Reference · every term used on the other pages

Glossary

Plain definitions for everything the other pages assume you know; each entry says which pages use it. One line of what it is, one of why it's on this site, one example. Cross-links look like [[this]].

BLUF

If a word on another page stopped you, it's here. If it isn't, that's a bug; send it to Support.

Prices, free-plan limits and feature claims on this page were checked October 2026. They drift; if one looks off, send a correction.

GroupTenets and framing

The words the whole site is organized around. Get these and the rest is detail.

SecurityTenet: How hard it is for someone to attack or impersonate you. About locks, not secrets.A passkey on your email raises security without changing what anyone knows about you.
PrivacyTenet: How little is known about you, and by how few parties. About secrets, not locks.An email alias per site means no one party can join your accounts together.
AutonomyTenet: Whether you hold the keys: can any single provider lock you out, or lock you in?Email on your own domain survives leaving the provider.
Trust costTools: What a vendor ends up holding about you as the price of using it. Named next to every service on the site. Not a judgment of whether the vendor is trustworthy.A removal service has a high trust cost: it needs your full identifier set to work.
Friction (between tenets)Why not all three: A case where raising one tenet lowers another. The three big ones: verification needs to know you; privacy tools centralize trust; self-hosted means self-defended.
Threat modelWhen things break: An honest list of who or what you're actually defending against, ranked by likelihood. Everything else on the site is cheaper once you have one."Outage and lockout are likely; targeted surveillance is not" is a threat model.
The FloorBuild the Floor: The baseline everyone gets regardless of threat model: password manager, second factors on the accounts that matter, a locked and updating phone, one encrypted backup. Named for what it is: the level below which nothing else holds.
BLUFbottom line up frontEvery page: The conclusion, first, in a box. Military writing convention. If you read only the BLUF you should still be able to act.
Effort / payoffChecklist: The two 1–3 ratings on the full checklist. Effort: 1 is minutes, 3 is an afternoon or a standing habit. Payoff: 3 closes a leak that feeds many others.

GroupIdentity and access

The things that have to be really you, and how they get taken.

