Glossary

Encryption where only the sender and recipient hold the keys; the server in the middle stores ciphertext it cannot read.

The data about your data — who, when, where, how big — that often leaks more than the message content itself.

A VPN that doesn't record connection details that could tie a session back to a specific user.

Running the server yourself instead of trusting a vendor's cloud — gains control, gains responsibility for uptime and backups.

An anonymity network that routes your traffic through three relays, each only knowing one hop, hiding your IP and your destination.

Tracking by combining dozens of browser data points (canvas rendering, fonts, timezone) into a unique signature, no cookies needed.

Source code published publicly under a license that allows inspection and (typically) modification. Necessary but not sufficient for trust.

Intelligence-sharing alliance of the US, UK, Canada, Australia, and New Zealand — relevant for jurisdiction-based privacy decisions.

The 6-digit codes from authenticator apps. Strong second factor; better than SMS.

Encrypting a message in multiple layers, peeled off one at a time as it travels through routers — the basis of Tor and Session.

An encryption property where compromising one session key does not let an attacker decrypt past sessions.

A boot process that cryptographically verifies each component of the OS image so a tampered system refuses to start.

Encrypting files on your device with your own key before they go to the cloud — the cloud only ever sees ciphertext.

An honest list of what you're protecting, who you're protecting it from, and what you're willing to give up to do it.