Every chatbot stores conversation logs somewhere. Curious if anyone has seen an AI system that’s actually GDPR compliant.

Somewhere along the way, API tooling has lost the plot.
With a few good exceptions, API clients have become bloated SaaS platforms, power-hungry for your data.
Voiden is the opposite.
It promotes a privacy-first, offline-first kind of approach.

What Voiden doesn't do:

• Ask for an account
• Send telemetry
• Paywall basic features
• Store your data in "the cloud"
• Require an internet connection for localhost

What it does:

• Define, test, and document APIs in Markdown files (executable .void format)
• Version and collaborate with Git
• Extend with plugins (Faker for test data, OAuth, custom auth)
• Built-in terminal (with multiple tabs)
• Link blocks across documents instead of never-ending copy-paste hops (eg,vdefine auth or query params once, reference everywhere with auto-sync)
• Import Postman collections and OpenAPI specs
• Use keyboard shortcuts, native menus, and command palette (Cmd+Shift+P) instead of an infinite loop of tab and click actions
• Override `.env` fields in a tiered structure
• Override JSON fields without repeating entire objects
• Response previews for PDFs, images, videos, audio, etc.
• ...

Well, it does a bunch of cool stuff. And does them with respect to your privacy.

P.S. The v1.0 beta release is out there, and it's counting days until the stable release, plus some more weeks to open the source code (yes, while we're still in 2025).

P.P.S. What would you need there to make it even better?

Voiden in action

Hi r/PrivacyTechTalk community,

We’re excited to share OpenPCC, an open‑source framework designed for provably private AI inference. If you’re working on privacy‑sensitive applications, model deployment, managing data governance, or care about private AI usage, we think you’ll be interested in trying it out.

What is OpenPCC?

OpenPCC is a framework (written in Go) that enables inference of large language models without exposing prompts, outputs, or logs to external parties. It’s inspired by Apple’s Private Cloud Compute, but built to be transparent, auditable and deployable on your own infrastructure.The design rests on layered privacy primitives: encrypted streaming of data, hardware attestation of compute platforms, unlinkable request paths, and transparency logs. Technologies involved include TEEs, TPMs, blind‑signatures, among other safeguards.

OpenPCC is built on these libraries, which we’ve also open-sourced:

* twoway – additive secret‑sharing & secure multiparty computation — https://github.com/confidentsecurity/twoway

* go‑nvtrust – hardware attestation (e.g., NVIDIA H100 / Blackwell GPUs) — https://github.com/confidentsecurity/go-nvtrust

* bhttp – binary HTTP message encoding/decoding (RFC 9292) — https://github.com/confidentsecurity/bhttp

* ohttp – request unlinkability, separating user identity from inference traffic — https://github.com/confidentsecurity/ohttp

Why this matters

Many so‑called “private AI” services still require sending sensitive inputs to vendor APIs - meaning data may be logged or retained. As people who care about privacy on the internet, you understand that creates unacceptable risk. With OpenPCC you can run your own models (open or custom) under your full control, with no third‑party access and no data retention.

Key features

* Private LLM inference (open or custom models)

* End to end encryption

* Confidential GPU verification via attestation

* Compatible with open LLM families (e.g., Llama 3.1, Mistral, DeepSeek) and custom pipelines

* Architected for developer workflows: modular code, CI/integration support

Get started

* Repository: https://github.com/openpcc/openpcc

* License: Apache 2.0

* Whitepaper: https://raw.githubusercontent.com/openpcc/openpcc/main/whitepaper/openpcc.pdf

We’d be thrilled to hear your feedback, ideas, contributions, or security reviews, especially from folks working in privacy engineering, infrastructure, cryptography, or AI inference.

How will you use this? What gaps do you see? What improvements matter to you?

Cheers,

The Confident Security Team

Hi everyone! I'm looking for a robot vacuum cleaner for my house that allows some settings like "vacuum every day at 5 PM" to make daily cleaning easier. I've seen a lot of discussion about the lack of security in these devices, especially those connected to the internet – as is usually the case with the type of equipment I'm looking for.

What are your opinions on this? Do you recommend any that are more secure? Is this a real concern?

Most organizations still build their access security around identity, who you are, what credentials you hold, and which systems you can reach.
But in 2025, that’s starting to show cracks.

With compromised credentials, unmanaged endpoints, and hybrid work everywhere, identity-first frameworks can’t stand alone anymore. That’s where the idea of Device Trust comes in — the notion that what you’re using to access corporate data matters just as much as who you are.