2FA / MFAtwo-factor · multi-factor authenticationChecklist · Tools: A second proof besides the password: a code, an app prompt, a key. Ranked weakest to strongest: SMS code, authenticator app, passkey or hardware key.A six-digit code from an app on your phone.
Two-step login2-Step Verification · two-step verification · two-factor authenticationStep by step · Build the Floor: The same idea as 2FA, under whatever name each company picked. Google and Amazon say "2-Step Verification," Microsoft says "two-step verification," Apple and Proton say "two-factor authentication," Bitwarden says "two-step login," and banks often say "security code" or "verification code." Whatever the label, look for the same three things in the settings: which second factor it uses (pick an authenticator app, passkey or hardware key over SMS when offered), where the recovery codes are, and whether SMS stays on as a backup. If SMS stays on, a SIM swap can still get in, so turn it off once another method works.Google: myaccount.google.com → Security → 2-Step Verification. Bitwarden: Settings → Security → Two-step login. New Apple Accounts have it on from the start.
Authenticator appTOTP · six-digit codesBuild the Floor · Step by step: An app that shows a new six-digit code every 30 seconds for each account you add. The code comes from a secret shared once, by scanning a QR code, so nothing is sent at login. Keep it in a separate app from your password manager.Ente Auth, Aegis, 2FAS, Proton Authenticator.
PasskeyWeigh it · Tools: A login that lives on your device and proves itself with cryptography instead of a typed secret. Nothing to phish, nothing to reuse. Backed up through your platform account or a hardware key.Signing in to Google with your phone's fingerprint prompt and no password.
Hardware keyYubiKey · security key · FIDO2Weigh it · When things break: A small USB/NFC device that holds passkeys and answers login challenges. Buy two; one is a single point of failure.
Password managervaultChecklist · Tools: An encrypted store of unique passwords, so a breach at one site opens one door. Should be exportable in a standard format (see exportable).Bitwarden, Proton Pass, KeePassXC, 1Password.
Vault timeoutauto-lock · session timeout · lock vs log outStep by step: How long a password manager stays open after you stop using it, and what it does when the time runs out. There are two choices. Lock keeps the encrypted vault on the device and asks for your master password, a PIN or your face or fingerprint to open it again; it works offline. Log out deletes the local copy, so getting back in needs the master password, your second factor and an internet connection. Lock is right for your own phone and laptop; log out is right for a shared or borrowed computer. Shorter is safer: a few minutes on a phone with biometric unlock, and "on browser restart" or "on system lock" on a computer. Each app and browser extension has its own setting, so set every one.Bitwarden: Settings → Vault timeout (some versions say "Session timeout"). 1Password and Proton Pass call it Auto-lock.
Master password re-promptre-promptStep by step: A per-item switch in Bitwarden that asks for your master password again before it shows or edits that one item, even while the vault is open. On a computer it guards viewing and editing; on a phone it guards hidden fields (passwords, card numbers) and editing. Bitwarden's documentation says it accepts only the typed master password, not a PIN or face/fingerprint. Use it on the few logins that unlock everything else: your main email, bank, phone carrier, Apple or Google account. It is a guard in the app's screens, not extra encryption, so a short vault timeout is still the real lock. Other managers don't all have it; 1Password, for one, has no per-item version.
URI matchmatch detection · website fieldStep by step: How a password manager decides which saved login belongs to the page you're on. Each login stores the site address (the URI); the manager offers to fill only when the page matches it. That makes it a phishing alarm: on a fake page like g00gle-login.com, your manager offers nothing. If you're sure you're on the right site and the fill doesn't appear, stop and check the address bar before you type anything by hand. Bitwarden lets you change the matching rule per login: Base domain (the default; any page on google.com), Host, Starts with, Exact, Regular expression, or Never. Leave the default unless a site breaks it.Saved address accounts.google.com, default rule: fills on mail.google.com too; never on google.com.evil.example.
Secure notenote itemStep by step: An item in a password manager that holds plain text instead of a login: Wi-Fi passwords, the PIN for a door code, a software licence, account numbers, answers you gave to security questions. It's encrypted like everything else in the vault and travels with it when you export. Two things never belong in it: the master password for that same vault, and that vault's own recovery codes, because both are what you'd need if you couldn't open the vault. Those go on paper in the go-binder.Bitwarden and 1Password call it "Secure note"; Proton Pass calls it "Note."
Biometric unlockFace ID · Touch ID · fingerprint unlockBuild the Floor · Step by step: Opening a phone, laptop or app with your face or fingerprint instead of typing. The face or fingerprint data stays on the device's security chip; it isn't sent to the company. It's a shortcut, not a replacement: your passcode or master password is still the real key, and the device asks for it after a restart and after a few failed tries. That's why a strong passcode still matters even if you rarely type it. Where it falls short is being made to unlock. Anyone holding you, or holding the phone up to you while you sleep, can use your face or finger; nobody can make you remember a passcode. US courts are split on whether police can force a biometric unlock: the federal appeals court for D.C. ruled against a forced thumbprint unlock in 2025 (United States v. Brown), the Ninth Circuit allowed one in 2024 (United States v. Payne), and as far as we know the Supreme Court hasn't settled it. A passcode has generally had stronger protection. So: keep biometrics on day to day, learn the off switch below, and if someone you live with is the danger, turn them off. That's different from handing your biometrics to a company; see biometric collection.iPhone: hold the side button and either volume button until the power-off slider shows, then cancel; the passcode is now required. On most Android phones, the "Lockdown" option in the power menu does the same.
Biometric collectionface scans · palm pay · voiceprintChecklist: A company or agency recording your face, fingerprints, palm, eyes or voice and keeping it on their own systems: airport face scans, express-lane memberships, palm-scan payment, bank voiceprints, face scans for age or ID checks, employer time clocks. This is the case to avoid. A password can be changed after a breach; your face can't. The records can also be shared with partners, sold with the company, or handed over under a subpoena. A few US states (Illinois, Texas, Washington) have biometric privacy laws, and Illinois lets people sue over violations; most states have none. When there's another option, take it, and when there isn't, ask how long they keep the data and who they share it with. This is not the same as biometric unlock on your own phone, where the data stays on the device.US travelers can usually ask for a manual ID check instead of the TSA face photo; the officer will look at your ID instead.
PassphraseBuild the Floor · Step by step: A password made of several random words. Four or five words picked by dice are stronger than eight random characters and far easier to remember. The words must be chosen by chance, not by you. Use one for the few things you type from memory, like your vault.EFF dice method: five dice per word, looked up on their long wordlist.
