The Privacy Page
Everything you need to take back your privacy: what to do first, a step-by-step checklist, the tools we trust, how to spot trackers and stalkerware, and your rights in Canada. Privacy is the defensive side of OSINT: if an investigator can find it, so can anyone else.
Start here: 5 quick wins
These five steps block the most common attacks and take about an hour in total.
Let it create a different long password for every account, so one breach can’t unlock the rest.
Start with your email, bank and phone account. An authenticator app or security key beats text messages.
Search your email on Have I Been Pwned and change any password that was exposed.
Remove location, microphone, camera and contacts access from apps that don’t need it.
End-to-end encrypted messages and calls by default, and you can hide your phone number behind a username.
The privacy checklist
29 steps in six areas. Tick them off as you go.
Accounts
Phone
Browser and search
Communications
Your information online
Home and devices
The privacy toolkit: 33 tools we trust
Chosen for strong privacy, a good track record and ease of use. Free and open-source options come first wherever they are as good as paid ones.
Password managers
A password manager creates and remembers a unique password for every account. It is the single biggest privacy and security upgrade most people can make.
Open-source and independently audited. The free plan stores unlimited passwords on unlimited devices.
Visit Bitwarden →From Proton in Switzerland. The free plan includes unlimited passwords and devices plus 10 hide-my-email aliases.
Visit Proton Pass →Polished and easy for families, with Travel Mode to hide vaults when crossing borders.
Visit 1Password →Works offline: your vault is an encrypted file that you store and back up yourself.
Visit KeePassXC →Two-step login (2FA)
A second step stops most account takeovers even when a password leaks. Authenticator apps and security keys are much safer than text-message codes, which can be stolen by SIM swapping.
Open-source authenticator for phone and desktop with end-to-end encrypted backups.
Visit Ente Auth →Open-source authenticator for Android with encrypted local backups.
Visit Aegis Authenticator →A physical security key. It cannot be phished, which makes it the strongest option for important accounts.
Visit YubiKey →Encrypted messaging
End-to-end encryption means only you and the person you are talking to can read your messages. Not even the app company can.
Encrypted messages and calls by default, run by a nonprofit. Usernames let you chat without sharing your phone number.
Visit Signal →No phone number and no user ID at all, for people who need to leave as little trace as possible.
Visit SimpleX Chat →Messages are end-to-end encrypted, but the app is owned by Meta and collects information about who you talk to and when.
Visit WhatsApp →Private email and aliases
Your email address is the key that links your accounts together. Private email providers and aliases make that link harder to follow.
Encrypted email based in Switzerland, with a free plan.
Visit Proton Mail →Encrypted email from Germany that also encrypts subject lines, contacts and calendars.
Visit Tuta →Creates email aliases that forward to your real inbox, so you can turn off any alias that gets spam or leaks. Part of Proton.
Visit SimpleLogin →Browsers
Your browser sees almost everything you do online. These block trackers or resist fingerprinting out of the box.
Independent of Google and still runs the full version of uBlock Origin. Set Enhanced Tracking Protection to Strict.
Visit Firefox →Built with the Tor Project to make every user look alike to trackers. Designed to be used with a VPN.
Visit Mullvad Browser →Routes your traffic through the Tor network to hide your location. Slower, but the strongest option for anonymity.
Visit Tor Browser →Private search
Search history reveals your health, money and relationships. These engines do not build a profile of you.
Ad and tracker blocking
Blocking trackers stops companies from following you from site to site, and it also blocks many malicious ads.
The best-known open-source content blocker. The full version runs on Firefox; Chrome users get uBlock Origin Lite because of Chrome’s extension changes.
Visit uBlock Origin →Blocks trackers and malicious sites at the DNS level on every device, including phones and smart TVs.
Visit NextDNS →Encrypted storage and backups
Encrypt files before they reach the cloud, so a breach or a subpoena at the provider exposes nothing readable.
