Mention disabling crash reports (#1940)

Signed-off-by: Daniel Gray <dngray@privacyguides.org>

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,10 @@
 contact_links:
   - name: Suggest a New Provider or Software
-    url: https://discuss.privacyguides.org/c/suggestions
+    url: https://discuss.privacyguides.org/c/site-development/suggestions
     about: Suggest something new for us to look at, or something we should remove.
+  - name: Suggest a Guide
+    url: https://discuss.privacyguides.net/c/site-development/guide-suggestions
+    about: Suggest an area where you think guidance might be required.
   - name: Ask a Question
     url: https://discuss.privacyguides.org/c/questions
     about: Let us know if something doesn't make sense!

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,8 @@ an advertising agency), and any other relevant affiliations.
 
 <!-- Place an x in the boxes below, like: [x] -->
 - [ ] Please check this box to confirm you have disclosed any relevant conflicts of interest in your post.
-- [ ] Please check this box to confirm your agreement to publish your work under the [Creative Commons Attribution-NoDerivatives 4.0 International](https://github.com/privacyguides/privacyguides.org/blob/main/LICENSE) license, and to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform and distribute your contribution as part of our project.
+- [ ] Please check this box to confirm your agreement to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute your contribution as part of our project.
+- [ ] Please check this box to confirm you are the sole author of this work, or that any additional authors will also reply to this PR on GitHub confirming their agreement to these terms.
 
 <!-- What's this? When you submit a PR, you keep the Copyright for the work you
 are contributing. We need you to agree to the above terms in order for us to

.github/workflows/crowdin.yml

@@ -1,8 +1,9 @@
 name: 💬 Crowdin Upload
 
 on:
-  push:
-    branches: [ main ]
+  workflow_dispatch:
+  release:
+    types: [published]
 
 jobs:
   synchronize-with-crowdin:
@@ -14,7 +15,7 @@ jobs:
       uses: actions/checkout@v3
 
     - name: crowdin action
-      uses: crowdin/github-action@1.4.14
+      uses: crowdin/github-action@1.5.2
       with:
         upload_sources: true
         upload_sources_args: '--auto-update --delete-obsolete'

.github/workflows/pages.yml

@@ -37,7 +37,7 @@ jobs:
           python-version: '3.10'
       
       - name: Cache files
-        uses: actions/cache@v3.0.11
+        uses: actions/cache@v3.2.3
         with:
           key: ${{ github.ref }}
           path: .cache

.github/workflows/preview.yml

@@ -1,47 +0,0 @@
-name: 🔂 Surge PR Preview
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-# Ensures that only one mirror task will run at a time.
-concurrency:
-  group: surge-sh
-
-jobs:
-  preview:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-      contents: write
-    environment: preview
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: '0'
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
-          ssh-key: ${{ secrets.ACTIONS_SSH_KEY }}
-          submodules: 'true'
-
-      - name: Set up Python runtime
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: Deploy to surge.sh
-        uses: afc163/surge-preview@v1
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CARDS: true
-        with:
-          surge_token: ${{ secrets.SURGE_TOKEN }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          dist: site
-          failOnError: 'true'
-          build: |
-            pip install pipenv
-            pipenv install
-            pipenv run mkdocs build --config-file mkdocs.production.yml

Pipfile

@@ -9,12 +9,13 @@ mkdocs-material = {path = "./mkdocs-material"}
 mkdocs-static-i18n = "*"
 mkdocs-git-revision-date-localized-plugin = "*"
 typing-extensions = "*"
-mkdocs-rss-plugin = "*"
 mkdocs-git-committers-plugin-2 = "*"
 mkdocs-macros-plugin = "*"
+pillow = "*"
+cairosvg = "*"
 
 [dev-packages]
 scour = "*"
 
 [requires]
-python_version = "3.10"
+python_version = "3.8"

