors, in a
form a stranger can read.
keep this to the format, not the content
One place, known to one other person.
Access to money
Consideration: how you pay for things when the card
network, the app, or the bank is the thing that's down.
Some cash at home — a week of ordinary spending in small
bills.
More than one institution — a second account somewhere
unrelated, with its own card, so a freeze or outage at one isn't
a freeze on you.
Know your account numbers without the app.
Keep it boring. This section is about access, not strategy.
consider linking out rather than expanding
Home network
Consideration: the network you own should be harder to get
into than the ones you don't.
Router basics — non-default admin password, auto-update
on, WPS and remote administration off, WPA3 where the devices
allow.
Segment the junk — IoT and guests on their own network;
the TV should not be able to see the laptop.
DNS filtering at the router so every device inherits it.
Local logging you can read — know what's on your network
on a normal day so an abnormal day is visible.
Physical placement — the router and the station on the
UPS, off the floor, reachable in the dark.
Devices
Consideration: repairability and spares over specs.
A backup phone — an old one, wiped, charged, with offline
maps (CoMaps or OsmAnd), Signal and Briar already on it.
Cables and chargers in duplicate, one set in the
go-binder's bag.
A radio that takes AA cells — for weather and broadcast
when everything else is quiet.
Prefer devices you can open — replaceable batteries,
standard ports, firmware you don't need permission to install.
Full-disk encryption everywhere, so a stolen device is a
lost device and nothing more.
People
Consideration: infrastructure is mostly other people.
Skills spread; gear doesn't.
Two neighbors who know the plan and where the binder is.
A shared node — one mesh relay on a roof does more for
the block than five in drawers.
Teach one thing — the person you taught to use a radio is
a second radio.
Mutual-aid contact — know the local group before you need
it. link out, don't host
Drills
Consideration: none of the above is real until it's been
tried once with the stakes off.
Quarterly, one evening: pull the modem's plug and see
what still works. Power the router from the station. Restore one
file from the unplugged backup. Send one message down the PACE
tree. Top up the batteries.
Yearly: open the go-binder and replace what's stale. Log
in to something using only the recovery codes.
Write down what failed. That list is next quarter's
to-do.
~*~
Tenet lean of this whole page: security
· privacy
· autonomy
. It's the autonomy page. Food, water and shelter are deliberately
out of scope; ready.gov covers them better than this site will.
0 · your answers
Worksheet
The three home-page questions, expanded. Fill it in here and save
locally or print it and fill it in by hand. Nothing you type leaves
this browser. Your answers fade back the Floor steps that don't apply
to you.
BLUF
Check the two adversaries that actually apply, rank what would hurt
to lose, say what you'll change. That's the whole plan; everything
after is execution.
1 · the baseline, on the devices in front of you
Build the Floor
The baseline everyone gets, written out click by click for the
computer and phone you actually have. Done in order it takes about an
hour. Tasks that don't match your Worksheet are dimmed, not hidden.
BLUF
Password manager, then two-factor on the four accounts that matter,
then the phone, then one encrypted backup. When you can log in to
email, bank and carrier with a generated password plus a second
factor, and the phone locks itself, the Floor is done.
ComputerPhone
No intake yet — showing everything.
Fill in the worksheet to fade back what
doesn't apply to you.Menu names move between versions. Apple paths were checked on iOS
26 and macOS 26 (27 shipped in September and may have moved a few);
Windows on 11 24H2; Android on a Pixel running 15. Samsung and other
makers rename things — when a name doesn't match, search
Settings for the word.
A · Password manager ~15 min
Why: reused passwords are how accounts fall. One unique
password per site means one breach is one breach. If yours live in
a document, this is the emergency.
Install Bitwarden (free, open source): App Store on the
iPhone or Play Store on Android, bitwarden.com on the Mac, plus
the Safari or Brave extension.
Already deep in Apple? iCloud Keychain is acceptable; it just
doesn't leave with you.
Install Bitwarden (free, open source): bitwarden.com on
the PC (the desktop app), plus the extension in Brave, Firefox or
Edge, and the phone app from its store.
Chrome or Edge offering to save passwords is not the same
thing; turn that off once Bitwarden is in so you get one
prompt: Edge → Settings → Passwords
or Chrome → Settings → Autofill and passwords.
Make the master passphrase four or five random words,
chosen by chance, not by you. Write it on paper. Decide where the
paper lives (not the laptop bag).
