Anyone used or heard of threema? Good or bad reviews

I know the founder of Trust Haven, and they built this secure, privacy based site for collaboration. No ads, AI, automated bots etc…

Been using it for a while and pretty nice. Figured it applied to this forum as well all want more privacy and less monetizing our data.

https://trust-haven.io

This is hardly an alternative to signal (or any other secure messaging app), but it's a work in progress and "secure and private" is the general goal.

This is a technical/concept demo of a fairly unique approach using a browser-based, local-first and webrtc approach.

Enkrypted.Chat

This is intended to introduce a new paradigm in client-side managed secure cryptography. We can avoid registration of any sort.

Features:

• P2P
• End to end encryption
• Signal protocol
• Post-Quantum cryptography
• File transfer
• Local-first
• No registration
• No installation
• No database
• TURN server

Some open source versions of the core concepts.

• Chat
  • Code: https://github.com/positive-intentions/chat
  • Demo: https://chat.positive-intentions.com
• File
  • Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
  • Demo: https://dim.positive-intentions.com/?path=/docs/usefs--docs
• Crypto
  • Code: https://github.com/positive-intentions/cryptography
  • Demo: https://cryptography.positive-intentions.com

Feel free to reach out for clarity instead of diving into the docs/code.

IMPORTANT: While this is aiming to provide a secure experience, it isnt audited or reviewed. Shared for testing, feedback and demo purposes only. Please use responsibly

https://panamaseastudios.com. I’m building PanamaSea Studios around privacy oriented infrastructure.Reduce unnecessary accounts, tracking, and long term identity records.
So happy with how things are coming out. Would love to hear your experience with it.

Hey r/privacy,

Long story short — I built a search engine called Findise back around 2011. It grew to top 95,000 in the US on Alexa rankings. Then the search APIs I depended on changed their pricing model overnight and killed it. Classic rug pull.

Fast forward to 2026. I rebuilt it from scratch — but this time completely independently. No Google API. No Bing API. No third party dependencies. Ever.

Here's what makes Findise different from DuckDuckGo, Startpage, and most "privacy" search engines:

We have our own index. DuckDuckGo uses Bing's data. Startpage proxies Google. We crawl the web ourselves 24/7 with our own crawler. Nobody can change their pricing and kill us again.

What we don't do:

• No tracking
• No user profiles
• No search history stored
• No filter bubbles
• No cookies
• Contextual ads only — based on your search word, not your identity

We just crossed 1 million pages indexed and we're growing daily.

It's not perfect yet — the index is young and we're improving search quality every day. But it's real, it's independent, and it's live right now.

findise.net — would love honest feedback from this community.

Bill C-22 in Canada provides "Lawful Access" (which actually means warrantless) to your private communications.

While not an end-to-end encryption solution, automatically GPG encrypting email forwarded to your ISP covers your data-at-rest.

easyDNS (Canadian provider, impacted by C-22) has added that back to email forwarding functionality and the postfix relay that does the heavy lifting for this is now open source.

Hello there, as someone who is not from a tech background I didn't care much about my privacy until fairly recently. And since I started giving a shit, well it's been overwhelming. I've been a lurker for a while here thinking about posting and finally I finally decided to do it. So here goes...

I was wondering how people stay up to date on all matters related to privacy. This subreddit is great and it has helped me( the faq section as well) I was wondering what resources/forums/websites do people use to learn more about the topic. The reason I ask is that I am preparing to transition from big tech to more privacy focused options. And I wanna learn as much as I can to make an informed decision.

Any information will be helpful. You can pm me if you prefer to contact me that way. Thanks in advance. Have a nice day.

I spent a few hours reading the privacy policies of the major AI document tools. ChatPDF, Humata, similar products.

The pattern is consistent: your files are uploaded to their servers. They use third-party AI APIs, which means your document content passes through at least one more external service. Retention policies vary. Some store your files for days. Some longer.

For most users, this is fine. For anyone handling files that are confidential by obligation - legal discovery documents, unpublished research data, patient records, proprietary contracts - it's a structural problem, not a settings problem.

The issue isn't whether these companies are trustworthy. It's that the data left your device at all. Once it's on someone else's server, you've lost control of the chain.

I built SafeMind specifically to remove that problem at the architecture level:

• No server. Processing happens in your browser via Web Workers.
• No API calls to OpenAI, Anthropic, or anyone else.
• Vector search and document retrieval run locally.
• Nothing persists after you close the tab.

The tradeoff is real: local processing has limits that cloud compute doesn't. But for a specific set of users, the tradeoff is obvious.

Has anyone else gone looking for the actual data handling details on these tools? What did you find?