Encrypts your files before you upload them to any cloud, including Google Drive, Dropbox or OneDrive.
Visit Cryptomator →End-to-end encrypted photo backup, an alternative to Google Photos and iCloud Photos.
Visit Ente Photos →Data broker removal
Data brokers and people-search sites collect and sell your address, phone number and relatives. You can opt out yourself for free, or pay a service to keep doing it. Most services focus on US brokers, so check Canadian coverage before you pay.
Shows which sites list you before you pay, with a free scan, and officially serves Canadian residents.
Visit Optery →Phones
Your phone carries your location, contacts, photos and messages. Hardened options exist for people at higher risk.
An optional extreme protection mode for people who may be targeted by sophisticated spyware.
Visit iPhone Lockdown Mode →One switch in Android 16 that turns on theft protection, blocks 2G networks, blocks unknown apps and restarts the phone after 72 hours locked.
Visit Android Advanced Protection →A hardened, privacy-focused version of Android. It runs on Google Pixel phones; Motorola announced a partnership in March 2026 for future devices.
Visit GrapheneOS →Phone privacy settings
iPhone
- Safety Check (Settings › Privacy & Security › Safety Check) shows who you share your location and data with, and lets you stop sharing in one place.
- Tracking: in Privacy & Security › Tracking, turn off “Allow Apps to Request to Track”.
- Location: review Location Services app by app, and turn off Precise Location for apps that only need your city.
- Lock screen: limit what is shown when your phone is locked, such as message previews and Control Centre.
- Lockdown Mode: for people who may be targeted by spyware (Privacy & Security › Lockdown Mode).
Android
- Permission manager (Settings › Security & privacy › Privacy) lists every app with access to location, camera and microphone.
- Privacy dashboard shows which apps used sensitive permissions in the last 24 hours.
- Ads: delete your advertising ID in Settings › Security & privacy › Ads (wording varies by phone maker).
- Unknown tracker alerts: keep them on in Settings › Safety & emergency.
- Advanced Protection (Android 16): one switch for high-risk users that hardens the whole phone.
Am I being tracked? Trackers and stalkerware
Bluetooth trackers, stalkerware and shared accounts can all reveal where you are. Since May 2024, iPhones (iOS 17.5 and later) and Android phones (version 6.0 and later) alert you when an unknown tracker such as an AirTag is moving with you, and let you make it play a sound to find it.
Warning signs
- Someone knows where you have been or what you wrote privately
- An “unknown tracker” or “AirTag found moving with you” alert
- Unfamiliar apps, device-management profiles or accessibility permissions
- Fast battery drain or heavy data use you can’t explain
- Your Google or Apple account shows devices or sessions you don’t recognise
What to do
- Check signed-in devices and location sharing in your Google or Apple account
- Run Safety Check on iPhone, or review device admin apps on Android
- Change passwords from a device the other person has never touched
- Get advice from the Coalition Against Stalkerware or a local victim support service
See yourself like an investigator
Investigators use open sources to build a picture of a person. Do the same to yourself, then close the gaps. See the OSINT Research Hub for the methods.
Search yourself
- Your full name in quotes, with your city or employer
- Your email addresses, phone numbers and usernames
- Your profile photos in a reverse image search
- Your email on Have I Been Pwned to find breaches
Clean up
- Lock down old social media posts, friends lists and tagged photos
- Request removal from people-search sites, or use a removal service
- Ask Google to remove personal details such as your address or phone number from its results
- Delete accounts you no longer use
Your privacy rights in Canada
Businesses covered by PIPEDA must answer your request for the personal information they hold on you within 30 calendar days. They can extend by up to 30 more days in limited cases, but must tell you why within the first 30. Access should cost little or nothing. If you are refused or ignored, you can complain to the Office of the Privacy Commissioner of Canada.
