Skip to content

RESOURCES

Privacy resources

Choose a guide, open a tool, or follow a subject in the reporting archive. No account required.

Before you share

Before you share a photo

Check both the file and what is visible in the picture.

  1. Open a copy in the metadata tool and review the fields it can read. Missing fields do not prove the file contains no identifying information.
  2. Use Strip Metadata, download the new image, then inspect that output again. Keep your original separately if you need it.
  3. Look for faces, addresses, screens, reflections, and other details in the image itself. Removing metadata does not remove visible clues.

Inspect a photo

Before you share a report

Follow the evidence behind the headline.

  1. Check the publication date and any correction or update note. An old report may describe a policy or product that has since changed.
  2. Open the cited source and find the passage behind the claim. A working link means the page is available; it does not establish that the claim is supported.
  3. Keep the source, date, and uncertainty with your share. If something is wrong or a source has moved, send the affected URL and supporting evidence through Contact.

Sources & corrections

Before you share a token

Readable fields do not establish authenticity.

  1. Use a disposable example rather than a token that grants access to a real account. Keep credentials out of screenshots, support tickets, and public messages.
  2. Treat the decoded header, claims, and expiry as assertions. A decoder does not establish who issued the token or whether its signature is valid.
  3. For an application, use its established validation rules for the expected issuer, audience, key, and algorithm. Read the guide for the distinction between decoding and acceptance.

Read the JWT guide

Before you share account access

Review the permission, not just the app name.

  1. Open the linked-app settings for the correct Google account and inspect the connection type and permissions. Sign-in and access to account data are different relationships.
  2. Remove connections you no longer need. Before removing a sign-in connection, check how you will access the other service afterward.
  3. Review the other service separately for stored data and account deletion. Removing a connection is not evidence that previously shared information was erased.

Review connected-app access

Start with a guide

Practical starting points for reducing tracking, securing accounts, and using AI locally.

Choose a tool for the task

Read each tool's data-flow label before entering information. A result describes what was checked; it is not a security certification.

Read your results

Check what was measured before acting or sharing. Zero is different from unavailable, and a passing configuration check is not a safety guarantee.

Follow a topic

Browse the reporting archive by subject. Reports include source links where available. Check the link review and publication date as you read.

Know the project

Check how we work, send a correction, or follow the archive without a social account.