Pipfile.lock

@@ -1,11 +1,11 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "cc061d23a1d1965a032daba80bbc3747582c5ce54374e393e09d1d3b4a3d79bf"
+            "sha256": "e58ad55b2281815cbad8bd08738bc446b516cd8a1892d8d6df9e27dc709e4b76"
         },
         "pipfile-spec": 6,
         "requires": {
-            "python_version": "3.10"
+            "python_version": "3.8"
         },
         "sources": [
             {
@@ -34,26 +34,26 @@
         },
         "cairocffi": {
             "hashes": [
-                "sha256:108a3a7cb09e203bdd8501d9baad91d786d204561bd71e9364e8b34897c47b91"
+                "sha256:509339b32ccd8d7b00c2204c32736cde78db53a32e6a162d312478d25626cd9a"
             ],
             "markers": "python_version >= '3.7'",
-            "version": "==1.3.0"
+            "version": "==1.4.0"
         },
         "cairosvg": {
             "hashes": [
                 "sha256:98c276b7e4f0caf01e5c7176765c104ffa1aa1461d63b2053b04ab663cf7052b",
                 "sha256:b0b9929cf5dba005178d746a8036fcf0025550f498ca54db61873322384783bc"
             ],
-            "markers": "python_version >= '3.5'",
+            "index": "pypi",
             "version": "==2.5.2"
         },
         "certifi": {
             "hashes": [
-                "sha256:43dadad18a7f168740e66944e4fa82c6611848ff9056ad910f8f7a3e46ab89e0",
-                "sha256:cffdcd380919da6137f76633531a5817e3a9f268575c128249fb637e4f9e73fb"
+                "sha256:0d9c601124e5a6ba9712dbc60d9c53c21e34f5f641fe83002317394311bdce14",
+                "sha256:90c1a32f1d68f940488354e36370f6cca89f0f106db09518524c88d6ed83f382"
             ],
             "markers": "python_version >= '3.6'",
-            "version": "==2022.6.15.1"
+            "version": "==2022.9.24"
         },
         "cffi": {
             "hashes": [
@@ -140,13 +140,21 @@
             "markers": "python_version >= '3.7'",
             "version": "==8.1.3"
         },
+        "cssselect": {
+            "hashes": [
+                "sha256:f612ee47b749c877ebae5bb77035d8f4202c6ad0f0fc1271b3c18ad6c4468ecf",
+                "sha256:f95f8dedd925fd8f54edb3d2dfb44c190d9d18512377d3c1e2388d16126879bc"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.1.0"
+        },
         "cssselect2": {
             "hashes": [
-                "sha256:3a83b2a68370c69c9cd3fcb88bbfaebe9d22edeef2c22d1ff3e1ed9c7fa45ed8",
-                "sha256:5b5d6dea81a5eb0c9ca39f116c8578dd413778060c94c1f51196371618909325"
+                "sha256:1ccd984dab89fc68955043aca4e1b03e0cf29cad9880f6e28e3ba7a74b14aa5a",
+                "sha256:fd23a65bfd444595913f02fc71f6b286c29261e354c41d722ca7a261a49b5969"
             ],
             "markers": "python_version >= '3.7'",
-            "version": "==0.6.0"
+            "version": "==0.7.0"
         },
         "defusedxml": {
             "hashes": [
@@ -173,27 +181,27 @@
         },
         "gitpython": {
             "hashes": [
-                "sha256:1c885ce809e8ba2d88a29befeb385fcea06338d3640712b59ca623c220bb5704",
-                "sha256:5b68b000463593e05ff2b261acff0ff0972df8ab1b70d3cdbd41b546c8b8fc3d"
+                "sha256:41eea0deec2deea139b459ac03656f0dd28fc4a3387240ec1d3c259a2c47850f",
+                "sha256:cc36bfc4a3f913e66805a28e84703e419d9c264c1077e537b54f0e1af85dbefd"
             ],
             "markers": "python_version >= '3.7'",
-            "version": "==3.1.27"
+            "version": "==3.1.29"
         },
         "idna": {
             "hashes": [
-                "sha256:84d9dd047ffa80596e0f246e2eab0b391788b0503584e8945f2368256d2735ff",
-                "sha256:9d643ff0a55b762d5cdb124b8eaa99c66322e2157b69160bc32796e824360e6d"
+                "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4",
+                "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
             ],
             "markers": "python_version >= '3.5'",
-            "version": "==3.3"
+            "version": "==3.4"
         },
         "importlib-metadata": {
             "hashes": [
-                "sha256:637245b8bab2b6502fcbc752cc4b7a6f6243bb02b31c5c26156ad103d3d45670",