Every click of the account setup, including the hint field and
the recovery code: Step by step →
Bitwarden.
iPhone:
Settings → General → AutoFill & Passwords
→ turn on Bitwarden, turn off the others so you get one prompt.
Android: open the Bitwarden app →
Settings → Autofill → Autofill services
→ on; when the phone asks for a preferred service for passwords
and passkeys, pick Bitwarden. Turn Google's own autofill off so
you get one prompt (search Settings for autofill; the menu
is under Passwords & accounts on most phones).
Move the four accounts that matter now, generating a new
password for each: primary email, bank, phone carrier, and the
account your devices hang off (Apple
AccountGoogle Account, plus your Microsoft account). Add your main
social account while you're at it. The rest migrate over the next
month as the browser prompts you.
Open Bitwarden's Data Breach report (free; it checks your
email addresses against known breaches) and look at the number.
It's the motivation for the next month.
B · Two-factor on the four accounts that matter
~10 min
Why: a password is one lock. A second factor means the
thief also needs the thing in your pocket. Order of strength:
hardware key, then an authenticator app, then text message. Text
is what SIM swaps target; use it only where nothing else is
offered. Not email: if email is the second factor for email, it's
one factor. A password manager's built-in code generator is fine
for other accounts; the manager's own second factor lives
outside it, in a separate authenticator app — see
Step by step.
Google account:myaccount.google.com → Security → 2-Step Verification. Add a passkey (the phone can hold it) or an authenticator
app; remove the phone number as a sign-in method once the app
works. Download the backup codes into Bitwarden.
On Android this is the
account the whole phone hangs off, so it gets the strongest
second factor you'll accept.
Apple Account:Settings → [your name] → Sign-In & Security. Two-factor is almost certainly on already; add a
Recovery Key and a Recovery Contact under Account
Recovery. Write the key on the paper.
Microsoft account:account.microsoft.com → Security → Advanced security
options. Turn on two-step verification with an authenticator app or a
passkey (not text message); download the recovery code into
Bitwarden. This account holds your Windows sign-in and your
disk-encryption recovery key, so it's the one to lock hardest.
Bank: in the bank's app under security settings, switch
from text codes to the app's own push or an authenticator if
offered. If only text is offered, keep it and note it; the
port-out PIN in step C is what protects it.
Carrier account: log in on the carrier's site, turn on
two-factor, and while you're there do step C.
Every backup code goes into Bitwarden as a note on that account,
today, not later.
C · The phone is the keystone ~15 min
Why: the phone is the recovery path for everything else.
Lose control of it and you lose the rest. These are toggles.
Screen lock:Settings → Face ID & Passcode → Change Passcode →
Passcode Options
→ six digits or alphanumeric. Face ID stays on for convenience.
Screen lock:Settings → Security & privacy → Device unlock → Screen
lock
→ PIN, six digits (not a pattern; patterns are easy to watch).
Fingerprint or face stays on for convenience. Samsung:
Settings → Lock screen → Screen lock type.
Auto-lock:Settings → Display → Screen timeout
→ 1 minute or less, and under
Device unlock → Screen lock settings
set "Lock after screen timeout" to Immediately.
Updates:Settings → General → Software Update → Automatic
Updates
→ all on. If the phone no longer gets updates, that is the
biggest finding of the day and no app fixes it.
Updates:Settings → System → Software updates
(Samsung: Settings → Software update → Auto
download) → on, and check
Settings → Security & privacy → System
& updates → Google Play system update. If the phone
no longer gets updates, that is the biggest finding of the day
and no app fixes it. Recent Pixels and Galaxy S phones get seven
years; cheaper and older phones often got two or three.
Find My:Settings → [your name] → Find My → Find My iPhone
→ on, with "Send Last Location." Know that you can wipe it from
icloud.com/find.
Find Hub (the new name for Find My Device):
Settings → Security & privacy → Device finders → Find
Hub
→ on, including "find offline devices." Know that you can lock
or wipe it from android.com/find.
Stolen Device Protection:Settings → Face ID & Passcode → Stolen Device
Protection
→ on. It stops a thief who watched you type the passcode from
changing the Apple Account.
Theft protection:Settings → Google → All services → Theft protection
→ turn on Theft Detection Lock, Offline Device Lock and Remote
Lock, and Identity Check if your phone offers it. Together they
do what Apple's Stolen Device Protection does: a snatched,
unlocked phone locks itself, and a thief who watched your PIN
still can't change the Google account.
