Your digital profile isn’t just your search history. It includes your passwords, emails, contacts, location history, the metadata of your daily life (dates, times, durations and a whole lot more). This data gets sold to brokers, collected by governments, exposed in breaches and used to manipulate what you buy, believe and vote for.

Privacy and security are not the same thing. Security is about keeping people out, by using strong passwords, two-factor authentication, encryption. Privacy is about reducing what’s collected about you in the first place. You need both, but don’t confuse them.

You don’t need to become anonymous. You need to reduce your exposure. That means fewer companies collecting your data, less of your behaviour being tracked, and more control over what you share and with whom. That’s achievable. This guide shows you how.

Not all privacy advice applies to everyone. What matters is reducing your exposure in the areas that are relevant to your life. You don’t need to do everything in this guide. Start where it makes sense and build from there.

Most data collection happens passively. You don’t hand it over deliberately, it leaks through the tools you use every day. Switch your browser, change to a private DNS, use a different email provider. Small changes compound quickly.

How to use this guide:

• Work through the sections in order or jump to what’s relevant
• Tick off items as you go
• Click Done when you’ve finished a section
• Don’t rush, small changes that stick are better than doing everything at once

What is currently happening?

You open an account to order some ink cartridges, book a train ticket, or reserve a table at a restaurant. You use a Gmail account to receive the confirmation and pop a reminder in your calendar app.

In a matter of minutes you’ve just handed over your name, home address, email, phone number, location and card details to the retailer, the email provider, and data brokers.

Within a year, this data could easily be on 50+ databases, where they can start to compile a Digital Profile that can then be sold on to advertisers, insurers, and governments. And if any single company or organisation in this chain suffers a breach, your personal details are exposed. Now think of how many times you’ve done that — hundreds. That’s a lot of data and personal information.

What can your Digital Profile include?

Each section in Core Privacy targets one or more of these layers directly.

• Personal details (Name, DOB, Nationality, Address)
• Location history (Favourite routes, current location)
• Behavioral data (Search keywords, medical queries, hobbies)
• Communication logs (Emails, chat logs, contact lists)
• Device fingerprints (Screen size, browser type, active times)
• Photos (Face, eyes, fingerprints, mood, location metadata)

And if that wasn’t enough, take a look at Meta’s data collection policy for the full potential of data collection. Full article by Its Not Nicole can be found here.

Why does this matter?

You might argue you have nothing to hide or you’re not important. Well, hackers or scammers don’t care for starters. But what if a political party gets in power in the future that isn’t keen on your comments, posts or activities? Or even worse, you already live in or visit a country that punishes or harms you for your online activity?

Yes, it’s your data. You’re very welcome to hand it out as you feel, but would you broadcast your search history and browsing, medical conditions, intimate messages or fringe views to strangers in the street? Would you let people see what you watch on telly or see what you’re up to behind closed doors? Would you tell them where you go every day, at what time and for how long? It’s your data, your privacy and your right.

Here’s a few resources to check out

We highly recommend checking out these privacy advocates for a deeper dive on all things digital privacy and security.

• Naomi Brockwell — simple, clear YouTube videos
• Sooraj Sathyanarayanan — a comprehensive list of privacy tools
• Ghost — technical deep dives on reducing your data leaking

• Install Brave browser (5 mins) Visit brave.com/download. They don’t track your usage, collect data or advertise to you. Turn on Shields to block adverts, cookies and tracking. Give Brave Search and their AI Leo a go too — they don’t store your searches or conversations.

• Set up a Proton account (10 mins) Visit proton.me then download their password manager Proton Pass. Set super strong passwords, sync them across multiple devices, no need to remember them or copy and paste them.

• Move from WhatsApp to Signal (5 mins + ongoing) Download from Play Store. Signal collects almost no data whatsoever and has no access to your messages, contacts or call logs. Run Signal alongside WhatsApp and slowly migrate people over as and when.

• Sign up for a privacy respecting email address (5 mins) Visit proton.me/mail. They don’t read your emails, docs or use your conversations to train their AI models. Stop using your name and DOB in the address.

• Move to an encrypted cloud storage provider (10 mins) Check out alternatives in the Cloud Storage section. They won’t use your photos or snoop on your documents.

• Check Have I Been Pwned (30 secs) Visit haveibeenpwned.com. See if your email has been leaked in a data breach. If so, change it and the password immediately.

• Review your apps (10 mins) Delete any apps you don’t use — they still collect data and drain your battery even when not in use.

• Review your app permissions (10 mins) Check what permissions you’re giving all your apps. Do they need access to your pictures 24/7? Do they need your exact location, microphone or phone contacts?

• Check your app settings (30 mins — deliberately difficult) Find the Settings cog in most apps, then dig around for Privacy and Security settings. What is ON? Limit telemetry, switch off advertising settings and check for AI or ‘smart’ features — these can scrape anything to feed AI models.

• Check out PrivacyPack (5 mins) Visit privacypack.org. Brilliant alternatives to the standard Google, Meta and Microsoft products.