-                "sha256:7401a975809ea1fdc658c3aa4f78cc2195a0e019c5cbc4c06122884e9ae80c23"
+                "sha256:da31db32b304314d044d3c12c79bd59e307889b287ad12ff387b3500835fc2ab",
+                "sha256:ddb0e35065e8938f867ed4928d0ae5bf2a53b7773871bfe6bcc7e4fcdc7dea43"
             ],
-            "markers": "python_version >= '3.7'",
-            "version": "==4.12.0"
+            "markers": "python_version < '3.10'",
+            "version": "==5.0.0"
         },
         "jinja2": {
             "hashes": [
@@ -287,6 +295,14 @@
             "markers": "python_version >= '3.6'",
             "version": "==3.3.7"
         },
+        "markdown2": {
+            "hashes": [
+                "sha256:528f978beb3dbcf529a139b6c76f6ac6ecf8bb96c131beab751bb095b3873b58",
+                "sha256:f65b4dbe1e16591b14fd40bc659b8b58d285eab70c1da21f390294fcdec42bb0"
+            ],
+            "markers": "python_version >= '3.5' and python_version < '4'",
+            "version": "==2.4.6"
+        },
         "markupsafe": {
             "hashes": [
                 "sha256:0212a68688482dc52b2d45013df70d169f542b7394fc744c02a57374a4207003",
@@ -343,19 +359,19 @@
         },
         "mkdocs": {
             "hashes": [
-                "sha256:a41a2ff25ce3bbacc953f9844ba07d106233cd76c88bac1f59cb1564ac0d87ed",
-                "sha256:fda92466393127d2da830bc6edc3a625a14b436316d1caf347690648e774c4f0"
+                "sha256:07ed90be4062e4ef732bbac2623097b9dca35c67b562c38cfd0bfbc7151758c1",
+                "sha256:2b7845c2775396214cd408753e4cfb01af3cfed36acc141a84bce2ceec9d705d"
             ],
             "index": "pypi",
-            "version": "==1.3.1"
+            "version": "==1.4.1"
         },
         "mkdocs-git-committers-plugin-2": {
             "hashes": [
-                "sha256:1e88c38bfe299a2737ebcf61e8cc27a5193b03d826f743e676ba59960b376c8e",
-                "sha256:617c413ea6b6a160169e601520b7a52377bce5d59f7788b948cdc067e8ced77c"
+                "sha256:14d4a89bf8965ab62ca9b8b0cd90f6c9b421bb89bfedca0d91c5119f18791360",
+                "sha256:4f6eb6137f35967dfa444703b6ea293f05bf2fd183506bc51db8fb21b061d5a3"
             ],
             "index": "pypi",
-            "version": "==1.1.0"
+            "version": "==1.1.1"
         },
         "mkdocs-git-revision-date-localized-plugin": {
             "hashes": [
@@ -375,30 +391,22 @@
         },
         "mkdocs-material": {
             "path": "./mkdocs-material",
-            "version": "==8.4.3+insiders.4.22.1"
+            "version": "==8.5.7+insiders.4.26.1"
         },
         "mkdocs-material-extensions": {
             "hashes": [
-                "sha256:a82b70e533ce060b2a5d9eb2bc2e1be201cf61f901f93704b4acf6e3d5983a44",
-                "sha256:bfd24dfdef7b41c312ede42648f9eb83476ea168ec163b613f9abd12bbfddba2"
+                "sha256:96ca979dae66d65c2099eefe189b49d5ac62f76afb59c38e069ffc7cf3c131ec",
+                "sha256:bcc2e5fc70c0ec50e59703ee6e639d87c7e664c0c441c014ea84461a90f1e902"
             ],
-            "markers": "python_version >= '3.6'",
-            "version": "==1.0.3"
-        },
-        "mkdocs-rss-plugin": {
-            "hashes": [
-                "sha256:50671e2030188da4bc01ff421d979903a01cd87b02e2ec5f430fd05d5ed55825",
-                "sha256:536efc35c2f62ea1eac4bae23532e07f0a19b9044291a12960f47be7d3aaf99e"
-            ],
-            "index": "pypi",
-            "version": "==1.1.0"
+            "markers": "python_version >= '3.7'",
+            "version": "==1.1"
         },
         "mkdocs-static-i18n": {
             "hashes": [
-                "sha256:9a13987c1a1afdb2b9f532f7c1597c2b6e747b4015f4adc1ebd65843b8bf1378"
+                "sha256:119583edee640b5b34834f415669357392e47c01b8a0587c95ccd8d14ef11e33"
             ],
             "index": "pypi",
-            "version": "==0.46"
+            "version": "==0.49"
         },
         "packaging": {
             "hashes": [
@@ -408,6 +416,12 @@
             "markers": "python_version >= '3.6'",
             "version": "==21.3"
         },