DicewareEFF wordlist · dice passphraseStep by step: The dice method for making a passphrase. Roll five dice (or one die five times), read the numbers in order, say 4-1-3-6-2, and look up the word next to 41362 on a wordlist. Repeat for each word. The EFF long wordlist has 7,776 words, one for every five-dice combination, so every word adds the same known amount of guessing: about 12.9 bits. Five words is about 65 bits; six is about 77. Dice matter because people are bad at choosing at random; we pick words that mean something to us, and attackers know the patterns. Don't edit the result into something you like better. A password manager's passphrase generator does the same job with a computer's randomness; Bitwarden's uses the EFF long list.eff.org/dice has the lists. The short lists use four dice per word and are easier to type but need more words.
Go-binderWhen things break · Household: One folder or zip bag with the paper you'd need in the first days after something goes wrong: recovery codes, copies of ID, key account numbers, contact list, the PACE plan. Kept where you can grab it, and one other person knows where it is.
Emergency Accesstrusted emergency contactHousehold: Bitwarden's way to let a person you trust into your vault if you can't get in yourself, or can't be asked. You invite them and pick a waiting period. If they ever request access, you get an email and can refuse during the wait; if you don't answer, access opens when it ends. "View" lets them read your items; "Takeover" lets them set a new master password and use the account. The person granting it needs Premium or a Families plan; the person receiving it can be on the free plan. Other managers handle this differently: 1Password relies on a printed Emergency Kit or a family organizer, KeePassXC on whoever has your file and password. Apple and Google have their own versions for their accounts: Legacy Contact and Inactive Account Manager.
Legacy ContactApple digital legacyHousehold: Apple's way to pass your iCloud data to someone after you die. You name one or more people and give each an access key, a printed sheet or a message. After your death they ask Apple for access with that key and a death certificate. They get photos, messages, notes, files and device backups. They don't get iCloud Keychain (your saved passwords, passkeys and payment cards) or anything you bought, so pair it with Emergency Access or similar for your passwords. Any one Legacy Contact can delete the account. It's different from a Recovery Contact, who helps you get back into your own account while you're alive and never sees your data.Settings → [your name] → Sign-In & Security → Legacy Contact.
Inactive Account ManagerGoogle digital legacyHousehold: Google's version of a will for your Google account. You choose how long the account must sit unused before it acts (3, 6, 12 or 18 months), up to 10 people to notify, and which data each of them may download: Gmail, Drive, Photos and so on. Each person needs a phone number on file so Google can check it's them. Before anything happens, Google tries to reach you by text and email. You can also have it delete the account at the end. Unlike Apple's Legacy Contact, it acts on silence, not proof of death, so it also covers someone who's alive but can't sign in.myaccount.google.com/inactive
Recovery codesWhen things break: One-time codes a service gives you when you turn on 2FA, for getting in when the second factor is gone. Print them; keep them apart from the thing they unlock.
SIM swapWeigh it · When things break: An attacker convinces your carrier to move your number to their SIM, then receives your SMS codes and password resets. The reason a phone number shouldn't be the only recovery path for anything.
Port-out PINnumber transfer PIN · account PINWeigh it: A PIN your carrier requires before moving your number anywhere. The cheapest defense against a SIM swap. Set it in the carrier app.
SIM PINSIM lockWhen things break: A code the SIM card, or eSIM, asks for every time the phone restarts. It's not your screen-lock passcode and not your carrier's port-out PIN. It stops someone who takes your physical SIM card from putting it in another phone and receiving your calls and texts. It does nothing against a SIM swap, which happens at the carrier. Every SIM ships with a carrier default; look it up on your carrier's site instead of guessing. A few wrong tries locks the SIM and you'll need the carrier's PUK code to unlock it; enough wrong PUK tries and you need a new SIM. Write your new PIN down in the go-binder before you set it.iPhone: Settings → Cellular → SIM PIN. Android: search settings for "SIM lock."
eSIMembedded SIMWhen things break: A SIM built into the phone instead of a plastic card. Your carrier loads your number onto it over the internet, often with a QR code or in the carrier's app. There's no card for a thief to pull out, but the carrier can still move your number to a different phone, so a SIM swap works the same way; your port-out PIN is still the defense. Moving an eSIM to a new phone usually needs the old phone or a carrier check, so plan it before you trade in the old one. A SIM PIN works on eSIMs too.
Credit freezeChecklist: An instruction to a credit bureau to refuse new-account checks in your name until you lift it. Free, reversible in minutes, done at each bureau's own site. Three big bureaus plus the smaller ones (ChexSystems, Innovis, NCTUE) for bank, phone and utility accounts.
IRS IP PINidentity protection PINWeigh it: A six-digit number the IRS issues you each year; a return without it is rejected. Stops someone filing in your name. Free at irs.gov.
Identity verificationKYC · know-your-customerTools · Why not all three: A service confirming who you are with ID, a selfie, or a bank link before it will serve you. Required by law for anything touching money; the clearest example of security costing privacy.privacy.com asks for it before issuing virtual cards.
Email aliasmasked email · relay addressChecklist · Tools: A disposable address that forwards to your real one. One per site; when one starts getting spam you know who leaked it and delete just that alias.Proton/SimpleLogin, addy.io, Firefox Relay, Apple Hide My Email.
Plus-addressingsubaddressing · plus addressTools: Adding +anything before the @ in your own address: yourname+store@proton.me still arrives at yourname@proton.me. Free and unlimited, nothing to set up, and you can filter or trace mail by the part after the plus. Gmail, Outlook, Proton and Fastmail all support it. Two limits: your real address is right there for anyone to strip out, and some sign-up forms refuse the + sign. Good for telling who sold your address; no good for hiding it. For that, use a real alias.
Alias prefixTools · Step by step: The part of an email alias before the @ that you choose. Some services add a random part after it, so a Proton Pass alias looks like prefix.random@passinbox.com. Everyone who gets mail from that alias sees the prefix, so keep it to the site's name or something neutral, never your own name, and check it before saving: Proton Pass fills it in from the item's title. With addy.io's username-style aliases, anything@yourname.anonaddy.com, the username is shared by all your aliases, which ties them together; use its random or shared-domain aliases when that matters.shop-codeberg.k3x9@passinbox.com tells you the leak came from Codeberg; jane-smith.k3x9@ tells everyone your name.
Virtual card numberWeigh it · Tools: A card number generated for one merchant, with its own cap and a pause button. A breach there exposes a number that only works there.privacy.com, or the feature inside many banks' own apps.
Second numberVoIP number · burner (loosely)Checklist · Tools: A phone number that isn't tied to your SIM, used for forms, stores and deliveries. See VoIP.Google Voice, MySudo.
Custom domainyour own domainWeigh it · Tools · When things break: A domain name you register (you@yourname.org) and point at whichever mail host you like. The address stops belonging to a provider. Renew it or lose it.