• Add a 3-month reminder to your calendar (2 mins) Add a recurring reminder every 3 months to: delete unused apps, review app permissions and settings, check Have I Been Pwned, unsubscribe from unwanted emails and change any compromised passwords.

What is it? DNS translates human-readable web addresses (e.g. www.google.com) into machine-readable IP addresses (e.g. 142.250.190.4). By default, your Internet Service Provider (ISP) handles this, allowing them to see every website you visit.

What about privacy? Without a privacy-focused DNS, your ISP and default DNS providers build a complete log of your browsing history. This data can be sold to advertisers, used to throttle your connection speeds, or handed over to authorities without a warrant in some jurisdictions. The default DNS providers are usually Google’s 8.8.8.8 or Cloudflare’s 1.1.1.1.

We recommend NextDNS — a privacy-focused, configurable DNS provider that blocks ads, trackers, and malware at the network level.

• Visit NextDNS.io and create a free account.
• Set up a profile for each specific device (Mobile, Laptop, Router).
• On your mobile and laptop download the NextDNS app (Android/iOS/Windows/Mac) and log in.
• Follow the simple Setup Guide for the specific device and operating system.
• Set it up on your router for whole-home coverage — log in to your router and enter your NextDNS ID into the DNS settings (usually under WAN/Internet settings).
• On your preferred browser go to Settings > Network (or similar), enable “Use Secure DNS”, select “Custom” and enter your NextDNS URL.
• Tip: Start with conservative blocklists. If a website breaks, add its domain to the Allowlist in your NextDNS dashboard (e.g. example.com, not the full URL).
• IP Leak — after setting up your private DNS, test to see if it’s leaking.

What is it? A VPN creates an encrypted tunnel between your device and a VPN server. All your internet traffic passes through this server, masking your real IP address and location from the websites you visit.

What about privacy? Without a VPN, your ISP can see every unencrypted site you visit and can throttle your speed for specific activities like streaming. On public Wi-Fi, anyone on the same network can intercept your data — passwords, emails — if the site doesn’t use HTTPS.

We recommend Proton VPN — open-source, based in Switzerland with strong privacy laws, and a strict no-logs policy.

• Download the app from Proton.me/vpn.
• Create a free account — no credit card required.
• Install the app on your phone and computer.
• Connect to the “Fastest” server or a specific country.
• Tip: Add the VPN to your easy access menu so you can switch it on and off quickly — some sites (e.g. banking apps) can block VPN connections.
• IP Leak — after setting up your VPN, test to see if it’s leaking your location.

What is it? Your email is your digital identity. It links to banking, social media, and shopping accounts. Using a single email address creates a centralised target for data brokers and hackers.

What about privacy? Using yourname@gmail.com everywhere means if one service is breached, attackers can use that email to try password resets on your bank, social media, and other accounts. It also allows trackers to link your shopping habits to your email address.

We recommend Proton Mail — end-to-end encrypted and based in Switzerland. Do not use your real name or date of birth in the registration.

• Sign up at Proton Mail.
• Install the app on your phone and computer.
• Go to Settings > Privacy and Security to enable additional features.
• Via Proton Pass, create email aliases to segregate sign-ups into separate groups — all emails forward to your main inbox. A few suggestions to get started:
  • random.official@youralias.com (Banks, Government)
  • random.shopping@youralias.com (Online Stores, Subscriptions)
  • random.social@youralias.com (Social Media, Forums)
  • random.temp@youralias.com (One-off sign-ups, Newsletters)
• Tip: Manage your email aliases at Simple Login using your Proton login details.

What is it? Messaging apps are a gateway to your relationships and your habits — who you call, when you call, where you call from and for how long.

What about privacy? Over 3 billion people use WhatsApp. Although Meta can’t see your messages, they collect a lot of data from your phone which is used to build a digital profile for advertising.

We highly recommend Signal — it feels a lot like WhatsApp, it’s easy to use, they can’t read your messages and collect next to none of your data.

• Download Signal.
• Don’t want to broadcast your phone number? Go to Settings > Privacy > Phone number.
• Run Signal alongside WhatsApp and slowly migrate people over as and when they are ready.

What is it? Passwords are the first line of defence. Weak or reused passwords are the cause of 80% of data breaches. A good password manager and two-factor authentication (2FA) app makes online life easier and more secure.

What about privacy? If you use an easy to guess password (e.g. Password123) or reuse a password, a single breach on one website can lead to attackers trying that same password on your bank, email, and social media. SMS-based 2FA (those 6 digit confirmation codes) is also insecure and vulnerable to SIM-swapping attacks.

We recommend Proton Pass — end-to-end encrypted, easy to use and synced between phones and laptops.

• Download Proton Pass.
• Add login details and new passwords as you go, don’t try to change all your passwords in one go.
• Add the browser extension to your desktop and auto-fill passwords.
• For greater security download Proton Authenticator and set up 2FA for critical accounts (Email, Bank, Social). You’ll need to go into Settings for each app to find 2FA.
• Tip: Password managers often copy passwords to your clipboard. Enable “Clear clipboard after X seconds” to prevent other apps from reading it.