Learn the off switch for Face ID and fingerprint.Hold the side button and either volume
button until the power-off slider appears, then tap
Cancel.Hold the power button
(on some phones, power and volume up together) and tap
Lockdown. If it isn't there, search Settings for
"lockdown" and turn the option on.
Until you type the passcode, the phone won't open for your
face or finger. Try it once now. Use it before a border
crossing, a protest, a traffic stop, or handing the phone to
anyone. Leave biometrics on the rest of the time; the theft
protection above depends on them.
Carrier port-out PIN (the SIM-swap defense): AT&T
calls it "Wireless Account Lock"; T-Mobile "Account Takeover
Protection" / "Port Out PIN"; Verizon "Number Lock." Do it on
the carrier's site now. While there, find the
CPNI marketing opt-out.
Signal: install, set a username in Settings →
Profile, turn on Registration Lock under Settings →
Account, and turn off "Who can find me by number."
This is the lane for anything you'd rather
not have in iMessage's backup.This is the lane for anything you'd
rather not have sitting in Google Messages or your carrier's
logs.
D · One encrypted backup, one local copy
~10 min
Why: encryption without backups is a way to lose your own
data. And the default iCloud backup can be
read by Apple and handed over; one switch fixes that.Android's own backup is mostly sealed
with your screen-lock PIN, but your photos aren't; the local copy
covers what the cloud doesn't.
Advanced Data Protection:Settings → [your name] → iCloud → Advanced Data
Protection
→ on. It will make you set a Recovery Key or Contact if you
skipped it in B. Now the backup, photos and iMessage history are
end-to-end encrypted. Write the key on the paper.
Phone backup:Settings → Google → All services → Backup
→ on. App data, settings, call history and texts are encrypted
with your screen-lock PIN, so Google can't read them. Photos
and videos in Google Photos are not; that's what the
local copy below is for. (The phone's own storage is encrypted
already on any Android from the last several years.)
Mac disk encryption:System Settings → Privacy & Security → FileVault
→ on. Choose "iCloud account can unlock" only if you're fine
with that; otherwise save the recovery key to the paper.
PC disk encryption:Settings → Privacy & security → Device encryption
→ on (Windows 11 Home; on Pro it's called BitLocker and lives
under the same menu). New PCs set up since late 2024 usually
have it on already. The recovery key is saved to your Microsoft
account; open aka.ms/myrecoverykey, copy the key to the
paper, and know that Microsoft holds a copy too.
One local copy of the irreplaceable: plug in a drive,
System Settings → General → Time Machine
→ add the drive, tick "Encrypt Backup." Photos and documents now
exist somewhere Apple isn't. Unplug it when it's done.
One local copy of the irreplaceable: plug in a drive and
turn on File History (search Settings for it) pointed at
that drive, or just copy the Photos and Documents folders onto
it. On Pro, right-click the drive → Turn on BitLocker so the
copy is encrypted; Home can't encrypt a removable drive with
BitLocker, so use VeraCrypt (free, open source) for the
folder that matters most. Unplug it when it's done.
Phone photos: plug the phone
into the PC by cable and copy the DCIM folder onto the same
drive.Phone photos: plug the phone
into the PC by cable (tap Trust) and copy the DCIM folder onto
the same drive, or use iCloud for Windows.
Phone photos: plug the phone into the
Mac by cable and use Android File Transfer or the Files
app to copy the DCIM folder onto the same drive.With Advanced Data Protection on, the
phone's photos are covered by the encrypted iCloud backup; the
drive holds the Mac's copy of them.
Write on the paper where the drive lives. The paper now has:
master passphrase, Apple recovery key,Google backup codes' location,FileVault key,disk-encryption recovery key, drive
location. That paper is the most important object in the house;
treat it like a passport.
E · Computer and browser, the short version
~10 min
Why: the computer is where the long sessions happen and
where the ad profile gets built. A few settings and one browser
change.
System Settings → Privacy & Security
→ walk down Location Services, Contacts, Photos, Microphone,
Camera; revoke anything you don't recognize. Then
Apple Advertising → Personalized Ads
off.
Settings → Privacy & security →
under General, turn off "Let apps show me personalized ads by
using my advertising ID"; under Diagnostics & feedback, turn
off optional diagnostic data and tailored experiences; then walk
down Location, Camera and Microphone under App permissions and
revoke anything you don't recognize.
Sign-in:Settings → Accounts → Sign-in options
→ a PIN or Windows Hello for the daily unlock, and "require
sign-in when waking from sleep." Then
Settings → Windows Update → make sure
updates are automatic. If the PC is still on Windows 10, its
free updates ended in October 2025 and the paid extension ends
this October; that is the biggest finding of the day.
