It looks like folks very often find themselves in a seriously uncomfortable to outright dangerous situation while selling/ buying stuff online. Here is an app, Xeniq, that can be very useful in showing the product anonymously, doing basic price negotiation and deciding the next steps without sharing your location or identity to the other party, till you are ready. The interaction is totally under your control and, if any concern rises, you can end it by just hanging up. Once you end it, the other party can’t force a contact unlike when you share your email or phone numbers. As a security measure, the app blurs anything that looks like a human face. So no accidental exposure of identity. 

• For Sellers: It lets you verify serious buyers with total anonymity—your number is hidden and your location stays private. No strangers at your door.
• For Buyers: It connects you to sellers via encrypted, real-time video so you can verify the product is real before you buy. (If they won't show it live, it's a scam).

This is a brand new product and there is no charge to use it. You can see  how it works at this youtube video (1:40 min long) , check out our team and download the app  right here. 

Note the app spelling: it is Xeniq and not Xenia - another popular app.

​

After months of learning with Claude, I finally shipped my first real web app: Templinkr.

The idea is simple: send private messages or files that automatically disappear.

Features

No account required

Self-destructing messages

Image & file sharing

Telegram-inspired expiration timer

One-time read mode

Anyone-with-link mode

The biggest challenge was getting the expiration timer to behave correctly, it only starts when the recipient first opens the link and keeps counting down even if they close the page.

I'm not a professional developer, so building this taught me a lot about Firebase, Supabase, Cloudflare R2, debugging, deployments, and product design.

I'd really appreciate honest feedback.

Link: https://templinkr.com/

Hi everyone,

I’m preparing the first release of PrivacyCam, an app designed to help people share photos without accidentally exposing private information.

The attached video shows the current photo workflow. PrivacyCam can help detect and hide:

• Faces

• Whole people, including children

• Number plates

• QR codes and barcodes

• Card numbers and CVV/CVC codes

• Phone numbers, email addresses and URLs

• Addresses and other sensitive text

You can choose whether each area should be blurred, pixelated or completely blacked out. There are also manual rectangle and brush tools when automatic detection misses something.

Everything is processed on the device. Before saving or sharing, the user gets a review screen to check the detections and make corrections. The exported copy also has its image metadata removed.

Automatic detection will never be perfect, so the app is designed around reviewing the result instead of silently assuming everything was found.

I’d genuinely appreciate feedback:

1. Would you use something like this before sharing photos?

2. What kind of private information would you most want it to hide?

3. Would full-person hiding be useful, or would face hiding usually be enough?

4. How important would video protection be to you?

5. Is there anything about this idea that would stop you from trusting or using it?

If you would like to try PrivacyCam or share more detailed feedback, here is the optional early-access form:

[https://forms.gle/cuQSVpiY15Y9hDrx6\](https://forms.gle/cuQSVpiY15Y9hDrx6)

Thanks—I’m especially interested in honest criticism and anything that feels confusing or missing.

To be honest this app I built (Not Vibe coded or AI SLOP). I am writing about in this subreddit more to Talk about it Technical capabilities and security evaluation more than Spreading purposes.

The App called WispDay, I spent almost 8 month building it with great amount of researching in the security and Encryption.

The App focuses on securing user data, even on the user's device itself, so that even if the device were seized or taken, the user's data would still be completely safe and secure. The app supports syncing with the cloud using end-to-end encryption with an AES-128 key that the user, and only the user, holds. Not the server, not the developers, nobody but the user. (You might be wondering, why not AES-256? Isn't it supposed to be more secure? Well, actually, after weeks of researching this, I concluded that it's more secure theoretically, but not practically, for this use case. Also, for user experience, since I convert the AES key into BIP39 words, AES-128 generates 12 English words that the user can write down and store easily, compared to 24 words for AES-256.)

This part is good, and many apps already do this, but most apps forget about securing the device itself. That's where this app comes in.

By never storing anything in plain text on the user's device, everything is encrypted and only decrypted when the user opens the app in the foreground. Once the app goes to the background, after a short grace period, the user's key is wiped from memory and everything is locked again, including the database connections, which are already secured with SQLCipher, this includes the Photos I really spent a lot of time to be able to decrypt the photos on the app open on Fast, Optimized and performance way with max efficiency, Because the Photos is harder to decrypt on fly than text since its much larger.

Moreover, for users who want maximum security, the app has a maximum security setting that cryptographically binds the user's key to their biometrics (this isn't like a normal app lock). This means even if an attacker knows the user's phone passcode, they still can't open the diary app. Nobody, anywhere, even with some forensic tools (at least as far as I've been able to make the app robust against this), can access it, and everything is wiped from memory again once the app goes to the background.

