Appendix

The Complete Privacy Checklist

Every actionable step in The Privacy Diet on one page — 49 of them. Tick them off as you go.

Where your ticks are stored: in this browser's localStorage, on this device only. No account, no cookie, no server — nothing is transmitted anywhere. Clearing site data clears your progress, and it won't follow you to another device.

Quick Wins (all audiences)

Switch to Firefox or Brave + install uBlock Origin
Set DuckDuckGo, Startpage, or Brave Search as default search engine
Audit and tighten app permissions on your phone
Install Bitwarden or KeePassXC + enable 2FA on email and key accounts
Install Signal, invite your key contacts, configure disappearing messages

Your Phone — Beginner

Complete the full iPhone or Android settings audit (location, permissions, analytics)
Enable Advanced Data Protection on iPhone (iCloud E2E encryption)
Delete your Advertising ID on Android
Delete unused apps; move social media apps to browser use
Disable Samsung-specific data collection if applicable

Your Phone — Advanced

Buy a Google Pixel device (6 or later, 8a or 9 recommended)
Flash GrapheneOS via the web installer at grapheneos.org
Re-lock bootloader after installation
Install F-Droid and Accrescent as app stores
Configure Signal, Aegis, ProtonMail, Organic Maps, NewPipe
Optionally: install sandboxed Google Play for banking/compatibility apps

Internet Use — Beginner

Harden Firefox with about:config tweaks and essential extensions
Install Firefox Multi-Account Containers to isolate sites
Switch to Proton Mail or Tuta for email
Begin Gmail migration — new signups go to new address immediately
Set up SimpleLogin or AnonAddy for email aliases
Use Signal for all sensitive messaging
Configure Signal: relay calls, disappearing messages, lock screen notifications off

Internet Use — Advanced

Choose and subscribe to a trustworthy VPN: Mullvad or ProtonVPN
Install and configure Mullvad Browser for sensitive sessions
Test your browser fingerprint at coveryourtracks.eff.org
Set up Tor Browser for high-sensitivity browsing
Enable PGP in Proton Mail for external encrypted correspondence

Home Network — Beginner

Change router admin password and username
Update router firmware; enable auto-updates
Enable WPA3; disable WPS and UPnP
Set a strong, unique WiFi password
Disable remote management
Move all IoT devices to the guest network
Configure encrypted DNS (DoH/DoT) on router or per device

Home Network — Advanced

Install Pi-hole on a Raspberry Pi or mini PC
Add curated blocklists; enable DNSSEC
Install Unbound for fully local DNS resolution
Consider replacing ISP router with OpenWrt or OPNsense hardware
Configure proper VLANs for network segmentation if hardware supports it

Self-Hosting

Set up a home server: Raspberry Pi 5 or used mini PC
Install Docker and Docker Compose
Deploy Vaultwarden; configure Bitwarden clients to use your instance
Deploy Nextcloud AIO for file and calendar sync
Deploy Immich for photo and video backup
Deploy SearXNG for private self-hosted search
Set up a reverse proxy (Nginx Proxy Manager or Caddy)
Configure WireGuard or Tailscale for secure remote access
Implement 3-2-1 backup strategy with Restic + Backblaze B2

Each item is a step explained in full in the book — this page is the index, not the instructions. See what's inside →