System Settings → Network → Firewall →
on.
Windows Security (search Start for it) → Firewall &
network protection → all three networks on. It usually is; this
is a check, not a change.
Install Brave (or Firefox) and set it as default:
System Settings → Desktop & Dock → Default web
browser. In Brave, turn off Rewards and the crypto wallet in Settings;
add uBlock Origin if it's Firefox. Keep Safari around for
the one site that breaks.
Install Brave (or Firefox) and set it as default:
Settings → Apps → Default apps. In
Brave, turn off Rewards and the crypto wallet in Settings; add
uBlock Origin if it's Firefox. Keep Edge around for the
one site that breaks; it won't be many.
Search engine → DuckDuckGo. Not for purity; to stop feeding one
profile.
iPhone:
Settings → Privacy & Security → Tracking
→ "Allow Apps to Request to Track" off.
→ Apple Advertising → Personalized Ads
off. → Location Services → set each
app to "While Using" or "Never."
Android:
Settings → Security & privacy → Privacy → Ads
→ Delete advertising ID.
→ Permission manager → Location → set
each app to "Only while in use" or "Don't allow," and turn off
"Use precise location" for anything that isn't maps.
Settings → Google → Ads → turn off ad
personalization there too.
The Floor is done when
You can log in to email, bank and carrier with a
Bitwarden-generated password and a second factor that isn't
email.
The phone locks itself within a minute and you know how to wipe
it remotely.
Advanced Data Protection is onPhone backup is on, the
computer's disk is encrypted, and there's a drive somewhere with
your photos on it.
You know where the paper is, and one other person does too.
Next: if you checked "move email off Google" on the intake,
Leave Google is the one big move.
Otherwise the full checklist picks up the
remaining toggles. Either way, put the
one-month check on the calendar now.
Who else do you know with passwords in a document? Send them this
page; it's the same conversation, and it's easier the second time.
2 · the one big move
Leave Google, in order
Moving email, calendar and contacts off the ad company is the
highest-value single change for this stack, and the one people stall
on because it feels like a cliff. It isn't; it's ten steps, each
reversible, and nothing gets deleted on day one.
BLUF
New address first, forward the old one to it, import the archive,
move contacts and calendar, re-point the five accounts that recover
through email, aliases for everything else, then let Gmail go quiet
for six months before you decide anything about it. Progress saves
in this browser.
Prices, free-plan limits and feature claims on this page were checked October 2026. They drift; if one looks off, send a correction.
~*~
Other Google services
Mail is the big move. These are the small daily ones, where the
convenience is paid for in data. Swap what's easy; turn down the
settings on what you keep.
Maps and driving. Google Maps and Waze (Google owns both)
keep your trips with your account. On an iPhone, Apple Maps ties
searches and routes to a random identifier instead of your Apple
Account. On any phone, CoMaps or OsmAnd need no account and
keep the maps on the phone, with turn-by-turn directions but no
live traffic. Keeping Google Maps? Its Timeline now lives on the
phone: leave the backup off and set auto-delete to three months.
Search. DuckDuckGo as the default in every browser you use
(the Floor sets it on the computer).
Chrome. Brave or Firefox, set up in the Floor. Chrome signed
in to your Google account sends your browsing along with it.
YouTube. Watch signed out, or pause YouTube History in your
Google account's activity controls.
What stays signed in.myactivity.google.com → Activity controls:
turn off Web & App Activity, or set it to auto-delete after
three months.
Your website, newsletter or signup form. If you run anything
on Google tools (Analytics, Forms, Maps or YouTube embeds), the
sibling site lists a replacement for each:
Swaps that keep the function, drop the
surveillance →
~*~
What not to do
Don't delete Gmail. Demote it.
Don't change every login in one sitting. Five today, the rest as
they come up.
Don't route the new mailbox back through Gmail's app "to keep one
inbox." That undoes the point.
Don't set up a second new provider "as a backup." One good post
office and an exportable archive is the backup.
Common question: "what if the new provider folds?" Answer with
portability, not reassurance: you have the archive locally, you can
export again any time, and if you took step 3 the address itself moves
with you. That's the whole hedge.
Reference · the routine that ties the tools together
Systems & workflows
Step by step covers one tool at a time. This page is the handful of
moves you'll repeat for every account, in the order that doesn't bite.
draft — built from one rehearsal, September 2026
BLUF
Everything lives in one of a few homes, and each secret lives in
exactly one. Two habits prevent most of the trouble: save before
you submit, and one screen at a time.