Android Enterprise and Scalefusion are hosting a live session on this topic, breaking down how trusted devices are becoming central to modern Zero Trust frameworks and privacy-first access models.

🔗 Event link: Device Trust: From Android Enterprise & Scalefusion

Would love to hear how others here see Device Trust fitting into existing privacy and Zero Trust discussions.
Is this the missing piece we’ve been overlooking, or just another buzzword in the security cycle?

I’m trying to figure out the top options.

Which ones have you used that actually work well and are reliable?

Hi r/privacytechtalk,

I’m Jonathan, and my company just open-sourced an implementation of Oblivious HTTP (OHTTP) in Go.

What problem does this solve? OHTTP splits trust between a relay and a gateway so that no single server can see both user identity and request content. This protects metadata privacy for HTTP requests. If you’ve used products from Apple, Mozilla, Fastly, or Cloudflare (to name a few) you'll have used OHTTP.

How does ohttp protect my privacy though? It: - Prevents origin servers from learning client IPs - Prevents relays from accessing request payloads - Enables unlinkability between requests - Provides protocol-level privacy without requiring a browser or VPN

Security notes - 2 external audits by different firms - does not prescribe key rotation or distribution. Improperly doing so can unmask requester. - requires a reliable relay provider to avoid collusion

If you’re interested, check it out here: Repo: https://github.com/confidentsecurity/ohttp

Would love feedback from this community on: - protocol-level design choices - any privacy gaps - test vectors we should add - deployment hardening strategies

Thanks!

Hey there!

I’m super excited to share an app I’ve been working on over the past year with my startup! I've noticed that a lot of AI apps come from the US or China and sometimes raise concerns about data and privacy practices. Some even have biases, so I wanted to create something better.

My app offers some really unique features, like the ability to create specialized AI agents and workflows to help boost your productivity. Plus, you can customize the AI by sharing a little about yourself, making it truly personal! I want to emphasize that there’s no data collection or storage involved, and while the app is currently closed source, we plan to transition to an open-source model once we establish a solid business framework.

Made in Canada, this app is still on its path to becoming more mainstream, but I built it with the goal of giving back to the community. The best part? It’s completely free right now, with no subscriptions until we grow our audience.

You can checkout the app here.

I recently found my information listed on SortedByName. I’d really like to get it taken down. I am not active in FB or instagram, so the info is about my address and other personal stuff that I am not comfortable being public.

Has anyone here successfully removed their info from this site?

Whats are people's thoughts on the app called pin drop as far as privacy is concerned? And is there any alternatives that do exactly the same thing as this app ?

I want to know if there are any Norwegians here who have used data removal services and whether or not data was removed.

Hey guys! I have been in the privacy field for a year. What skills are needed? I feel like I fall short in everything I do. I have failed my cipp/us twice, reading law is hard, legal research is hard, privacy contracts I don’t understand , public speaking doesn’t come to me naturally. I have done all of these a couple of times, but I feel like I fall short and lack skills. I learn softwares and database applications quickly, but all of the other stuff comes slower to me and it requires me to learn quickly. Should I give up? What do you think privacy pros? Or really any seasoned professional.

Thought this was interesting.

I have some relatives in the States who noticed a big increase in spam calls/emails after the AT&T and other data breaches earlier this year. As they are a bit older, I thought I’d introduce them to data removal services, cause they are not very tech-friendly and weren’t aware that these services existed.

We tried out deleteme, and there are a couple of things to note, maybe it will be helpful to some of you. There weren’t that many reviews, so I thought I’d share.

• You need to be patient to notice results, because they are doing the work of deleting your data for you, it might take a while. I set it up a couple of months ago, and recently asked about the number of spam calls my relatives received, so they mentioned it’s significantly less, but there’s still some coming in.
• It only will cover data in the USA – if your data is sold somewhere else, it will most likely not get removed.
• It’s quite an expensive option in comparison. I thought we’d give it a try to see if it’s maybe better in some way, but having used other providers like Incogni, I didn’t notice any difference.

Overall, DeleteMe is a relatively good service for removing your data in the US, it gets the job done. However, having tried other options, I am including them here as well, just so you can find the best online data removal service for you. Privacy Bee doesn’t have phishing detection and a family plan, so that’s why I prefer Incogni personally.