GroupExposure and brokers

Where the data about you comes from, who sells it, and the legal handles for pulling it back.

Data brokerChecklist · Tools: A company that buys, merges and resells records about people it has no relationship with. Wholesalers feed the retail sites.Acxiom, Epsilon, LexisNexis, Oracle (wholesale); Spokeo, Whitepages (retail).
People-search siteChecklist: A retail broker that publishes a profile page per person: addresses, relatives, phone numbers. Searching your own name on one is how you find the old details you forgot.Whitepages, Spokeo, BeenVerified, Radaris.
Opt-outChecklist · Tools: A broker's form for removing your listing. Each site has its own; they repopulate, so it's a recurring chore, not a one-time fix.
Removal serviceChecklist · Tools: A subscription that files and re-files opt-outs for you. Needs your identifiers (names, addresses, numbers), never your logins.EasyOptOuts (~$20/yr), DeleteMe, Optery, Incogni.
Data sheetChecklist: The form a removal service uses to search for you: name variants, date of birth, every address, every number and email. More complete means more found.
Breachdata breach · leakChecklist · When things break: A company's copy of your data getting out. The usual origin of spam and of passwords being tried elsewhere.
Have I Been PwnedHIBPChecklist · Tools: A free site that tells you which breaches an email or phone number appears in, and alerts you to new ones.
Credential stuffingimplied throughout: Taking a leaked email+password pair and trying it on hundreds of other sites automatically. Works because people reuse passwords. Defeated by a password manager.
DoxxingWhy not all three: Publishing someone's private details, usually home address, to enable harassment. Assembled largely from people-search sites.
Trackertracking pixel · third-party cookieWeigh it · Support: A hidden request a page or email makes to a third party so that party can log that you were there. Blocked by content blockers and filtering DNS.
Advertising IDIDFA · AAIDWeigh it: A per-device number apps use to recognize you across apps. Resettable or deletable in the phone's privacy settings.
ACRautomatic content recognitionWeigh it: A smart TV watching what's on its own screen and reporting it. One buried toggle per brand.
CCPA / CPRACalifornia Consumer Privacy ActChecklist: California law giving residents the right to know, delete and opt out of sale of their data. The reason many opt-out forms exist at all.
Delete Act / DROPChecklist · Weigh it: California's follow-on law and its one-request-deletes-everywhere mechanism for registered brokers. Available to California residents now; brokers have had to process requests since August 1, 2026.
Do Not Call registryChecklist: The federal list legitimate telemarketers must honor. Robocallers ignore it; register anyway, it's two minutes.
RobocallChecklist: An automated call, usually from a spoofed number. Carrier filters and "silence unknown callers" drop them; the registry doesn't.
7726SPAMChecklist: The number to forward spam texts to. Trains the carrier's filter. Never reply "STOP" to a text you don't recognize; it confirms your number is live.

GroupEncryption

The words that decide whether a provider can't read your data or merely promises not to.