The system: what lives where
Your head — the vault passphrase. The only thing you memorize.
Paper — the passphrase again, and the vault's own recovery code, spaces and all. Two copies, two places.
Your phone — the authenticator app: six-digit codes for the vault and the accounts that matter.
The vault — every other password, which alias each account uses, other services' recovery codes, PINs, security-question answers.
One inbox — your identity email, where every reset goes. It gets the strongest lock, and never uses email as its own second factor.
Aliases — one per service, all forwarding to that inbox. If one leaks, you know who, and you switch off one address.
The rule under all of it: a secret never lives inside the thing it unlocks. That's why the vault's own passphrase and recovery code are on paper, and why its second factor is in a separate app.
Any new account
Alias first. Make one for this service (see Email aliases). Check the prefix before saving — it's visible.
Vault item second. New item → Login. Title Service — account, username the alias, website filled in. Generate a password (Password, 20+ characters) and save. The account doesn't need to exist yet.
Sign up, pasting from the saved item.
Verify the email promptly, in the same browser. These links expire.
Log out and back in once using the vault. That proves it saved the right password.
Two-factor if the account matters (below). Add the date to the item's notes.
Changing a password
Vault first. Open the item, generate a new password, save. The old one is kept in the item's password history if the site asks you to type it.
Then the site: change-password form, old password, paste the new one.
Log out and back in with the vault to confirm.
Saving before submitting is the whole trick. If the site accepts a password the vault never saved, it's gone.
Turning on two-factor
Authenticator app installed first (Ente Auth, Aegis, 2FAS, Proton Authenticator, Bitwarden Authenticator — any separate app).
Site's security settings → authenticator app. The QR code on this screen is the secret: scan it in private, don't screenshot it.
Type the six-digit code to confirm it worked.
Recovery codes: into that account's vault item — except the vault's own, which goes on paper. Copy them exactly, spaces included; they have to be typed that way later.
Log out and back in to test.
Skip email as a two-factor method; it's the weakest one. Hardware keys are optional and need the key in hand. Code-hosting sites (Codeberg, GitHub and the like): set up an SSH key or access token before two-factor, because two-factor stops your password working for git.
Handing someone a password
Never in email or a text; both are stored forever somewhere.
Bitwarden Send (in the vault: Send → New): paste the secret, set it to expire in a day and to delete after one view, send the link. Text Sends are free; files need Premium. It's end-to-end encrypted, so Bitwarden can't read it either.
Or Signal with disappearing messages on, then delete for everyone once they've saved it.
Anything shared on purpose for the long term goes in the household's shared collection, not in a message.
Fixing an account made the old way
Your real email, a reused password. Common, and fixable in ten minutes.
Log in with the old password one last time, while it still works. "Forgot password" sends mail to the old address, so skip it unless the login truly fails.
Change the password (the workflow above).
Make an alias and add it to the account's email settings. Click the verification link.
Set the alias as primary, then remove the old address.
Update the vault item's username to the alias.
Two-factor last.
When you're stuck or locked out
Stop. Nothing gets worse by waiting; repeated tries can lock you out for longer.
Read the exact words on the screen. "We sent a code to your email," "code from your authenticator app" and "recovery code" are three different doors.
Page shows one line of error text and nothing else? Try a private window. If it works there, your browser is holding something stale: quit it completely and reopen. (Ctrl/Cmd+Shift+T brings closed tabs back.)
Waiting on an email? Check spam, search for the sender's name, give it five minutes, and check which address that account actually uses.
Using a recovery code? Type it exactly as written, spaces between groups. Using one usually turns two-factor off; cross it out and set two-factor up again.
Still stuck: write down what you tried, and ask. That list is most of the fix.
When a screen asks for money
Password managers, alias services and VPNs all put an upgrade screen in the path of their free features. It's an offer, not a step. Close it and look for the free path; the free plans cover everything on the Floor. If something really does need paying for, write it down and decide later, not mid-task. PG to reword
Once a month, ten minutes
Run the vault's breach report; fix one account from your To fix folder.
Updates on phone and computer.
Disable any alias that's started getting spam — and note who leaked it.
Check the paper is still where you left it.
Closing an account
Download anything you want to keep.
Delete the account on the site.
Then disable its alias. Disable, don't delete, for a few months — deleting an alias that an account still uses locks you out of that account.
Vault item: add "closed" and the date to the notes, or delete it.