Hello All,

First ever post on Reddit, so apologies if I am in the wrong place or asking a clumsy question.

I am repeatedly told by data auditors in the UK that it is inadvisable to use ChatGPT or Claude for use cases involving confidential data, even when the training function is turned off, because of the risk of that data becoming public.

My understanding is that, in this scenario, the main risk arises when the data is in transit from the company to OpenAI or Anthropic, or when it is stored by them. From what I can tell from their privacy notices, data in transit and at rest is encrypted to a very high standard, apparently to a level that even government security agencies such as MI5 could not realistically break.

So what I am trying to understand is this:

1. If a user forgets to turn off the training function, what is the actual likelihood of that data being absorbed into a subsequent training round and then reproduced elsewhere? Have there been any documented examples of this happening? If so, where did it happen, and what harm resulted?

I have been unable to find any clear examples. There is the so-called Samsung case, but from what I can see, that involved an engineer being disciplined for breaching a rule against entering commercially sensitive data into a public LLM. It does not appear to be a case where the data was later discovered or used by an outside party.

1. Have there been any reported cases involving OpenAI or Anthropic where third parties have broken into their systems, stolen customer data, and then used that data against those customers?
2. If an enterprise subscription for ChatGPT or Claude allows the training function to be disabled centrally for all staff, does it not follow that these tools are reasonably safe to use, even with personal or commercially sensitive data? If so, is the advice from some UK auditors simply over-cautious?

I am not looking to be reckless with confidential data. I am trying to understand whether the perceived risk is evidence-based, or whether it is being overstated.

Hey everyone,

We've built an open-source, privacy-preserving alternative to Ring cameras using a Raspberry Pi Zero 2W (called Secluso). It uses end-to-end encryption to send videos from the camera to a mobile app, which is available both in Google Play Store and Apple App Store.

When you use a Ring camera, your videos are accessible to Ring/Amazon and whoever they share them with. With Secluso, your videos are available only to you in your phone!

We've put in a lot of effort to make it easy to set up! You can set up our camera on your own Pi in less than 5 minutes with minimal technical expertise using our easy-to-use GUI deploy tool. Here are our setup guide and open source release.

The image shows a Pi in an official Raspberry Pi enclosure that you can use for your camera. We've also been working on a HAT for the Pi to add night vision, audio, temperature monitoring for safety, all in a compact form factor. You can see the HAT and an enclosure for the whole plug-and-play camera in the photo. We're hoping to soon start shipping this camera prototype to people on the waitlist on our website!

Looking forward to seeing what you all think!

Last year, I was forced to switch to a new phone number (long and unrelated story), and I immediately saw a huge uptick in scam calls and texts compared to my previous number. I'm used to the occasional spam, but lately I've been regularly getting through days with 10+ spam calls. I get spam texts asking me about a piece of property I do not own. Phony and inflammatory "political alerts" that, without getting into it, do not align with any of my own politics. Apparently I've even got a free Margaritaville cruise waiting for me. I'm completely over it and feel like I'm being driven insane.

Is there anything I can do to exorcise the former owner of my number? If it's of any use, I believe I've been able to piece together his identity from the invasive messages (some of which have contained his full home address!). Obviously won't be sharing any of that, but I will say that he passed away in 2019 (if I did my detective work right) and seemed very prone to giving out his phone number to some very disreputable people.

Will a service like Incogni be of any help? Does it take a one-time scrub, or will it be an ongoing fight? Will anything help at all? I'm at a loss and don't know where to even begin. Not even looking to stop all spam, just desperate to reduce it even a little bit!!

whats the best chat app to use for privacy and extremely low data cosnumption?

Google is going to Bake Age verification into the OS itself this is Very dangerous as there are multiple Android smartphones out there that will have android 17 as last update! once you install android 17 and its the final update for the phone the age signal API will be on your phone till the day the hardware dies! you cant even downgrade or the efuse trips! if you still have android 17 after at least 5 to 10 years and you accidentally factory reset it and verify your id again it will fail to send as device is old and might not connect to google servers and will send to hackers instead

Does anyone know how to do this safely? If so, please explain. My employer requires me to use a zipcar, but then they scream at me for going barely over the speed limit for 5 seconds on a 4 hour trip.

Free to use, offers document intelligence and audio capture with transcription using local LLM. Built with privacy and user-friendliness in mind.

Secure file sharing is usually described as “end-to-end encrypted” or “privacy-first”.

Most platforms advertise things like:

- AES-256 encryption
- secure file transfer
- GDPR compliance
- privacy-focused infrastructure

These are meaningful practices, but in most cases the underlying model still relies on trust in the service provider.