What is it? Your browser is the window to the internet — it’s how you access websites, email services and do your shopping. Your search engine is how you interact with the browser to find online information.

What about privacy? Default browsers like Chrome and Edge track your browsing, sell data to advertisers and integrate AI that harvests your inputs. Default search engines record and track your search history and keystrokes — even if you don’t click search — to train AI models and build a profile of every site you visit.

We recommend Brave Browser and Search — no ads, no tracking, no search logs and super easy to use.

• Download from Brave.com.
• Import your bookmarks (optional, but easy).
• Go to Settings > Shields and ensure “Block Fingerprinting” and “Block Cookies” are turned on.
• In Settings > Search Engine, set the default to Brave Search.
• Cover Your Tracks — find out how well your browser now protects you from tracking.

What is it? Calendars such as Google, Outlook or your default provider are accessed via your account and synced across devices. By default, the provider has full access.

What about privacy? Your calendar is usually not encrypted, so your provider can see your schedule, private meetings, birthdays, medical appointments and when and where you go on holiday. All of this can be used to build an accurate profile of your personal life.

We really like Proton Calendar — it’s slick, easy to use, they can’t see your entries and you can easily sync between devices.

• Download Proton Calendar.
• If you want to import your current calendar from Google, go to Settings > Import from Google.

What is it? Cloud storage (Google Drive, OneDrive, Dropbox) stores your files on remote servers. By default, providers can scan your files for content — to serve ads or for legal compliance — and hold the encryption keys.

What about privacy? Providers can scan your files for keywords to train their AI. If their servers are breached, your unencrypted data is exposed. Legal requests can force them to hand over your files without your knowledge.

We recommend Proton Drive — slick, easy to use, they can’t see your files and you can easily back up your phone photos.

• Download Proton Drive.
• Add a passcode and/or 2FA in Settings for added security.

What is it? We are all familiar with Zoom, Teams, Meet or WhatsApp video calls — they can be great for connecting with family, friends or colleagues.

What about privacy? Although providers often offer an encrypted option, it is sometimes not switched on by default, does not apply to group meetings, or limits the app’s functionality when enabled.

Brave Talk is easy to use, built into the Brave browser, super private and you can screenshare too.

• Simply visit talk.brave.com.
• Click the ‘person +’ icon to invite others via a link.

What is it? Microsoft Word and Excel and Google Docs and Sheets. We’ve all used them to create and store important documents — from letters and contracts to financial records and medical data.

What about privacy? These are private documents, or so you thought. Both Microsoft and Google can access their content, especially if you have Editor or AI features enabled. This information can then be used to train their AI models.

We recommend ONLYOFFICE for compatibility and familiarity.

• Download ONLYOFFICE.
• If you prefer to stick with Microsoft or Google, check your settings for Editor or AI features and turn them off.
• Move sensitive files to a local drive, disable OneDrive or use an encrypted cloud service.

What is it? Modern AI features (Copilot, Gemini, OpenAI, Claude) are everywhere now, from chat bots and image creation to coding and AI agents. Many of these smart features are on by default, hidden deep in settings, with new capabilities enabled on every software update without your explicit consent.

What about privacy? Every prompt you send to a cloud AI is stored, analysed and potentially used to train future models. Your data is scraped from your personal emails, photos, private messages, documents and chat logs.Your questions reveal your health concerns, financial situation, relationships and beliefs. Most people wouldn’t hand that to a stranger, so why hand it over to a corporation?

How to limit AI’s reach

• Check Settings: Go to every app and device settings. Look for options similar to “Help Improve”, “Personalise”, “AI Features” or “Smart Features” — turn them off.
• Disable Cloud Processing: Turn off any “Send to Cloud” options for voice assistants and keyboards.
• Local AI: Install a local model on your device (e.g. Llama3.2:1B) — none of your data is leaked.
• Private AI: Use Brave’s AI Leo, built into the Brave browser, which is designed to not store your chat history for training.

Content coming soon.

Privacy is not a one-time setup. It requires regular checks to ensure settings haven’t reverted and new threats are addressed. Don’t be overwhelmed — build habits that stick and take your time to implement changes.

Monthly Checklist

• Review Permissions: Check phone and desktop app permissions (Location, Camera, Mic). Revoke unused ones.
• Check for Breaches: Run your emails through Have I Been Pwned. Change passwords immediately if breached.
• Update Settings: After Operating System updates, re-check privacy toggles (AI, Diagnostics, Smart Features).
• Clean Up: Delete unused apps — they collect data even when not in use.
• Clipboard: Clear your phone and desktop clipboard regularly.
• Recent Files: Search your phone for and delete old screenshots, downloads and edits. These often contain personal data you forgot about.
• Add a recurring reminder to your calendar every 3 months to: delete unused apps, review app permissions and settings, check Have I Been Pwned, unsubscribe from unwanted emails and change any compromised passwords.