Reported differences
These are drafts. If a workflow doesn't match what happened to you, write in with what you were doing and where it went sideways. It goes here for the next person.
Read before trusting anything here
Terms and Conditions
BLUF
No upsell, no data kept, no fear, no five-page to-do lists, no
pretending to cover threats we can't.
Won't use fear
We name adversaries plainly and rank them by likelihood. Most
readers' real exposure is a reused password and an unlocked phone,
not a hacker in a hoodie, and we say that kindly rather than
dressing it up.
Won't keep anything about you
The intake and the checklists save in your browser and nowhere
else. There's no account, no analytics, no tracking pixel, and no
outside requests at all — even the fonts are embedded in the file.
A session in person keeps a one-line record (name, date, tier,
check-in date) and nothing else; the intake sheet stays in your
hands.
Won't hand you a list longer than five
Nobody leaves a session, or should leave this site, with more than
five things to do today and three this month. If the full
checklist looks long, that's why the Worksheet sorts it. Tune-up,
not rebuild.
Won't sell you a VPN
A VPN moves trust from the coffee-shop network to a VPN company.
It's useful on networks you don't own and irrelevant to the
threats most readers actually have. When we mention one, we say
what it's for and what it isn't. No affiliate links, here or
anywhere on the site.
Won't cosplay opsec
No spy-grade habits against threats you don't have.
Over-correcting costs convenience, adds nothing, and gets
abandoned, taking the useful habits with it. We are not trying to
make you invisible; we're trying to make you boring and expensive
to target.
Won't tell you to burn down Apple
An iPhone and a Mac, tuned, are fine for this tier. Moving email
off the ad company is a higher-value move than leaving Apple, and
we'd rather you did one thing well.
Won't recommend anything that needs ongoing payment to us
Every tool on the site works if you never speak to us again. Where
a subscription is the right answer (a mailbox, a domain), we say
what it's for and what happens when you stop.
Won't cover high-risk or politically sensitive situations; we refer those out
Where a settings path, a vendor's default, or a law's status is
unverified, it's flagged on the page. Send corrections through
Support; they're the most useful mail we get.
~*~
What we will do
Say why before what, every time.
Center clarity: plain words, one step at a time, every term defined
in the Glossary.
Print the trust cost next to every vendor we name.
Check back in a month, because that's when the password migration
actually finishes.
For two or more people
Household
Anyone who shares your accounts shares your security. This page is
the Floor for a household: the shared logins, who can get into
whose, and what happens if one of you can't.
BLUF
Inventory the shared accounts, give the household one password
manager with a shared collection, decide who holds whose recovery,
and write the one page that lets everyone else get in if you
can't. Then one drill a year.
Prices, free-plan limits and feature claims on this page were checked October 2026. They drift; if one looks off, send a correction.
1 · All parties do their own Floor
A household is only as locked as its least-locked phone. Everyone
else's Floor is not optional; it's usually
faster because the first person can drive.
2 · Inventory the shared accounts
Why: shared logins are where reuse hides. Nobody wants to
change the Netflix password because someone else has it
memorized.
List every account more than one person uses: streaming, utilities, the
bank's joint account, the airline, the kids' school portal, the
router admin page, Amazon, the family Apple/Google plan.
Mark which ones are shared on purpose (utilities,
streaming) and which are
one person's account someone else just knows (that's the one
to fix).
Anything with money or identity behind it gets its own login per
person where the service allows it (most banks and Apple/Google
do). Shared-on-purpose accounts go in the shared collection in
step 3.
3 · One manager, one shared collection
Why: the shared password should live in one place all
parties can see and any of them can rotate, not in a text thread.
Bitwarden: create a free Organization (up to two people)
or use the Families plan (up to six); put the shared-on-purpose logins in a shared
collection. Apple households can use iCloud Keychain's
Shared Groups instead.
Past six people: Families stops at six and can't add
seats. Either put the people who actually use the shared logins
on Families and let everyone else keep their own free vault
(most big households don't need every password shared with
everyone), or move the whole group to a Bitwarden
Teams organization, which has no cap and gives every
member Premium, at $4 per person per month (about $384 a year
for eight, as of October 2026). A third way: two Families
plans, each bought by a different person, with one person in
both (Bitwarden lets one account belong to more than one
organization). That covers up to eleven people for about $96 a
year, but each shared password lives in only one of the two,
so anything everyone needs has to be copied into both and kept
matching by hand.
Each person keeps their own vault for their own accounts. The
shared collection is the only overlap.