Office of the Privacy Commissioner guide →Quebec has the strongest private-sector privacy law in Canada. Since September 2024 it includes a right to data portability: getting your information in a structured, commonly used format.
Commission d’accès à l’information →Alberta and British Columbia have their own private-sector privacy laws, and every province has rules for government bodies and health records. Your provincial privacy commissioner handles those complaints.
Find your provincial commissioner →Tabled on June 15, 2026, the Protecting Privacy and Consumer Data Act would replace the privacy parts of PIPEDA. It proposes a right to have your information deleted, a data mobility framework, a right to sue for damages and fines of up to $10 million or 3% of global revenue. As of October 2026 it is at second reading in the House of Commons and is not law yet.
Follow Bill C-36 →Register your home or mobile number on the National Do Not Call List to cut telemarketing calls, and report violations there.
National Do Not Call List →Access request letter (PIPEDA)
Copy this letter, fill in your details and send it to the company’s privacy officer. Their contact is usually in their privacy policy.
Privacy glossary
- Data broker
- A company that collects personal information from public records, apps and purchases and sells it to others.
- Doxxing
- Publishing someone’s private information, such as their home address, to harass or endanger them.
- End-to-end encryption (E2EE)
- Encryption where only the sender and receiver can read a message, not the company in the middle.
- Fingerprinting
- Identifying your browser from its unique combination of settings, fonts and hardware, even without cookies.
- Metadata
- Information about a message rather than its content: who, when, where and how often.
- Passkey
- A login that uses your device and fingerprint, face or PIN instead of a password, and cannot be phished.
- Phishing
- A fake message or website designed to trick you into giving up passwords or codes.
- SIM swapping
- When a criminal convinces your carrier to move your number to their SIM card, so they receive your text-message codes.
- Stalkerware
- Software secretly installed on someone’s phone to monitor their messages, calls or location.
- Tracker
- Code on websites and apps that records what you do and shares it with advertisers and data companies.
- Two-step login (2FA)
- A second proof of identity, such as an app code or security key, on top of your password.
- Threat model
- Working out who might want your information, what they could do with it, and how much protection you need.
Questions about online privacy
Is a VPN enough to protect my privacy?
No. A VPN hides your browsing from your internet provider and hides your IP address from websites, but it does not stop tracking cookies, fingerprinting, data brokers or account breaches. It is one tool among many: start with a password manager and two-step login.
Does incognito or private mode make me anonymous?
No. Private mode only stops your browser from saving history and cookies on your own device. Websites, your employer, your internet provider and your accounts can still see what you do.
Are free privacy tools safe?
Many of the best ones are free and open source, such as Bitwarden, Signal, Firefox and uBlock Origin. Be careful with free VPNs and free apps from unknown companies, which often pay for themselves by collecting and selling data.
How do I know if there is stalkerware or a tracker on me?
Warning signs include someone knowing things they should not, a battery that drains fast, or unfamiliar apps and device-management profiles. iPhones from iOS 17.5 and Android phones from version 6.0 alert you to unknown Bluetooth trackers travelling with you. If you suspect stalkerware, removing it can alert the person who installed it, so talk to a support service first and call 911 if you are in danger.
What are my privacy rights in Canada?
Under PIPEDA, businesses must tell you what personal information they hold about you within 30 days of your request, at little or no cost, and you can complain to the Privacy Commissioner if they refuse. Quebec’s Law 25 adds stronger rights, including data portability. A new federal law, Bill C-36, was proposed in June 2026 but has not passed.
What should I do first?
Install a password manager, turn on two-step login for your email, and check Have I Been Pwned. Those three steps take under an hour and block the most common attacks.
Cite or link to The Privacy Page
Free to share. Please link back.
Topics: online privacy, privacy guide, privacy checklist, privacy tools, password manager, encrypted messaging, private browser, data broker removal, stalkerware, PIPEDA, privacy rights Canada, Bill C-36, Quebec Law 25, digital security, Marie Landry Spy Shop