EncryptionWeigh it · When things break: Scrambling data so only holders of a key can read it. The question is always: who holds the key?
End-to-end encryptionE2EE · E2ETools: Only the sender and the recipient hold the keys. The service in the middle carries ciphertext it cannot read, even if compelled. Contrast in transit and at rest.Signal. WhatsApp's messages (but not its metadata).
Encrypted in transitTLS · HTTPS · the padlock: Scrambled between you and the server, readable by the server. Every website has this. It is not E2EE.
Encrypted at rest: Scrambled on the provider's disks, with the provider holding the key. Protects against a stolen hard drive, not against the provider. Every big cloud has this. Also not E2EE.
Zero-knowledgezero-access: Marketing term for a service that stores your data E2E-encrypted with a key derived from your password, so it cannot read it or reset it for you. Lose the password, lose the data; that's the point.Bitwarden's vault, Proton Drive.
Metadata: Everything about a message except its contents: who, to whom, when, how often, from where. Usually not covered by E2EE, and often more revealing than the contents.Signal keeps almost none; most others keep all of it.
Forward secrecy: Keys that change per message or session, so a key stolen later can't decrypt what was recorded earlier. Signal has it; PGP email does not.
Full-disk encryptionFDE · LUKS · FileVault · BitLockerWeigh it · When things break: The whole drive scrambled, unlocked at boot. A stolen laptop becomes a lost laptop. LUKS on Linux, FileVault on Mac, BitLocker on Windows; phones default on. For an external drive on any OS, VeraCrypt.
PGP / OpenPGP: The old standard for encrypting email. Works, but subject lines and metadata stay in the clear, no forward secrecy, and both sides have to set it up. Proton and Tuta hide the setup between their own users.
Key (cryptographic): The secret that unlocks encrypted data. Public key: shareable, used to lock. Private key: yours, used to unlock. "Hold your own keys" on this site means the private key never leaves devices you control.
Key-derivation functionKDF · Argon2id · PBKDF2Step by step: The deliberately slow math that turns your passphrase into the real encryption key. Slow on purpose: every guess an attacker makes costs the same time. Argon2id also costs memory, which makes guessing on graphics cards much more expensive.Bitwarden: Settings → Security → Keys → Argon2id.
Caveats to E2EE: Encryption ends at the endpoint. A compromised phone, a cloud backup of chats, or a screenshot defeats it. Check whether backups are encrypted too.WhatsApp chat backups to iCloud/Google Drive are unencrypted unless you turn on encrypted backups.

GroupNetwork

The home network you own, and the pieces of it named on the Scorecard and Crumbling pages.

DNSdomain name system: The lookup that turns a name (example.org) into an address. Whoever answers your DNS sees every site you visit, which is why picking the resolver matters.
Filtering DNSfiltering resolverWeigh it · Tools: A DNS resolver that refuses to answer for known malware and tracker domains. Set on the router, every device inherits it.Quad9, NextDNS, a Pi-hole at home.
Router (yours vs the ISP's)Weigh it · When things break: The box between your network and the internet. The ISP's is theirs, updated on their schedule; one you own can run your DNS, VPN and local services and stays when the contract ends.
WPSWi-Fi Protected Setup: The push-button pairing feature on routers. Known-weak; turn it off.
WPA2 / WPA3: Wi-Fi encryption generations. WPA3 where all devices support it; WPA2-AES otherwise; never the older ones.
Network segmentationguest network · VLANWhen things break: Putting untrusted devices (TV, smart plugs, guests) on their own network so they can't see the laptop. Most routers call the simple version "guest network."
VPN: A tunnel that moves your traffic's exit point to a server elsewhere. Hides your address from sites and your traffic from the local network; the VPN provider sees everything instead. A trust cost transfer, not a privacy multiplier.
IoTInternet of Things · smart devices: Anything with a chip and a Wi-Fi radio that isn't a computer. Rarely updated, often chatty. Segment it.
Amazon SidewalkWeigh it: Amazon devices sharing a slice of your internet with neighbors' Amazon devices, on by default. One toggle in the Alexa app.
Local loggingWhen things break: Your router or resolver keeping a record of what's on your network and what it talked to, readable by you. Knowing a normal day makes an abnormal one visible.

GroupCommunications

Terms shared with the ACT site. Defined here at the depth this site needs; ACT goes further.

PACE planPrimary · Alternate · Contingency · EmergencyWhen things break: Four ordered ways to reach the same people, written down and rehearsed. Only useful if everyone is fluent in every tier, not just the first.Phone → Signal over Wi-Fi → GMRS handheld → meet at the corner at 6.
VoIPvoice over IP: A phone number that lives on the internet instead of a SIM. Works anywhere you have data; the basis of a second number.
Mesh networkWhen things break: Devices relaying for each other with no central tower. Each node extends the reach of every other. See ACT for the full treatment.
LoRa / MeshtasticWhen things break: Low-power long-range radio, and the open firmware that turns cheap boards into a text-message mesh. No subscription, no license, miles of range with a clear line of sight.
FRS / GMRS: Consumer walkie-talkie bands. FRS needs no license; GMRS needs a cheap no-test license and allows more power and repeaters. The block-level tier of a PACE plan.
Amateur radioham: Licensed hobby radio with real range. A Technician license is one exam. Only worth it if you'll practice.
Offline messagingWhen things break: Phone-to-phone messaging over local Wi-Fi or Bluetooth when there's no tower. Signal can't do this; Briar (Android) can — in maintenance mode since July 2026, still safe. No iOS equivalent we'd vouch for.
Caller ID spoofing: Faking the number a call appears to come from. Why "it was my bank's number" proves nothing. Carriers now sign calls (STIR/SHAKEN) to flag the fakes; it's imperfect.

GroupSoftware and autonomy

The properties that decide whether a tool is yours or rented.