Rotate every shared password once, now, from the manager. It
takes twenty minutes and it's the last time anyone types "our"
password from memory. One-off handoffs go through Bitwarden Send
or a disappearing Signal message, never a text.
4 · Who holds whose recovery
Why: "If something happens to you, I can't get into
anything" is the sentence this whole page exists to make untrue.
Apple: each person sets another household member as
Recovery Contact (Settings → [name] → Sign-In & Security → Account
Recovery) and as Legacy Contact (same menu). Google: set another
household member as the recovery email and in
Inactive Account Manager.
Bitwarden: set up Emergency Access so another
household member can request the vault after a waiting period you choose.
The person granting access needs Premium (about $20 a year as of
October 2026) or a Families plan; the person receiving it can be on
the free plan.
Papers, swapped. Each person's paper (master
passphrase, recovery key, FileVault key, drive location) is
sealed in an envelope someone else in the household
keeps. Not photographed. Not in anyone's phone.
One hardware key each, plus a spare held by someone else in
the household.
5 · The one page
Why: the household go-binder. It answers "where is
everything" for the person who didn't set it up.
Where the envelopes are. Where the backup drive is. Which
manager, and that Emergency Access exists.
The list from step 2, with which login is whose.
Carrier, bank and insurance account numbers (no passwords), and
the PACE plan if you have one.
All parties know where this page is. One person outside the
house knows it exists.
6 · Kids and parents, lightly
Kids' devices: screen lock, updates on, Find My in the family
group, location sharing set deliberately rather than by default.
Their accounts get a manager entry in the shared collection
until they're old enough for their own vault.
Older parents: the Floor's step C (phone lock, updates, port-out
PIN) and a Recovery Contact are the whole job. Don't move their
email; teach them to say "I'll call you back" to anyone who
phones about a bank or a computer.
Once a year
Open one envelope and log in to something using only what's
inside. Reseal.
Rotate the shared collection.
Re-read the one page and fix what changed.
A household is whoever shares your logins, your devices or your
roof, however you're related. One session covers all of them.
Past six people, tell me up front; the session runs longer and
the shared vault needs a different plan (step 3).
One month later · ~15 min
Did it hold?
The Floor is done in about an hour; the habits set in a month. This is
the short list to run thirty days on, alone or with the person who
helped. Ticks save in this browser.
BLUF
Check the password migration finished, the second factors still
work, the paper is where you said, and nothing quietly reverted.
Then pick the three things for next month and send one person this
site.
~*~
Next check-in: six months. That one is the
full checklist's "search your name, re-run the
breach check" task and takes ten minutes.
Support scaffold
Get help, or help keep this running
Two directions. Both are here because a page that asks people to give
up conveniences owes them a human on the other end.
For now: email
Booking, office hours, workshops and the newsletter are still being
wired up. Until they are, everything below starts with one message
to
relaypoint-support.gawk671@passinbox.com. Expect a reply from a person.
Get help
A session, devices on the table
Ninety minutes, in person or on a call. Intake first (who are you
hiding from, what would hurt to lose), then the Floor gets done
rather than listed, then a take-home card and a check-in a month
later. Sliding scale, no questions.
rates + booking link (one path)
Office hours
A recurring slot where you bring one stuck task and leave with it
done. Bring a friend; the aliases lesson lands better in pairs.
schedule + booking link
Ask by mail
Write to an alias, not a personal address, so the site practices
what it teaches. Expect a reply, not a ticket number.
Triage in a room, in an afternoon, with the Tier 1 list on the
wall. Pairs well with an ACT radio session.
next dates
~*~
Keep it running
Newsletter
Occasional. Setting paths move, brokers change names, a new easy
fix shows up. It's a plain email list: no signup form, no
tracking pixel. Reply "unsubscribe" to leave.
Hosting is nearly free; the time isn't. A monthly amount keeps
office hours open.
Patreon / Ko-fi / Liberapay link
Send one person
Everyone who does the Floor knows five people with passwords in a
document. Send them the Start page. If a session happens, both of
you get the referral rate.
referral rate
Pay the commons instead
Most of what this site sets you up with is free software running
on donations. If a session or this site saved you money, sending a
few dollars upstream is a fine way to say thanks.
If a settings path on any page is wrong, that's the most useful
thing you can send. Flagged items especially.
same alias, subject "fix:"
~*~
How this site treats you
No analytics, no tracking pixels, no third-party scripts. View
source; it's one file.
The checklists save in your browser only. Nothing you tick is sent
anywhere.