+        "paginate": {
+            "hashes": [
+                "sha256:5e6007b6a9398177a7e1648d04fdd9f8c9766a1a945bceac82f1929e8c78af2d"
+            ],
+            "version": "==0.5.6"
+        },
         "pillow": {
             "hashes": [
                 "sha256:0030fdbd926fb85844b8b92e2f9449ba89607231d3dd597a21ae72dc7fe26927",
@@ -469,7 +483,7 @@
                 "sha256:fa768eff5f9f958270b081bb33581b4b569faabf8774726b283edb06617101dc",
                 "sha256:fac2d65901fb0fdf20363fbd345c01958a742f2dc62a8dd4495af66e3ff502a4"
             ],
-            "markers": "python_version >= '3.7'",
+            "index": "pypi",
             "version": "==9.2.0"
         },
         "pycparser": {
@@ -489,11 +503,11 @@
         },
         "pymdown-extensions": {
             "hashes": [
-                "sha256:3ef2d998c0d5fa7eb09291926d90d69391283561cf6306f85cd588a5eb5befa0",
-                "sha256:ec141c0f4983755349f0c8710416348d1a13753976c028186ed14f190c8061c4"
+                "sha256:651b0107bc9ee790aedea3673cb88832c0af27d2569cf45c2de06f1d65292e96",
+                "sha256:767d07d9dead0f52f5135545c01f4ed627f9a7918ee86c646d893e24c59db87d"
             ],
             "markers": "python_version >= '3.7'",
-            "version": "==9.5"
+            "version": "==9.7"
         },
         "pyparsing": {
             "hashes": [
@@ -503,6 +517,13 @@
             "markers": "python_full_version >= '3.6.8'",
             "version": "==3.0.9"
         },
+        "pyquery": {
+            "hashes": [
+                "sha256:1fc33b7699455ed25c75282bc8f80ace1ac078b0dda5a933dacbd8b1c1f83963",
+                "sha256:a388eefb6bc4a55350de0316fbd97cda999ae669b6743ae5b99102ba54f5aa72"
+            ],
+            "version": "==1.4.3"
+        },
         "python-dateutil": {
             "hashes": [
                 "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86",
@@ -513,13 +534,15 @@
         },
         "pytz": {
             "hashes": [
-                "sha256:220f481bdafa09c3955dfbdddb7b57780e9a94f5127e35456a48589b9e0c0197",
-                "sha256:cea221417204f2d1a2aa03ddae3e867921971d0d76f14d87abb4414415bbdcf5"
+                "sha256:335ab46900b1465e714b4fda4963d87363264eb662aab5e65da039c25f1f5b22",
+                "sha256:c4d88f472f54d615e9cd582a5004d1e5f624854a6a27a6211591c251f22a6914"
             ],
-            "version": "==2022.2.1"
+            "markers": "python_version < '3.9'",
+            "version": "==2022.5"
         },
         "pyyaml": {
             "hashes": [
+                "sha256:01b45c0191e6d66c470b6cf1b9531a771a83c1c4208272ead47a3ae4f2f603bf",
                 "sha256:0283c35a6a9fbf047493e3a0ce8d79ef5030852c51e9d911a27badfde0605293",
                 "sha256:055d937d65826939cb044fc8c9b08889e8c743fdc6a32b33e2390f66013e449b",
                 "sha256:07751360502caac1c067a8132d150cf3d61339af5691fe9e87803040dbc5db57",
@@ -531,26 +554,32 @@
                 "sha256:277a0ef2981ca40581a47093e9e2d13b3f1fbbeffae064c1d21bfceba2030287",
                 "sha256:2cd5df3de48857ed0544b34e2d40e9fac445930039f3cfe4bcc592a1f836d513",
                 "sha256:40527857252b61eacd1d9af500c3337ba8deb8fc298940291486c465c8b46ec0",
+                "sha256:432557aa2c09802be39460360ddffd48156e30721f5e8d917f01d31694216782",
                 "sha256:473f9edb243cb1935ab5a084eb238d842fb8f404ed2193a915d1784b5a6b5fc0",
                 "sha256:48c346915c114f5fdb3ead70312bd042a953a8ce5c7106d5bfb1a5254e47da92",
                 "sha256:50602afada6d6cbfad699b0c7bb50d5ccffa7e46a3d738092afddc1f9758427f",
                 "sha256:68fb519c14306fec9720a2a5b45bc9f0c8d1b9c72adf45c37baedfcd949c35a2",
                 "sha256:77f396e6ef4c73fdc33a9157446466f1cff553d979bd00ecb64385760c6babdc",
+                "sha256:81957921f441d50af23654aa6c5e5eaf9b06aba7f0a19c18a538dc7ef291c5a1",
                 "sha256:819b3830a1543db06c4d4b865e70ded25be52a2e0631ccd2f6a47a2822f2fd7c",
                 "sha256:897b80890765f037df3403d22bab41627ca8811ae55e9a722fd0392850ec4d86",
                 "sha256:98c4d36e99714e55cfbaaee6dd5badbc9a1ec339ebfc3b1f52e293aee6bb71a4",