Local-firstWhen things break: Software that works fully without a server and syncs when one is available. Test: turn off the internet; if it shows a spinner, it isn't local-first.Obsidian, KeePassXC, most desktop apps from before 2010.
Open sourceFOSS: The code is public. Doesn't guarantee quality; does guarantee someone can check it and that it can outlive the company.
ExportableTools: Your data comes out in a standard format you can take elsewhere. The minimum bar for autonomy in a tool you don't host.Bitwarden exports JSON/CSV; Signal exports a backup file; a proprietary notes app that only exports PDF doesn't count.
Self-hosting: Running the service yourself on hardware you control. Maximum autonomy, and you become the security team. The Trifecta's third edge.Vaultwarden (Bitwarden-compatible), Nextcloud, a Pi-hole.
Local modellocal LLM · on-device AIChecklist · Tools: A language model running on your own machine. Nothing you type leaves it. Slower and smaller than the cloud ones; the trade is the point.LM Studio, Ollama.
Temporary chatincognito modeChecklist: A cloud chatbot mode that promises not to keep or train on the conversation. Better than nothing; a local model is the version you don't have to trust.
Training opt-outChecklist · Weigh it: The setting that stops a chatbot using your conversations to train future models. Stops future use only; changes location and default often.
Content blockerad blockerWeigh it: A browser extension that refuses requests to known ad and tracker domains before they load.uBlock Origin on Firefox; Brave's built-in shields.
3-2-1 backupWhen things break: Three copies, on two kinds of media, one off-site. The copy people skip is the one that's unplugged.
Data exportGoogle Takeout and equivalentsWeigh it · When things break: The big platforms' "download everything" feature. Schedule it; a copy you hold is the one a lockout can't take.
Offline referenceKiwix · CoMaps · OsmAndWhen things break: Wikipedia, medical references and maps downloaded whole to a device, usable with no connection.
justdeleteme.xyz: A directory of direct links to the account-deletion page of most services, rated by how hard they make it.

GroupPower

Five terms from When things break, because "how long will it run" needs units.

Watt-hourWh: Energy. A device drawing 10 W for 1 hour uses 10 Wh. The unit that lets you divide a battery by a device.A router+modem at ~10 W runs ~25 hours on a 250 Wh station.
mAh: How power banks are labeled. Multiply by 3.7 V and divide by 1000 for Wh, then take off ~30% for conversion losses.20,000 mAh ≈ 74 Wh nominal, ~50 Wh usable.
UPSuninterruptible power supply: A battery that sits between the wall and a device and takes over the instant the wall stops. Put one on the modem and router.
LiFePO₄lithium iron phosphate: The battery chemistry for anything that sits charged for months: safer, thousands of cycles, doesn't mind being left full.
USB-C PDpower delivery: The USB standard that carries enough power for laptops. One cable type and one charger for everything you'd run off a station.

GroupThreats, named plainly

"Who are you hiding from" needs a vocabulary. These are the adversaries this site plans for, and the two it doesn't.

Commercial surveillanceHome: Advertisers, platforms and brokers logging what you do in order to sell access to you. The default adversary for nearly everyone; not malicious, just relentless.The ad for the thing you only talked about. No, your phone isn't listening; the tracking is simply good enough that it doesn't need to. That should worry you more.
Account takeoverATO: Someone else getting into your email, bank or Apple/Google account, usually with a reused password from a breach or a SIM swap. The second adversary. Email is the prize because it resets everything else.
Device loss and theft: The phone left in the cab, the laptop taken from the car. The third adversary. Answered by full-disk encryption, a lock screen, and Find My; not by anything clever.
Phishing: A message that impersonates a service to get you to type a password or code into the wrong page. The common route to takeover. Passkeys can't be phished because there's nothing to type.
Single point of failureChecklist: One thing that, if it goes, takes everything with it. Passwords in a document are the classic: one breach, every account. One hardware key with no backup is another.
Public Wi-Fi: A network you don't control. Mostly safe now that sites use HTTPS; the residual risk is the network operator seeing which sites, and fake hotspots. The one place a VPN earns its keep at this tier; Tor Browser does the same job for free with no account, at the cost of speed.
Nation-state / targeted surveillance: Governments and professionals aiming at you specifically. Out of scope here. If this is your threat model, you need a person, not a website; see Terms and Conditions for who to ask instead. The tool that tier starts with is Tor Browser.
Opsec cosplay: Adopting spy-grade habits against a threat you don't have. Costs convenience, adds nothing, and usually gets abandoned, taking the useful habits with it. The site's phrase for over-correcting.

GroupYour stack: Apple, Google, carrier, VPN

Most readers arrive with an iPhone, a Mac, a Gmail address and a VPN they installed once. These are the settings and words that matter for that setup. Position: tune Apple, migrate off Google, simplify the VPN.