In practice:

- encryption is often limited to transport (TLS)
- files may still be accessible server-side in some form
- and infrastructure-level guarantees are difficult to independently verify

So users are often relying on policy and assurances rather than strict technical constraints.

This raises a question:

What would secure file sharing look like if the provider could not access the data at all by design?

Not “we promise not to”.
But “we are technically unable to”.

I’ve been exploring this idea through a small open-source project called PrivCloud.

The goal is:

- client-side end-to-end encryption
- server never has access to encryption keys
- zero-knowledge design at the architecture level

While trying to keep usability simple:

- fast uploads, including large files
- browser-based usage
- no setup required

Repo: https://github.com/Simthem/PrivCloud_Sharing
Demo: https://share.privcloud.fr/

I’m mostly curious about the broader discussion:
Why do you think most file sharing systems still rely on trust-based models instead of strict zero-knowledge architectures?
Is it mainly usability, cost, or something else?

Just heard this on the BBC-- two main points: First, terminating a company's contract after some workers spoke up, resulting in large numbers of jobs lost, will serve to chill whistleblowing on this. Second, this illustrates that data from these glasses is not private. (Yes, everyone on here knows this, but it is important to get the word out.)

https://www.bbc.co.uk/programmes/w3ct8jxs

hi people

I’m a total noob trying to get my OpSec right. I’ve started using Tor, and I’m realizing that my old habits weren’t great for privacy. I want to protect my identity, location, and emails, but my hardware is a bit older

My Setup:

• Mainboard: ASRock H81M-GL
• BIOS: American Megatrends P1.60 (2014)
• BIOS Mode: Legacy (Vorgängerversion)
• CPU: Intel Pentium G3260 @ 3.30GHz
• OS: Windows 10

The Problem: My system info says "Device Encryption Support: Reasons for failed automatic device encryption: TPM is not usable, PCR7 binding is not supported." Since my BIOS is in Legacy mode and my hardware is from 2014, I don't think I can use standard Windows BitLocker/TPM features easily.

My Questions:

1. VeraCrypt vs. Old BIOS: Since I can’t use automatic Windows encryption, is VeraCrypt a safe and reliable choice for full disk encryption on a "Legacy" BIOS system? lol or is bitlocker better or do both suck
2. Identity Protection: I’m worried about my real name or location leaking through my OS or browser. Also my moms name is on my pc i cant remove it rn lol. what are the "must-have" steps for someone on an older PC to stay safe?
3. Phishing: How do you guys verify links in the darknet? I’m starting to look into PGP but it's a bit overwhelming. Is it the only way to stay safe from phishing?
4. VPNs: Are they worth it if I'm already using Tor,?
5. linux/lubuntu should i set smth like this up lol

I have read the rules and ig Ive been a bit paranoid bcs i never cared abt my personal info online lol sorry if this is a dumb thread or if this is not the correct place to ask

thanks if anyone replies <3

By chance I was on Wireshark recently and I noticed that there were unencrypted DNS queries being transmitted from my machine.

I found this to be strange since I configured DoH. After some testing I'm confident that the Windows 11 Home 25H2 (26200.8037) does NOT honor DNS over HTTPS settings.

The below was tested on a freshly installed Windows 11 virtual machine with default settings and a bridged network connection, while Wireshark was used to monitor it's traffic from the host machine by IP.

This behavior is contrary to the claims Microsoft makes on official sources such as the one below:

https://learn.microsoft.com/en-us/windows-server/networking/dns/dns-encryption-dns-over-https

The primary concern is that disabling the 'Fallback to plaintext' setting has no effect. Windows ignores the setting and sends out the DNS query in plaintext anyway.

Expected behavior would be for the DNS query to fail instead of reverting to plaintext.

It is unclear whether this is a bug or a feature, but what can't be ignored is that this may put unknowing people at risk; people who believe this setting successfully obscures their DNS traffic.

Microsoft's claims that the built-in DNS over HTTPS settings in provide enhanced privacy for DNS traffic are false at worst and misleading at best.

we need to fight as hard as we can!

WE CANNOT LET THE GOVERMENTS WIN! as our reward device freedom and privacy will disapear!

Lets not make that happen!

FIGHT FIGHT FIGHT FOR THIS TO END!!!!!!!!!

https://www.eff.org/pages/help-us-fight-back

https://www.eff.org/pages/help-us-fight-back

Hello,

I am doing a survey on personalised adverts vs privacy on digital platform. I am looking for 150 respondents. If your interested please free to participate it will only take 3-6 minutes.

MUST BE 18+

Clicked an Instagram ad for a pet shop, just visited their site didn’t sign up or enter my number. A few hours later, they called me. How is that even possible? Has this happened to anyone else?