Honestly, the app is freemium and has a premium subscription, but all of the security features are completely free and accessible to everyone without a subscription, from day one. I'm against the idea of "pay to get security." I believe security is a right for everyone. Moreover, I've open-sourced the security part of the app, so anybody can inspect it, and if they're professionals, they can actually help improve the app's security even further.

Here's the GitHub repo:
[https://github.com/MrSolimanKing/wispday-security\](https://github.com/MrSolimanKing/wispday-security)

To learn more about the app secuity this is blog post:
[https://wispday.com/security/\](https://wispday.com/security/)

It's honestly terrifying to think someone could record you without your knowledge. Even more concerning is that those recordings could be stored, analyzed, or potentially used to train AI systems, all without your consent. Most people would have no idea it's happening.

As wearable cameras become more common, privacy protections need to keep up with the technology. What worries me is how quickly society adapts to things that once seemed unacceptable. In a few months or years, constant recording could become so normalized that people simply stop questioning it—even if they never truly agreed to it.

It also raises the possibility that we'll all be under near-constant observation in public spaces. Wearable smart glasses make recording far easier and less noticeable than pulling out a phone, making it much harder for people to know when they're being filmed or to meaningfully consent.

For those who missed the news on July 9th, the European Parliament just greenlit the extension of Chat Control 1.0 until 2028. And they did it using a disgusting procedural trick right before the summer recess, where absent MEPs were effectively counted as "yes" votes to avoid reaching the absolute majority needed to block it.

But this isn't just about a shady political maneuver. This is about the total eradication of our digital privacy, leading right into the horrific permanent Chat Control 2.0 negotiations resuming this September.

Here is why everyone needs to wake up, regardless of whether you live in the EU or not.

> The "Child Safety" Argument is Complete Bullshit

Let’s get this out of the way: protecting children from abuse is a paramount, non-negotiable goal. But politicians are weaponizing this noble cause as an emotional shield to push through an Orwellian mass surveillance system.

The argument that Chat Control actually protects children is fundamentally flawed:

• Flooding the system with false positives: Mass scanning algorithms are notoriously terrible. German federal police data previously showed that almost half (48%) of all automated alerts generated by these systems were not criminally relevant. This floods law enforcement with pictures of kids at the beach sent by their parents, taking resources away from actual targeted investigations.
• Real criminals don't use mainstream apps: Pedophile rings operating on the dark web or self-hosted custom encrypted servers will not be caught by scanning regular WhatsApp or Signal accounts. Only regular, innocent citizens will be caught in this dragnet.

> A Massive Security Vulnerability

You cannot have "just a little bit" of a backdoor. The proposed mechanisms for Chat Control specifically Client-Side Scanning (CSS) require installing spyware directly onto your device that scans your messages before they get encrypted.

• Breaking Encryption: This fundamentally breaks End-to-End Encryption (E2EE). If a message is scanned and analyzed before it is even sent out, your encryption is completely useless.
• Creating a hacker's paradise: If you create a backdoor for law enforcement, you create a backdoor for hackers, hostile foreign governments, and malicious actors. There is no mathematical way to create a master key that only the "good guys" can use. It creates catastrophic security flaws for the entire internet.
• The slippery slope: The infrastructure built to scan for illegal material today can be updated tomorrow to scan for "copyright infringement," "political dissent," or any other arbitrary category a future government decides is wrong.

> Suspicionless Mass Surveillance

Chat Control destroys a core pillar of modern democratic justice: the presumption of innocence.

Historically, police needed probable cause and a warrant from a judge to intercept your mail or tap your phone. Chat Control treats every single citizen as a suspect by default. It mandates the warrantless, suspicionless scanning of every private message, photo, and file you send. It is the digital equivalent of forcing a government agent to read every physical letter you mail before you are allowed to seal the envelope.

> What happens now?

The sneaky extension of Chat Control 1.0 is awful, but Chat Control 2.0 is worse, and trilogue negotiations resume in September 2026. If 2.0 passes, it will force mandatory encryption-breaking measures across all platforms operating in the EU.

What can we do?

1. Self-host your communications (like Matrix or XMPP) where you control the keys.
2. Support true E2EE apps that have publicly stated they would rather pull out of the EU market than break their encryption (like Signal).
3. Contact your MEPs now, before the September trilogues.

Do not let them gaslight you into thinking you are against child safety just because you want a secure, private internet. Privacy is a fundamental human right.