Advanced Data ProtectionADP · iCloud end-to-end encryption: The switch that makes iCloud backups, photos, notes and iMessage backups E2EE, so Apple can't read or hand them over. Off by default. Turn it on, and print the recovery key it gives you. Caveat: mail, contacts and calendar stay readable by Apple.
Recovery key / recovery contactApple ID · Google account: Apple: a 28-character key or a trusted person who can vouch for you when you're locked out. Google: backup codes and a recovery phone/email. Set them before you need them; they go in the binder with the recovery codes.
iCloud Private Relay: Apple's built-in two-hop proxy for Safari traffic on paid iCloud plans. Hides your address from sites and the sites from Apple. Not a VPN; only covers Safari and some app traffic.
Hide My Email: Apple's alias service, built into iOS and Safari on paid iCloud. Fine as the alias tool if you're staying in Apple's world; aliases don't leave with you if you don't.
iMessage: E2EE between Apple devices; green-bubble SMS is not. Keep it. Its weak spot is the backup, fixed by ADP. Add Signal for the lane where you'd rather Apple didn't have the metadata.
Signal username: A handle so people can reach you on Signal without your phone number. Set it in Signal's profile settings; then turn off "find me by number."
Registration LockSignal PINBuild the Floor: A Signal setting that stops anyone from registering your phone number on another device without your Signal PIN. It matters because Signal accounts are tied to a phone number: without it, someone who gets your number through a SIM swap could take over your Signal and receive new messages. With it, they also need the PIN. It's Signal's version of two-step login. The catch: Signal can't reset the PIN. If you forget it, you're locked out of registering again until the account has been inactive for 7 days, and you lose your old settings. Write the PIN down in the go-binder; the regular reminders are there to keep it fresh.Signal → Settings → Account → Registration Lock.
Find My / Activation Lock: Locate, lock or wipe a lost Apple device; Activation Lock makes a stolen one unusable without your account. Turn on and leave on.
Stolen Device ProtectionAndroid: Theft protection · Identity CheckBuild the Floor: An iPhone setting (iOS 17.3 and later) for the thief who watched you type your passcode and then grabbed the phone. Away from places the phone knows as home or work, it requires Face ID or Touch ID, with no passcode fallback, to see saved passwords, erase the phone, turn off Lost Mode or set up an eSIM. Changing your Apple Account password, turning off Find My or changing Face ID adds a one-hour wait, then a second Face ID check. You can choose to have the delay apply everywhere. Turn it on before you need it; it can't be turned on remotely after the phone is gone. Android's version is called Theft protection: Theft Detection Lock, Remote Lock, and Identity Check on Android 15 and later.iPhone: Settings → Face ID & Passcode → Stolen Device Protection. Android: Settings → Google → All services → Theft protection.
Lockdown Mode: Apple's setting for people targeted by professional spyware. It breaks things on purpose. Not for this tier; listed so you know what it is when you see it.
Photo metadataEXIF · location tags: Where and when a photo was taken, embedded in the file. Apple and most messengers strip it on share; a raw file sent by email or uploaded to a marketplace usually doesn't. Turn off location in the share sheet when it matters.
Migrating off Googlede-Googling (partial): Moving email, calendar and documents away from the ad company. The single highest-value move for this stack, done in stages: new address first, forward the old one, move contacts and calendar, then let the old inbox go quiet. Nothing has to be deleted on day one.
Forwarding and import: Gmail can forward everything to the new address and the new provider can import the old archive over IMAP. The two settings that make a migration reversible.
Brave: A Chrome-compatible browser with blocking built in. The easy default for someone leaving Chrome; everything still works. Turn off its crypto and rewards features in settings.
Link cleaner / UTM parameters: The junk after the ? in a shared link (utm_source=…) that tells the site who sent whom. A link cleaner strips it. A concept worth knowing; not a tool most people need.
No-logs policy: A VPN's claim that it doesn't record what you did through it. Unverifiable by you; the next-best evidence is a third-party audit and a track record with subpoenas.
Audit (third-party): An outside firm examining a product's code or infrastructure and publishing what it found. Not proof of safety; better than the company's word.
VPN exit countryserver location: Where your traffic appears to come from. Irrelevant for the threats on this site; a distant exit just means more captchas and slower streaming. Pick the nearest fast one.
Five / Nine / Fourteen Eyes: Intelligence-sharing agreements between countries. Comes up in VPN marketing. Matters only if governments are your adversary; see nation-state.
Jurisdiction: Whose laws a company answers to. Encryption limits what can be handed over; jurisdiction decides whether it must be. A provider in a good jurisdiction with E2EE has little to hand over; that's the combination to look for.
Provider longevity"what if they fold?": Judge by four things: how they make money (subscriptions beat ads and venture funding), who controls them (a foundation or the founders beat an acquirer), where they are (jurisdiction), and whether you can leave with your data (exportable, your own domain). Portability is the answer to the question; reassurance isn't.
CPNI opt-out: Customer Proprietary Network Information: your carrier's record of your calls and usage, which it may use for marketing unless you opt out. A form on every carrier's site.
Carrier choice: The big carriers have all been breached. Switch on price and coverage; the privacy move is the same either way: port-out PIN and CPNI opt-out.
Number porting: Moving your phone number between carriers, or to a VoIP service. The legitimate version of what a SIM swap abuses.
Minimal phoneflip phone · dumb phone: A phone that does less on purpose. Good instinct; check what the maker's cloud sees before moving your number onto one. A second SIM or a second number is the low-commitment version.

