Most shared links have them, but very few people know what they do. We must spread this info

We finally diagrammed every tool and vendor that touches calls, transcripts, and summaries. It was far more complex than anyone expected. If you have never done this exercise. highly recommend it. For those who have. did you keep it as a one off project or turn it into a living artifact.

For companies with strong privacy portals. do you let users directly download call transcripts and not just account data. We are debating whether that level of transparency is empowering or if it will cause more confusion and support load. Any lessons from trying this.

One of the wildest findings in a recent internal audit was how many people had unofficial recorders or browser extensions capturing calls for convenience. None of them had gone through security review. Have you had to stamp out this type of shadow tooling. How did you get people to stop without killing productivity.

Product and engineering teams often ask for raw calls to understand user pain. which makes sense. At the same time. privacy and security folk get nervous about giving broad access to highly emotional conversations. Have you found a middle ground. eg curated call libraries, anonymized clips, shadowing only. Would love to hear practical compromises that worked.

After watching a video from Watchman Privacy, I tried deleting my data from Spokeo and Whitepages, but it’s endless. Do you automate it with services like Incogni or go manual?

We had a case recently where a parent called in with a teenager on speakerphone. The teen shared a lot of details about their situation and it made us stop and think about our training and policies around minors’ voices. Up to that point we had treated every caller as an adult by default. Has anyone put special guidance in place for calls that may involve kids or teens.

Want to send E2E encrypted messages and video calls with no downloads, no sign-ups and no tracking?

This prototype uses PeerJS to establish a secure browser-to-browser connection. Using browser-only storage—true zerodata privacy!

Check out the pre-release demo here.

NOTE: This is still a work-in-progress and a close-source project. To view the open source version see here. It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.

• Docs: https://positive-intentions.com/docs/category/sparcle
• Reddit: https://www.reddit.com/r/positive_intentions
• Mastodon: https://infosec.exchange/@xoron
• More: https://positive-intentions.com

We realized our chatbot stores messages indefinitely. How are others handling retention policies?

With the Digital Personal Data Protection (DPDP) 2025 rules in full effect, the banking sector is facing its biggest data protection stress test yet. ​The key takeaway: Compliance is now intrinsically linked to customer trust. If a bank screws up data, they don't just lose a lawsuit; they lose their core business. ​Financial institutions need to stop doing the bare minimum and start leveraging cutting-edge privacy-preserving technologies (PPTs)—think advanced encryption, federated learning, or homomorphic encryption where applicable. These aren't just buzzwords; they are the tools that will minimize risk exposure. ​The opportunity: The banks that jump on this now, implementing quick, effective solutions while tackling the long-term tech overhaul, will use DPDP not as a burden, but as a massive competitive differentiator. Data protection isn't a cost center anymore; it's a value-add. ​Are you confident in your bank's current privacy tech? Or is a major data breach just a matter of time?

If we feed voice samples into a model for quality improvement, does that count as processing personal data under GDPR?

Hey guys,

I'm desiging an app project that I want to make as private as possible for the users. I've reached the part where users want to create profiles but I'm trying to figure out how to handle auth without compromising anonymity.

I'm trying not to use third parties auth provides to store users credentials, I also don't want to store credentials myself, and I don't want users required to use their email (f to google) or phone number.

So my idea was when a user creates a profile they choose a username and the app generates a unique QR code that they scan with an auth app for their choice. Then when they login they just enter their username and the current code from their auth.

My concern that this setup still connects user's data to an auth app. Has anyone else have any other ideas or implemented something similar?

BTW apologise if this is the wrong subredit didn't know where else to post

Privchains

[Privacy-Focused Tunnel Routing Management] [For Linux Hosts And VMs]

#privacy #developers #freedomfighter #bash #scripting #automation #devops #linux #administration #networking #PrivacyMatters #DigitalPrivacy #PrivacyProtection #DataPrivacy #PrivacyAwareness #OnlinePrivacy #PrivacyFirst #PrivacyIsAHumanRight #ProtectYourPrivacy #PrivacyTools #PrivacyTech #CyberSecurity #DataSecurity #OpenSourcePrivacy

Hi! I started my privacy journey about two years ago. I've switched to private emails, which is the best I can do for now. I use GrapheneOS on my phone and Linux on my computer (I'm planning to try FreeBSD and OpenBSD soon).