Vendors we name are named with their trust cost. Nobody pays to be
on the Six Jobs page.
The fonts are embedded in the page itself: zero outside requests.
View source and count.
The site's own terms · last updated 30 September 2026
Privacy policy
Everything on this site tells you to read the terms before trusting a
service. These are ours, short enough to actually read.
BLUF
This site collects nothing about you. Everything you type stays in
your browser. Loading the page contacts nobody but the host, which
keeps ordinary server logs that we don't add to and don't read.
What we collect
Nothing. No account, no analytics, no tracking pixels, no cookies set
by us, no forms that submit anywhere. There is no server-side "us" to
send anything to; this is one HTML file.
What stays in your browser
Your worksheet answers, checklist ticks and scorecard weights save in
your browser's local storage, on your device only. They are never
transmitted. We can't see them — which also means we can't recover
them: the Clear buttons where they exist, or your browser's site-data
controls, erase everything for good. If you're on a shared or public
computer, clear this site's data in your browser before you leave.
Outside requests: zero
The typefaces are embedded inside this file, so loading the page
contacts nobody but the host. That's deliberate: a German court ruled
in January 2022 (LG München I, 3 O 17493/20) that loading fonts from
Google's servers hands each visitor's IP address to Google without
consent — and that self-hosting was always the reasonable alternative.
So we self-host. View source and count the outside requests yourself.
Third parties, one by one
Every company that touches your data through this site, what they see,
why we chose them, and what happens if they stop deserving it. Rows
get written before the feature ships, never after.
Who
What they see
Their policy
Why them
If they turn bad
The host: Neocities
Per their policy: your IP address, browser, device type,
operating system, and the site you came from. How long they keep
it isn't stated. Their policy also reserves the right to use and
resell “non-personal,” aggregated information. It's
written for their own website and doesn't say whether it covers
visits to sites they host; we assume it does. We don't add to any
of it. What we see is a daily total for the whole site: hits,
page views and bandwidth. No addresses, no pages, no visitors.
Independent, and funded by paying members rather than
advertising. It promises never to put ads on hosted sites or
sell personal data, adds no scripts of its own, and uploads by
drag and drop. Codeberg was our first choice; its new policy on
projects written with heavy AI help sent us here while we ask
whether this site fits.
The site is one file. It moves to a new host in an afternoon and
you never notice.
Payments: Patreon (ACT only)
Nothing unless you click through. The ACT pages link to a
Patreon page; if you pledge, Patreon handles the payment and
we see your Patreon name, pledge level and whatever you put in
your profile. No card details reach us.
It's where the ACT supporters already are. It's a link, not an
embed, so a visit to this site tells Patreon nothing.
Supporters can be pointed anywhere else with one edit; a
donation-first option (Liberapay or similar) is being weighed.
Email: Proton
Only if you write to us. The support address is a Proton Pass
alias that forwards to one Proton inbox. Proton stores mail
encrypted; mail sent from outside Proton travels as ordinary
email on the way there, readable by the servers it passes
through, as all email is.
Majority-owned by a nonprofit foundation, funded by
subscriptions rather than ads, and the alias means our personal
address never appears here.
The alias can point anywhere. When the site moves to its own
domain, the address changes once and this row gets updated.
Booking / calendar not chosen
Nothing yet — booking is a plain email.
link when chosen
self-hostable preferred
exit path written before launch
Newsletter: plain email (ACT)
Only if you subscribe, by sending an email to the support
address. Your address sits in that Proton inbox and goes out
in the BCC line — no mailing-list company, no open or
click tracking. Reply "unsubscribe" and it's removed.
See the Email: Proton row.
The ACT newsletter used to run through a form service that
logs visitors; this replaced it.
Nothing to export but a list of addresses, which only we hold.
The tools this site recommends (Bitwarden, Signal, Proton and
the rest) are not parties to this page — they never see you through
us. Their trust costs are printed on the
Tools page, next to each one.
In-person sessions
If you book a session, your intake sheet stays in your hands. We keep
a one-line record — name, date, tier, check-in date — and nothing
else, as the Terms and Conditions say.
What isn't written yet
The Support page is still being built. Before any of the following
goes live, its row in the table above gets filled in and a section
added here — the policy moves before the feature does:
referrals how the referral rate works
without us keeping a list of who referred whom.
Changes
This page is the whole policy; there is no longer version elsewhere.
It carries a date at the top, and every page is a single file — view
source and check for yourself. If something here stops being true, that's a
bug: report it through Support and it gets fixed or the feature gets
pulled.