GroupEmail plumbing

Email is a mailbox on a street served by a post office. The mailbox is your inbox, the street is your domain, the post office is the provider. Once that's clear, the acronyms are just parts.

Domainthe street: The part after the @. If it's gmail.com the street belongs to Google. If it's yours (see custom domain), you can move the mailbox to any post office and the address never changes.
Registrar: Where you rent a domain, yearly. Renew it or someone else can. Turn on auto-renew and use an address that isn't on the domain itself for the account.
MX recordmail exchanger: The record in your domain's settings that says which post office handles its mail. Changing providers means re-pointing it, plus the few sender-verification records (SPF, DKIM, DMARC) the new host lists; senders never notice.
SMTP: The protocol that carries mail between post offices. Sending.
IMAP: The protocol a mail app uses to read your mailbox. Also how an old archive gets imported into a new provider.
Providerthe post office: Who stores and delivers the mail. Judge by longevity and whether it can read what it stores (E2EE or not).
Archive (email): The old mail you want to keep after leaving a provider. Import it into the new one, or export it as a file (mbox) to the unplugged drive. A place to put archives is one of the quiet reasons to have a paid mailbox.
Real-name address: you@yourdomain with your actual name. Fine: that address's job is identity, not anonymity. Anonymity is the aliases' job.

~*~

ReferenceEnd-to-end encrypted tooling

One tool per job where E2EE is available and real, with the caveat that matters. Meters show the tenet lean; every row is exportable unless noted. Not endorsements; starting points.

MessagingSignal: E2EE by default, near-zero metadata, open source, forward secrecy. Needs a phone number to register (usernames hide it from contacts). Caveat: encryption ends at the phone; lock the phone. Security Privacy Autonomy
Messaging, no phone numberSimpleX · Matrix/Element: SimpleX has no identifiers at all. Matrix is federated (pick or run a server) and E2EE in private rooms. Caveat: Matrix metadata lives on the homeserver; smaller networks mean fewer of your people are on them. Security Privacy Autonomy
The one everyone hasWhatsApp: Messages are E2EE (Signal protocol). Caveat: Meta keeps the metadata, and chat backups are unencrypted unless you turn encrypted backups on. Fine for the PACE tier where the whole family is already on it. Security Privacy Autonomy
EmailProton Mail · Tuta: E2EE between users of the same service; PGP to outsiders (Proton). Supports a custom domain. Caveat: mail to Gmail users is readable by Google at their end; subject lines aren't encrypted under PGP. Security Privacy Autonomy
PasswordsBitwarden · KeePassXC: Bitwarden: zero-knowledge cloud vault, open source, self-hostable as Vaultwarden. KeePassXC: a local encrypted file you sync however you like. Caveat: forget the master password and no one can help. Security Privacy Autonomy
Files in the cloudCryptomator · Proton Drive: Cryptomator encrypts a folder on your machine so any cloud (Drive, Dropbox, iCloud) only ever sees ciphertext. Proton Drive is E2EE natively. Caveat: encrypted files can't be previewed or searched by the cloud, which is the point and the cost. Security Privacy Autonomy
PhotosEnte Photos: End-to-end encrypted photo library, open source client and server, audited (Cure53 2025), every platform, self-hostable, 10 GB free. The exit from Apple Photos or Google Photos. Caveat: a subscription for a real library, and a migration for later, not day one. Security Privacy Autonomy
Backupsrestic · Borg · Kopia: Encrypted, deduplicated backups to a drive or any cloud bucket, with the key held by you. The tool for the off-site copy in 3-2-1. Caveat: command-line (restic, Borg); Kopia has a GUI and runs on Mac, Windows and Linux. Security Privacy Autonomy
NotesStandard Notes · Notesnook · Obsidian + Cryptomator: Standard Notes is E2EE and open source (owned by Proton since 2024; still a separate subscription). Notesnook is the independent open-source E2EE option. Obsidian is local-first plain files; encrypt the folder yourself if it syncs through a cloud. Caveat: Obsidian's own Sync is E2EE but proprietary. Security Privacy Autonomy
Calls and videoSignal · Jitsi: Signal calls are E2EE. Jitsi Meet is open source and E2EE in supported browsers; self-hostable. Caveat: group video E2EE is newer and less tested than messaging. Security Privacy Autonomy
Device sync without a cloudSyncthing: Folders kept identical across your own devices, peer-to-peer, encrypted in transit, no server. Caveat: it's sync, not backup; a deletion syncs too. Security Privacy Autonomy
Not E2EE, often assumed to beiMessage backups · Telegram · Gmail · Slack · Discord: iMessage is E2EE but iCloud backup of it isn't unless Advanced Data Protection is on. Telegram is not E2EE except in "secret chats." Gmail, Slack and Discord are readable by the provider by design. Security Privacy Autonomy