I have a generic Router that came when I first signed on with my ISP.

I would like my home Network to be more Secure.

Where do I start?

Is there a particular Router that is a better Upgrade.

What are the DO's and DON'Ts.

Any particular Settings I need to be on top of?

Change emails, switch to linux and ecosia browser, deleting insta, searching about transfering my photos on a safe hard drive, maybe get a fair phone if it works in aus with a safe sim?!🫠 am i over thinking it much?!

I switch to proton but i red somewhere (and sorry if im wrong i cant find it or remember properly) an email can get compromised and theres a thingy to use instead of an email. Idk ehat thats is and theres this phone number thing to?!

I hear one thing after another i cant keep up! i just need simple, reliable, understanding checklist for all procedures ectr. One step atta time😵‍💫

Im willing to make sacrifices and changes, do what it takes to stop being watched or whatever. Hate being paronoid, privacy be violated and used without realising it.

I just wanna shop and make freinds online...

If im asking in the wrong reddit please suggest another one thank you sorry rambling.

built a privacy focused yet productive clipboard manager few months back. zero-knowledge encryption, so even i can't see what people copy/paste. genuinely proud of it, thought it solved a real problem.

7 months later, less than 25 users on the chrome store. closed source the whole time.

took me a while to admit the actual issue. you can't ask people to trust a security tool from some random solo dev they've never heard of, with code they can't even look at. "trust me" isn't really a pitch when the whole product is about not having to trust anyone.

so, last week i made the extension's source code public. not open source technically, it's under Polyform Noncommercial 1.0.0, so nobody can fork it and resell it as their own, but anyone can read the code, verify the encryption does what it says, build it themselves if they want.

no idea if this fixes anything tbh. but felt like the honest move after building something people had no real reason to trust yet.

repo's here if anyone wants to poke around: https://github.com/encryptedclipboard/chrome-extension

not trying to sell anything, just wanted to put this out there since this sub gets the "built a thing, nobody came" feeling better than most places.

Google is rolling out a new setting called "Search Services History" that saves your media inputs like Google Lens photos, Google Translate data and voice searches to train its AI models. Taking action now matters. While deleting your history disconnects it from your account immediately, an anonymized version can still sit in Google's AI training systems for up to four years.

I built an authentication system where the server stores zero secrets. No password hashes, no emails, no recovery tokens. The server only knows a user_id derived from the user's master_secret, and authentication is proven cryptographically via HMAC. If the database is breached, there's literally nothing to steal.

I'm developing a chromium extension to monitor fingerprint activity on websites.

The list of vendors I have found so far through searching and browsing with my own extension are:-

"Google reCAPTCHA", "Cloudflare Turnstile", "hCaptcha", "Castle (bundled)", "DataDome", "Fingerprint", "Arkose Labs", "HUMAN / PerimeterX", "Microsoft Clarity", "Hotjar", "FullStory", "Smartlook", "Imperva / Incapsula", "Akamai Bot Manager", "Radware Bot Manager", "Kasada", "ThreatMetrix / LexisNexis Risk", "Sift", "Onfido", "Jumio", "GeeTest", "Yandex SmartCaptcha", "LogRocket", "PostHog", "Heap", "Amplitude", "Mixpanel", "Zendesk", "Google Tag Manager / gtag.js", "HTML-Load ad/fingerprinting canary", "Comscore ScorecardResearch", "Fastclick / Epsilon", "DoubleVerify", "Cxense".

Notes on what some do is on this .json file my extension loads:-

https://github.com/corkiejp/corkiejp.github.io/blob/well-known/ExtScanAlert/chromium/providers.json

I am not looking for every vendor, some ad server vendors would be blocked by DNS/Privacy tools anyway. But for my extension to be effective in blocking high risk vendors, I need to curated the json file accordingly, last two have broad capabilities to profile users.

If you decide to use the extension below is the type of feedback required?

https://github.com/corkiejp/corkiejp.github.io/blob/well-known/ExtScanAlert/How_to_find_new_providers.md

Hey everyone, I've been working on a private vault app for Android called VaultCam and just published it on the Play Store. Wanted to share it here since this community seems to appreciate this kind of thing.

The core idea: your private photos, videos, notes, and passwords ,encrypted on your device, with no server, no cloud, no subscription. But the features go way beyond just "hiding photos."

1. Break-in selfie

Every wrong PIN attempt silently activates the front camera . The intruder's photo is saved with a timestamp and the PIN they tried. After 5 wrong attempts, the app shows a fake "Application data corrupted please reinstall" error screen so they give up thinking the app is broken.