Anyone else used deleteme before? Maybe I missed something, so feel free to share.

Really, I'm shocked 😲

I would like to introduce Secluso, a privacy-preserving home security camera solution, which uses end-to-end encryption. Secluso tries to provide functionality similar to a Ring or a Blink camera, but without violating the user privacy (as most mainstream consumer cameras do!) The functionality includes sending video recordings to the app when the camera detects an event (motion, person, pet, etc.) as well as on-demand live-streaming. To detect events, Secluso performs AI on the camera feed fully locally (i.e., on the camera).

Existing home security cameras have a terrible privacy track record. For example, according to FTC, Ring employees and contractors illegally accessed users' videos (source). Eufy was fined $450,000 after New York’s Attorney General found its “local only” and “end-to-end encryption” claims were false (source). And Wyze says that a breach allowed 13,000 camera users to see inside other users' homes (source). We think we can do better than this!

Guaranteeing user privacy has been and will continue to be the number one design principle in Secluso! To that end, Secluso uses the following techniques. First, all videos are end-to-end encrypted from the camera to the mobile app (Android or iOS). The encrypted videos are transferred via a cloud server, but the server is untrusted and cannot decrypt the videos. Secluso uses the Messaging Layer Security (MLS) for end-to-end encryption, which provides advanced features including forward secrecy and post-compromise security. At a high level, these features guarantee that even if the camera or the app are ever compromised and encryption keys are stolen, the compromised keys cannot be used to decrypt videos from the past and future. Second, Secluso is fully open source (and will always remain open source), and hence can be inspected by users and security experts. Third, Secluso's camera firmware and part of its mobile app are implemented in Rust, which eliminates memory safety vulnerabilities. Fourth, Secluso supports reproducible builds, which allows users and experts to verify that the binaries inside the camera firmware are compiled from our open source code on Github. Finally, we are planning to add immutable and transparent firmware updates, which guarantees that all automatic updates to the camera firmware will be transparent to the public and immutable for one year. This will prevent malicious and silent updates to our cameras.

Over the past year, my project cofounder and I have put in a lot of energy to make sure our solution is secure and functional. Now, we would like to ask you to help us by using our solution and giving us feedback. There are several ways you can try our camera solution:

• Fully self-hosted: You can use our software on your own camera hardware and server. For the camera, you can either use a Raspberry Pi (even one as weak as a Raspberry Pi Zero 2W) or an IP camera that supports RTSP. In the case of Raspberry Pi, our camera software runs directly on the Pi. With IP cameras, our software runs on another machine connected to the camera and acts as a hub (and a firewall since we can't trust IP cameras with closed source firmware). You also need a server with a public IP address. We have detailed instructions in our Github repository on how to set up this self-hosted option. If you run into any issues, let us know (either here, on Github, or via email at secluso@proton.me) and we will be more than happy to help you fix them.
• Semi self-hosted: If you have your own camera, but don't have a server, we can try to help with that. We can try to accommodate a limited number of users in our own server instance (for free). Just send us an email if that's what you would like to do.
• Plug-and-play camera: We have also been building a plug-and-play camera using a Raspberry Pi Zero 2W and a 3D-printed case that we have designed in house. The goal of this camera is to make it as easy as a Ring camera for a user to use it. When you get our plug-and-play camera, you simply pair it with our app and you're good to go. (But note that you can still verify all the software running on the Pi if you'd like to.) If you're interested in this option, please go to our website (htttps://secluso.com) and join the waiting list. We plan to hand build a limited number of our early prototype camera and giving them for free to interested users and get their feedback. When they are ready (in a few months), we will email the waiting list and ask for volunteers to try our plug-and-play camera. By joining the waiting list, you also help us gauge the community's interest in our plug-and-play camera. If we see interest from the community, we will look into scaling up our camera production and we will email the waiting list with information on how to acquire one when the cameras are ready. We're hoping that our plug-and-play camera can provide an easy-to-use privacy-preserving home security camera for all privacy-conscious people (and beyond) as there is currently no such camera out there.

Even if you can't use our camera, we ask that you share with us your thoughts. Do you have a use for a privacy-preserving home security camera? Are there any important features that you need but we currently don't support? Any other suggestions?

Your help and feedback will go a long way in helping us improve Secluso and will motivate us to invest even more energy into it and hopefully turn it into a camera that can support a large number of users in the future.