                 "sha256:9df7ed3b3d2e0ecfe09e14741b857df43adb5a3ddadc919a2d94fbdf78fea53c",
                 "sha256:9fa600030013c4de8165339db93d182b9431076eb98eb40ee068700c9c813e34",
                 "sha256:a80a78046a72361de73f8f395f1f1e49f956c6be882eed58505a15f3e430962b",
+                "sha256:afa17f5bc4d1b10afd4466fd3a44dc0e245382deca5b3c353d8b757f9e3ecb8d",
                 "sha256:b3d267842bf12586ba6c734f89d1f5b871df0273157918b0ccefa29deb05c21c",
                 "sha256:b5b9eccad747aabaaffbc6064800670f0c297e52c12754eb1d976c57e4f74dcb",
+                "sha256:bfaef573a63ba8923503d27530362590ff4f576c626d86a9fed95822a8255fd7",
                 "sha256:c5687b8d43cf58545ade1fe3e055f70eac7a5a1a0bf42824308d868289a95737",
                 "sha256:cba8c411ef271aa037d7357a2bc8f9ee8b58b9965831d9e51baf703280dc73d3",
                 "sha256:d15a181d1ecd0d4270dc32edb46f7cb7733c7c508857278d3d378d14d606db2d",
+                "sha256:d4b0ba9512519522b118090257be113b9468d804b19d63c71dbcf4a48fa32358",
                 "sha256:d4db7c7aef085872ef65a8fd7d6d09a14ae91f691dec3e87ee5ee0539d516f53",
                 "sha256:d4eccecf9adf6fbcc6861a38015c2a64f38b9d94838ac1810a9023a0609e1b78",
                 "sha256:d67d839ede4ed1b28a4e8909735fc992a923cdb84e618544973d7dfc71540803",
                 "sha256:daf496c58a8c52083df09b80c860005194014c3698698d1a57cbcfa182142a3a",
+                "sha256:dbad0e9d368bb989f4515da330b88a057617d16b6a8245084f1b05400f24609f",
                 "sha256:e61ceaab6f49fb8bdfaa0f92c4b57bcfbea54c09277b1b4f7ac376bfb7a7c174",
                 "sha256:f84fbc98b019fef2ee9a1cb3ce93e3187a6df0b2538a651bfb890254ba9f90b5"
             ],
@@ -565,6 +594,13 @@
             "markers": "python_version >= '3.6'",
             "version": "==0.1"
         },
+        "readtime": {
+            "hashes": [
+                "sha256:0a67e29adfcfb25488b1edd6f08e158de5f832e84fe8e35cf83e639208ce0b97",
+                "sha256:ddf221ed5b004c97ee350bc782dda1139ea6dfb817a404cdcc251ac33c11aa28"
+            ],
+            "version": "==2.0.0"
+        },
         "regex": {
             "hashes": [
                 "sha256:003a2e1449d425afc817b5f0b3d4c4aa9072dd5f3dfbf6c7631b8dc7b13233de",
@@ -701,19 +737,19 @@
         },
         "tinycss2": {
             "hashes": [
-                "sha256:b2e44dd8883c360c35dd0d1b5aad0b610e5156c2cb3b33434634e539ead9d8bf",
-                "sha256:fe794ceaadfe3cf3e686b22155d0da5780dd0e273471a51846d0a02bc204fec8"
+                "sha256:2b80a96d41e7c3914b8cda8bc7f705a4d9c49275616e886103dd839dfc847847",
+                "sha256:8cff3a8f066c2ec677c06dbc7b45619804a6938478d9d73c284b29d14ecb0627"
             ],
-            "markers": "python_version >= '3.6'",
-            "version": "==1.1.1"
+            "markers": "python_version >= '3.7'",
+            "version": "==1.2.1"
         },
         "typing-extensions": {
             "hashes": [
-                "sha256:25642c956049920a5aa49edcdd6ab1e06d7e5d467fc00e0506c44ac86fbfca02",
-                "sha256:e6d2677a32f47fc7eb2795db1dd15c1f34eff616bcaf2cfb5e997f854fa1c4a6"
+                "sha256:1511434bb92bf8dd198c12b1cc812e800d4181cfcb867674e0f8279cc93087aa",
+                "sha256:16fa4864408f655d35ec496218b85f79b3437c829e93320c7c9215ccfd92489e"
             ],
             "index": "pypi",
-            "version": "==4.3.0"
+            "version": "==4.4.0"
         },
         "urllib3": {
             "hashes": [
@@ -763,11 +799,11 @@
         },
         "zipp": {
             "hashes": [
-                "sha256:05b45f1ee8f807d0cc928485ca40a07cb491cf092ff587c0df9cb1fd154848d2",
-                "sha256:47c40d7fe183a6f21403a199b3e4192cca5774656965b0a4988ad2f8feb5f009"
+                "sha256:4fcb6f278987a6605757302a6e40e896257570d11c51628968ccb2a47e80c6c1",
+                "sha256:7a7262fd930bd3e36c50b9a64897aec3fafff3dfdeec9623ae22b40e93f99bb8"
             ],
             "markers": "python_version >= '3.7'",
-            "version": "==3.8.1"
+            "version": "==3.10.0"
         }
     },
     "develop": {