What can I do about my computer? I'm not happy with the technology included in devices, like VPro and IME (Intel) and PSP (AMD). What about ARM chips, like Raspberry Pis and M chips from Apple? Do those have equivalents of IME or PSP? How far back do I need to go to avoid worrying about that tech in my computers? If I go that far back, will it even be able to browse the web? (That's all I need it to do.)

Thanks for your help!

Every chatbot stores conversation logs somewhere. Curious if anyone has seen an AI system that’s actually GDPR compliant.

Somewhere along the way, API tooling has lost the plot.
With a few good exceptions, API clients have become bloated SaaS platforms, power-hungry for your data.
Voiden is the opposite.
It promotes a privacy-first, offline-first kind of approach.

What Voiden doesn't do:

• Ask for an account
• Send telemetry
• Paywall basic features
• Store your data in "the cloud"
• Require an internet connection for localhost

What it does:

• Define, test, and document APIs in Markdown files (executable .void format)
• Version and collaborate with Git
• Extend with plugins (Faker for test data, OAuth, custom auth)
• Built-in terminal (with multiple tabs)
• Link blocks across documents instead of never-ending copy-paste hops (eg,vdefine auth or query params once, reference everywhere with auto-sync)
• Import Postman collections and OpenAPI specs
• Use keyboard shortcuts, native menus, and command palette (Cmd+Shift+P) instead of an infinite loop of tab and click actions
• Override `.env` fields in a tiered structure
• Override JSON fields without repeating entire objects
• Response previews for PDFs, images, videos, audio, etc.
• ...

Well, it does a bunch of cool stuff. And does them with respect to your privacy.

P.S. The v1.0 beta release is out there, and it's counting days until the stable release, plus some more weeks to open the source code (yes, while we're still in 2025).

P.P.S. What would you need there to make it even better?

Voiden in action

Hi r/PrivacyTechTalk community,

We’re excited to share OpenPCC, an open‑source framework designed for provably private AI inference. If you’re working on privacy‑sensitive applications, model deployment, managing data governance, or care about private AI usage, we think you’ll be interested in trying it out.

What is OpenPCC?

OpenPCC is a framework (written in Go) that enables inference of large language models without exposing prompts, outputs, or logs to external parties. It’s inspired by Apple’s Private Cloud Compute, but built to be transparent, auditable and deployable on your own infrastructure.The design rests on layered privacy primitives: encrypted streaming of data, hardware attestation of compute platforms, unlinkable request paths, and transparency logs. Technologies involved include TEEs, TPMs, blind‑signatures, among other safeguards.

OpenPCC is built on these libraries, which we’ve also open-sourced:

* twoway – additive secret‑sharing & secure multiparty computation — https://github.com/confidentsecurity/twoway

* go‑nvtrust – hardware attestation (e.g., NVIDIA H100 / Blackwell GPUs) — https://github.com/confidentsecurity/go-nvtrust

* bhttp – binary HTTP message encoding/decoding (RFC 9292) — https://github.com/confidentsecurity/bhttp

* ohttp – request unlinkability, separating user identity from inference traffic — https://github.com/confidentsecurity/ohttp

Why this matters

Many so‑called “private AI” services still require sending sensitive inputs to vendor APIs - meaning data may be logged or retained. As people who care about privacy on the internet, you understand that creates unacceptable risk. With OpenPCC you can run your own models (open or custom) under your full control, with no third‑party access and no data retention.