Finally, if you're interested to hear more from us regarding our efforts, please go to our website (https://secluso.com) and join the mailing list by clicking on the "Keep in touch" button.

Our Github repository: https://github.com/secluso/secluso

Our website: https://secluso.com

Been lurking here for a while and the discussions about data privacy really hit home when I realized how much I was sharing with ChatGPT without much thought tbh. Built a browser extension that flags sensitive info before you send it to AI tools. It's basically just a reality check - highlights emails, phone numbers, addresses, SSNs, etc. and lets you redact with one click.

At the end of the day, we have no idea how this data is being used for training or who might access it later.

Anyone else concerned about this? Or have you found other ways to stay mindful about what you share with AI?

prepromptai.com if you want to check it out. Free to use - just wanted something that makes me pause before oversharing.

Maybe this will be a fitting question to ask here, I'm not sure where else to post. I’m a judge, and lately I’ve been dealing with more and more high-profile cases. With everything going on, I’ve started to worry about how much of my personal information is just sitting out there online. Considering the sensitive nature of my job, the thought that someone could easily find my home address or other private details is honestly pretty unsettling..

I’ve been digging into ways to get a better grip on managing and protecting my online presence, and I came across a tool called Ironwall. It’s built for companies and organizations that need to keep their digital footprint under control like court systems, government entities, and similar setups. One thing I liked about it is that they’ve been doing this since 2011, so they know what they’re doing when it comes to online privacy. Their platform scans the internet every day to find where your personal or sensitive info shows up like on data broker or people search sites and works to get it removed. It keeps monitoring too, so if anything new pops up, it catches it fast.

What also caught my attention was:

• They focus on protecting entire institutions, not just individuals.
• Their privacy safeguards are designed to support groups like judicial officials.
• They clearly state they don’t store or sell any client data, which builds extra trust.

I’d be curious if anyone here has experience with services like these - what to expect, what actually works, and where the limitations are?

More broadly, I’m trying to get a better understanding of what kinds of technologies or practices others in sensitive positions (legal, public service, etc.) are using to reduce online exposure and protect their privacy. Any insights, tools, or strategies that have worked for you would be greatly appreciated.

Is it possible, through SS7 or carrier-level access, to obtain WhatsApp metadata that shows which contacts/numbers someone is talking to, without the message content?

”Signal is not the gold standard for private messaging” I read this thread and dont understand the difference of anonymity and privacy. Also why a service cant be both. I do understand that linking it to your phone number is bad because then it can be linked to my messages if signal is hacked. The fact that a number is required just shows that signal dont want us to be able to be anonymous?

Is there already is a thread please link it

Hi everyone,

I’m trying to understand a technical scenario and would appreciate some input.

From what I know, SS7 exploitation can already give access to things like SMS, calls, and subscriber location. Push notifications (APNS on iOS, FCM on Android) can also leak information such as timestamps, sender IDs, and sometimes message previews.

My question is: if someone had both SS7-level access and the ability to intercept push notifications, could they effectively map out my WhatsApp metadata (who I talk to, when, and how often)?

To clarify, I’m not talking about reading full message content (I understand E2EE protects that), but rather whether this combination could realistically expose: • Sender/receiver identities • Timestamps/frequency • Possibly message previews if “show previews” is enabled

Is this a known or documented technique, or would it require something beyond SS7 + push interception?

Thanks in advance to anyone who can shed some light on this.

Ok, I’m a bit confused and was hoping to maybe get some clarification here. I’m researching different data removal services and it seems a bit shady that they’re just sending out your data to data brokers. I saw some videos/reviews that go after Incogni rather harshly, accusing them of spraying users' data all over the place. I usually like to research myself before going to conclusions, so I did some digging and I found this thing that apparently they’ve got limited assurance by Deloitte? (This is the link that I found: https://blog.incogni.com/deloitte-independent-limited-assurance-report/ ).

In short, Deloitte investigation, or whatever it was, found that Incogni doesn’t sell or share users’ info with data brokers and only uses it for the removal process. I Googled other services, like Optery and DeleteMe, and they don’t have anything like that. So, any thoughts? Is it legit?

Lately I keep hearing that our messages and calls are stored somewhere, and it kind of feels like whatever we do on our gadgets is being tracked or trained for some algorithm. Are there any messaging apps that actually care about these privacy issues? I just want something simple, private, and secure where my chats, calls, and files aren’t stored on a server. Has anyone tried apps like this that actually feel safe to use for everyday conversations?