README.md

@@ -9,26 +9,20 @@
 
   <p><em>Your central privacy and security resource to protect yourself online.</em></p>
 
-  <p><a href="https://www.reddit.com/r/PrivacyGuides/">
-    <img src="https://img.shields.io/reddit/subreddit-subscribers/PrivacyGuides?label=Subscribe%20to%20r%2FPrivacyGuides&style=social">
-  </a>
-  <a href="https://mastodon.social/@privacyguides">
-    <img src="https://img.shields.io/mastodon/follow/107604420394178246?style=social">
+  <p><a href="https://mastodon.neat.computer/@privacyguides">
+    <img src="https://img.shields.io/mastodon/follow/109298532634697668?domain=https%3A%2F%2Fmastodon.neat.computer&label=Follow%20%40privacyguides%40neat.computer&style=social">
   </a>
   <a href="https://twitter.com/privacy_guides">
     <img src="https://img.shields.io/twitter/follow/privacy_guides?style=social">
   </a>
+  <a href="https://discuss.privacyguides.net/">
+    <img src="https://img.shields.io/discourse/users?label=Join%20our%20forum&logo=discourse&server=https%3A%2F%2Fdiscuss.privacyguides.net&style=social">
+  </a>
   <a href="https://github.com/privacyguides/privacyguides.org/stargazers">
     <img src="https://img.shields.io/github/stars/privacyguides?style=social">
   </a></p>
 
