TL;DR
The author reframes 'privacy' as a question of control and details a personal technology stack chosen to limit third-party influence. Choices include a local-first password manager, GrapheneOS on Android, Signal for messaging, a personal email domain routed through Tuta, and local calendar/contact hosting on a Raspberry Pi.
What happened
In a December essay the author argues that 'control' is a clearer goal than the broad term 'privacy' and lays out a personal threat model that prioritizes limiting how others can shape their online experience. Their practical steps include using GNU pass as a password manager and avoiding phone-based password access, while recommending Bitwarden for users wanting a friendlier interface. For messaging they prefer Signal but acknowledge continued reliance on WhatsApp to stay connected. On mobile they run GrapheneOS to enforce sandboxing and granular permission controls, install open-source apps from F‑Droid, and avoid social apps on the phone by using browser containers. Email is operated through a personal domain (example hello@toidiu.com) with Tuta as the current provider. Calendar and contacts live on a Raspberry Pi running a CalDAV service (sabre.io/baikal) synced to the phone with DAVx⁵. The author also says they use Cloudflare Registrar after a price-driven switch and rely on Cloudflare's 1.1.1.1 DNS resolver because of perceived alignment of incentives.
Why it matters
- Framing concerns as 'control' focuses on who can influence what you see, do, and how you spend time online.
- Reducing dependence on large platforms limits the power of organizations that may track or monetize user behavior.
- Local-first and open-source tools can extend device longevity and reduce background resource usage.
- Keeping services portable (personal domain, local CalDAV) preserves the ability to change providers without losing data.
Key facts
- The author reframes 'privacy' as 'control' and uses that framing to select tools and practices.
- Password manager: GNU pass is used on a laptop only; Bitwarden is recommended for users wanting a better UI; the author has considered Passage.
- Messaging: Signal is preferred; WhatsApp is still used when necessary; Venmo is disabled on the author's devices.
- Phone: GrapheneOS runs on the author's Android device to enable sandboxing, granular permissions including network access, and the ability to disable apps.
- Apps: The author prefers open-source apps from F‑Droid and avoids installing social media on the phone, instead using browser containers to limit third-party cookies.
- Email: The author uses a personal domain (example hello@toidiu.com) and currently uses Tuta as the email provider rather than hosting their own server.
- Calendar/Contacts: Hosted locally on a Raspberry Pi using a CalDAV server (sabre.io/baikal) and synced to the phone with DAVx⁵.
- Domain and DNS: The author switched to Cloudflare Registrar after a competitor raised renewal prices and uses Cloudflare's 1.1.1.1 DNS, citing trust in the company's incentives.
- The post links to external resources including articles on platform tracking and a talk titled 'In Defense of Privacy'.
What to watch next
- Registrar pricing and renewal policies that prompt users to move domains — author switched when their previous registrar raised renewal price.
- Research and reporting about de‑anonymizing techniques on Android referenced in the author's sources (e.g., studies involving Meta and other firms).
- not confirmed in the source
Quick glossary
- Control (digital): The ability to decide who can access, shape, or act on your data and online experience.
- GrapheneOS: A privacy- and security-focused mobile operating system for Android devices that emphasizes sandboxing and permission controls.
- Password manager: A tool that stores and organizes passwords, often generating strong, unique credentials so users don't reuse passwords across sites.
- CalDAV: A protocol used to sync calendar data between a server and client applications.
- DNS resolver: A service that translates human-readable domain names into IP addresses; different resolvers can offer different privacy or performance characteristics.
Reader FAQ
Why does the author prefer 'control' over 'privacy' as a framing?
They argue 'privacy' is vague and that focusing on control makes it easier to address who can influence what you see and do online.
Which password manager does the author use?
They use GNU pass on their laptop, avoid accessing it from their phone, and recommend Bitwarden for users wanting a better UI.
Does the author host their own email server?
No; they use a personal domain but currently rely on Tuta for email hosting instead of running their own server.
Is the author employed by Cloudflare and did that affect their domain choice?
The author discloses Cloudflare is their current employer and says they switched to Cloudflare Registrar after a competitor raised renewal prices.
On privacy and control 2025-12-25 "I don't need to care about privacy because I have nothing to hide." is an argument that I have heard countless times. I found this…
Sources
- Privacy and control. My tech setup
- Security Is Not Privacy: Why Your Devices Might Be Safer …
- The Core Principles of Privacy, Flexibility, and Control in Tech
- Default settings for privacy — we need to talk
Related posts
- How I use Samsung’s hidden Connectivity Labs to boost Wi-Fi performance
- Leak suggests OnePlus 16 will adopt a 200MP main sensor in 2026
- How to get the most from Apple Health: top tips for 2026 tracking