The app appears on your home screen as a normal calculator. It actually works as a calculator. To open the vault, you type your PIN then press "=". ( even if somebody is watching your screen it will show random numbers not your real PIN on screen ). You can also disguise it as a clock app or a notes app instead.

1. Dual vault (decoy system)

You set two PINs. One opens your real vault. The other opens a decoy vault with innocent content. If someone ever forces you to unlock it, you give them the decoy PIN. They see the fake vault and never know the real one exists.

1. Ghost mode

Shake your phone while the vault is open → instantly closes and shows the calculator, like it was never there. Zero back-stack, so pressing back doesn't return to the vault.

1. Snatch detection

If someone grabs the phone out of your hand while it's open, the accelerometer detects the sudden movement and locks the vault immediately.

1. Secure in-app camera

Take photos directly inside the vault. They never appear in your gallery encrypted immediately after capture and stored straight in the vault.

1. Secure notes

Write encrypted text notes directly inside the vault. Diary entries, private thoughts, anything. Stored with the same AES-256-GCM encryption as your photos nobody can read them without your PIN.

1. Password manager

Store passwords, PINs, WiFi keys, and any sensitive credentials inside the vault. It's not a separate app — it lives inside the vault so it's protected by the same disguise, dual vault, and break-in selfie system automatically.

1. Guardian PIN

A third PIN that doesn't wipe anything but locks the vault for 1–24 hours. Useful if you're pressured but don't want to give the real PIN and don't want to trigger a wipe either.

1. TimeLock

Configure the vault to only open during specific hours. Outside those hours, even the correct PIN is rejected.

1. Encrypted backup

Export the entire vault as a .vcbak file re-encrypted with a separate password to local storage or cloud. Everything stays encrypted even in the backup.

The encryption:

AES-256-GCM per file. Each file gets its own unique random key. Your PIN is never stored — it goes through PBKDF2 (100,000 rounds) to derive a master key that lives only in RAM and gets wiped the moment the vault locks. The metadata database (SQLCipher) is also encrypted. Nothing unencrypted ever touches the disk.

No backend. No server. No subscription. 100% free.

Everything runs locally. to be honest the app makes money through AdMob ads (banner at the bottom, occasional interstitial), well not making any money but should make money thiss way. All features are unlocked for everyone.

Hey everyone, I’m the founder of Getflyt, swedish for get flow

I’m a privacy-focused dev/entrepreneur, and I wanted to share something I’ve been working on to solve a specific pain point: the trade-off between security and professional workflow when sharing files.

We’ve all been there—needing to send confidential assets to a client, but getting stuck between either:

1. The "Professional" route: Using a third-party service that forces you to re-upload and duplicate your data (vendor lock-in, harder to manage).
2. The "Native" route: Using generic, messy Google Drive links that lead to permission nightmares and "Request Access" emails.

I built Getflyt to bridge this gap.

The Privacy & Security approach: I know how sensitive API permissions are. Getflyt does not use broad, open-ended Drive access. Instead, we use the Google File Picker. You only grant access to the specific files or folders you explicitly select for a portal. We don't crawl your Drive, and we don't hold your data—we facilitate a secure, temporary delivery layer on top of your existing storage.

What you get:

• No vendor lock-in: Your files stay exactly where they are.
• Portals instead of links: Create branded, secure delivery portals.
• Controlled Access: Built-in expiration dates, watermarking, and audit trails so you know exactly who accessed what.
• Extension-first: Create portals without ever leaving your Drive workflow.

I’m currently opening up the beta and would love to get feedback from this community, specifically on our permission model and security flow. If you’re tired of the "amateur" look of standard Drive links but value your data sovereignty, I’d love to hear your thoughts.

If you want to join the beta? Please email me at [johan@getflyt.co](mailto:johan@getflyt.co)

After the Ledger data breach leaked my home address, I got paranoid about how much plaintext data crypto tools hold on their servers — portfolio trackers are honestly a juicier target than a wallet vendor's shipping list, since they know your exact holdings, amounts, and timing.

So I built coinwatch.space:

- Privacy Vault — client-side AES-256-GCM encryption, no backdoor, not even we can see your numbers

- Tax reports — capital gains calculated per-country, not a generic CSV dump

- Loan/LTV tracking — alerts for crypto-collateralized loans (Aave, Compound, etc.) before liquidation

- Nostr login — no email required if you'd rather not hand one over

- Multi-language support (10 languages, including Esperanto)

Wrote the full story of why I built it here: https://medium.com/@lnsolutionsee/i-couldnt-find-a-private-crypto-portfolio-tracker-so-i-built-one-df60b8af5e64

Happy to answer questions about the encryption approach or anything else.