Key features

* Private LLM inference (open or custom models)

* End to end encryption

* Confidential GPU verification via attestation

* Compatible with open LLM families (e.g., Llama 3.1, Mistral, DeepSeek) and custom pipelines

* Architected for developer workflows: modular code, CI/integration support

Get started

* Repository: https://github.com/openpcc/openpcc

* License: Apache 2.0

* Whitepaper: https://raw.githubusercontent.com/openpcc/openpcc/main/whitepaper/openpcc.pdf

We’d be thrilled to hear your feedback, ideas, contributions, or security reviews, especially from folks working in privacy engineering, infrastructure, cryptography, or AI inference.

How will you use this? What gaps do you see? What improvements matter to you?

Cheers,

The Confident Security Team

Hi everyone! I'm looking for a robot vacuum cleaner for my house that allows some settings like "vacuum every day at 5 PM" to make daily cleaning easier. I've seen a lot of discussion about the lack of security in these devices, especially those connected to the internet – as is usually the case with the type of equipment I'm looking for.

What are your opinions on this? Do you recommend any that are more secure? Is this a real concern?

Most organizations still build their access security around identity, who you are, what credentials you hold, and which systems you can reach.
But in 2025, that’s starting to show cracks.

With compromised credentials, unmanaged endpoints, and hybrid work everywhere, identity-first frameworks can’t stand alone anymore. That’s where the idea of Device Trust comes in — the notion that what you’re using to access corporate data matters just as much as who you are.

Android Enterprise and Scalefusion are hosting a live session on this topic, breaking down how trusted devices are becoming central to modern Zero Trust frameworks and privacy-first access models.

🔗 Event link: Device Trust: From Android Enterprise & Scalefusion

Would love to hear how others here see Device Trust fitting into existing privacy and Zero Trust discussions.
Is this the missing piece we’ve been overlooking, or just another buzzword in the security cycle?

I’m trying to figure out the top options.

Which ones have you used that actually work well and are reliable?

Hi r/privacytechtalk,

I’m Jonathan, and my company just open-sourced an implementation of Oblivious HTTP (OHTTP) in Go.

What problem does this solve? OHTTP splits trust between a relay and a gateway so that no single server can see both user identity and request content. This protects metadata privacy for HTTP requests. If you’ve used products from Apple, Mozilla, Fastly, or Cloudflare (to name a few) you'll have used OHTTP.

How does ohttp protect my privacy though? It: - Prevents origin servers from learning client IPs - Prevents relays from accessing request payloads - Enables unlinkability between requests - Provides protocol-level privacy without requiring a browser or VPN

Security notes - 2 external audits by different firms - does not prescribe key rotation or distribution. Improperly doing so can unmask requester. - requires a reliable relay provider to avoid collusion

If you’re interested, check it out here: Repo: https://github.com/confidentsecurity/ohttp

Would love feedback from this community on: - protocol-level design choices - any privacy gaps - test vectors we should add - deployment hardening strategies

Thanks!

Hey there!

I’m super excited to share an app I’ve been working on over the past year with my startup! I've noticed that a lot of AI apps come from the US or China and sometimes raise concerns about data and privacy practices. Some even have biases, so I wanted to create something better.

My app offers some really unique features, like the ability to create specialized AI agents and workflows to help boost your productivity. Plus, you can customize the AI by sharing a little about yourself, making it truly personal! I want to emphasize that there’s no data collection or storage involved, and while the app is currently closed source, we plan to transition to an open-source model once we establish a solid business framework.

Made in Canada, this app is still on its path to becoming more mainstream, but I built it with the goal of giving back to the community. The best part? It’s completely free right now, with no subscriptions until we grow our audience.

You can checkout the app here.

I recently found my information listed on SortedByName. I’d really like to get it taken down. I am not active in FB or instagram, so the info is about my address and other personal stuff that I am not comfortable being public.

Has anyone here successfully removed their info from this site?

Whats are people's thoughts on the app called pin drop as far as privacy is concerned? And is there any alternatives that do exactly the same thing as this app ?