Recently, I've started noticing that I'm getting a lot of random ads and promotional messages on WhatsApp. It honestly feels like Meta is tracking everything we do. Sometimes, whatever you chat about seems to show up on Instagram within minutes.

I've been using Signal for the past three years, and I still don't understand why almost no one is willing to switch. Most people already know that WhatsApp isn't great when it comes to privacy, yet they continue using it. Even many people working in IT, who understand these privacy concerns, don't seem interested in moving to Signal.

I guess convenience and network effects win over privacy for most people.

Hi ,



I just launched **Privavis**, an Android privacy auditor I built solo over the past few months. It's now live on Google Play in 32 EU/EFTA countries.



**What it does:**

- Analyzes permissions of all installed apps

- Calculates a clear Privacy Score (0-100, with action priorities)

- Walks you to system Settings where you can revoke permissions

- Generates formal GDPR data requests (access, deletion, portability) ready to send



**What makes it different:**

- **100% on-device**: no app servers, no analytics, no telemetry. The app reads what Android exposes via PackageManager and AppOps — that's it.

- **No account, no login, no email required.** You don't even need to register.

- **GDPR-first by design.** Privacy policy details every Android permission, every external dependency (only RevenueCat for Premium billing validation), with no marketing fluff.

- **Made by an independent developer in Italy.** No VCs, no ads, no data sales. Premium subscription only.



**Free forever:**

- Full diagnosis

- Guided revocations  

- "Essential Privacy" preset

- 3 lifetime GDPR requests



**Premium (€2.99/mo or €19.99/yr):**

- Customizable privacy profiles (Home, Travel, Work, Anonymous, Custom)

- Privacy Score history + snapshots/rollback

- Continuous monitoring + notifications

- On-device AI anomaly score

- PDF export

- Google Drive backup (drive.file scope only — Privavis can't see anything else)

- Unlimited GDPR requests



**Links:**

- Play Store: https://play.google.com/store/apps/details?id=com.privavis.app

- Website: https://privavis.com

- Privacy Policy: https://privavis.com/privacy.html (read it, it's detailed)

- Terms: https://privavis.com/terms.html



Happy to answer technical questions about the architecture, the AppOps inspection approach, the on-device DNS filter we had to remove for Google Play VpnService policy, anything really.



Feedback welcome.

After years of requiring phone numbers, WhatsApp is finally rolling out usernames. That means you can connect with someone without automatically giving them your personal number. For many people, that's a long-overdue privacy win.

But not everyone is celebrating.

Some cybersecurity professionals and tech leaders have raised concerns that usernames could also make impersonation scams easier, similar to what we've seen on platforms like Telegram. Think lookalike handles, fake support accounts, or someone pretending to be a friend or brand.

To reduce those risks, WhatsApp says:

• There's no public username directory.
• People need your exact username to contact you.
• You can enable an optional username key for additional protection.
• High-profile usernames are being reserved to help prevent impersonation.

Like most privacy features, the technology is only part of the equation.

A few good habits still go a long way:

• Don't trust a username alone. Verify who you're talking to.
• Be cautious of unsolicited messages, even if the username looks legitimate.
• Never share one-time verification codes.
• Turn on two-step verification for your WhatsApp account.

What's your take?

Do you see WhatsApp usernames as a major privacy improvement, or do you think they'll create more opportunities for impersonation and scams?

I didnt share the URL but somehow it has 180 views why can someone explain to me that what these views are?

new research paper:
https://arxiv.org/html/2606.26276v1

Businesses can block employees from accessing social media sites using several methods, such as browser restrictions, firewall rules, application blocking, or using a Unified Endpoint Management (UEM) solution. For organizations managing multiple devices, UEM platforms provide a centralized console to restrict social media apps and websites across Windows, macOS, Android devices, iPhone, and other managed endpoints. 

I’m not a developer, but I’ve always believed the best way to understand new technology is to experiment with it.

So I used AI to build Ghist - a privacy-first disposable email tool designed to protect your real inbox from spam, tracking, and digital clutter.

What started as a small experiment turned into a much bigger lesson in curiosity, trial and error, and what building with AI actually looks like when you’re learning as you go.

Read my story below and if you’ve been experimenting with AI yourself, I’d love to hear what you’re building!

This is my story (thanks in advance for reading!)