-  <a href="https://github.com/privacyguides/privacyguides.org/issues">
-    <img src="https://img.shields.io/github/issues-raw/privacyguides/privacyguides.org">
-  </a>
-  <a href="https://github.com/privacyguides/privacyguides.org/issues?q=is%3Aissue+is%3Aclosed">
-    <img src="https://img.shields.io/github/issues-closed-raw/privacyguides/privacyguides.org">
-  </a>
-  <a href="https://github.com/privacyguides/privacyguides.org/pulls">
+  <p><a href="https://github.com/privacyguides/privacyguides.org/pulls">
     <img src="https://img.shields.io/github/issues-pr-raw/privacyguides/privacyguides.org">
   </a>
   <a href="https://github.com/privacyguides/privacyguides.org/pulls?q=is%3Apr+is%3Aclosed">
@@ -36,9 +30,6 @@
   </a>
   <a href="https://opencollective.com/privacyguides">
     <img src="https://img.shields.io/opencollective/all/privacyguides">
-  </a>
-  <a href="https://crowdin.com/project/privacyguides">
-    <img src="https://badges.crowdin.net/privacyguides/localized.svg">
   </a></p>
 </div>
 
@@ -46,7 +37,7 @@
 
 **Privacy Guides** is a socially motivated website that provides information for protecting your data security and privacy. We are a non-profit collective operated entirely by volunteer team members and contributors.
 
-Our current list of team members can be found [here](https://github.com/orgs/privacyguides/people). Additionally, [many people](https://github.com/privacyguides/privacyguides.org/graphs/contributors) have made contributions to the project, and you can too!
+Our current list of team members can be found [here](https://www.privacyguides.org/about/#our-team). Additionally, [many people](https://github.com/privacyguides/privacyguides.org/graphs/contributors) have made contributions to the project, and you can too!
 
 ## Contributing
 

data/articles.yml

@@ -1,22 +0,0 @@
-extra:
-  articles:
-    - name: '"Hide Nothing"'
-      publisher: Privacy Guides
-      url: 'blog/2022/06/09/hide-nothing.md'
-      date: 2022-06-09
-    - name: '"Move Fast and Break Things"'
-      publisher: Privacy Guides
-      url: 'blog/2022/04/04/move-fast-and-break-things.md'
-      date: 2022-04-04
-    - name: 'Firefox Privacy: 2021 Update'
-      publisher: Privacy Guides
-      url: 'blog/2021/12/01/firefox-privacy-2021-update.md'
-      date: 2021-12-01
-    - name: 'Virtual Insanity'
-      publisher: Privacy Guides
-      url: 'blog/2021/11/01/virtual-insanity.md'
-      date: 2021-11-01
-    - name: 'Welcome to Privacy Guides'
-      publisher: Privacy Guides
-      url: 'blog/2021/09/14/welcome-to-privacy-guides.md'
-      date: 2021-09-14

docs/about.en.md

@@ -1,15 +0,0 @@
----
-title: "About Privacy Guides"
----
-
-**Privacy Guides** is a socially motivated website that provides information for protecting your data security and privacy. We are a non-profit collective operated entirely by volunteer team members and contributors.
-
-Our current list of team members can be found [here on GitHub](https://github.com/orgs/privacyguides/people). Additionally, [many people](https://github.com/privacyguides/privacyguides.org/graphs/contributors) have made contributions to the project. You can too, we're open sourced on GitHub!
-
-Our team members review all changes made to the website and handle administrative duties such as web hosting and financials, however they do not personally profit from any contributions made to this site. Our financials are transparently hosted by the Open Collective Foundation 501(c)(3) at [opencollective.com/privacyguides](https://opencollective.com/privacyguides). Donations to Privacy Guides are generally tax deductible in the United States.
-
-*The following is a human-readable summary of (and not a substitute for) the [license](https://github.com/privacyguides/privacyguides.org/blob/main/LICENSE):*
-
-:fontawesome-brands-creative-commons: :fontawesome-brands-creative-commons-by: :fontawesome-brands-creative-commons-nd: Unless otherwise noted, the original content on this website is made available under the [Creative Commons Attribution-NoDerivatives 4.0 International Public License](https://github.com/privacyguides/privacyguides.org/blob/main/LICENSE). This means that you are free to copy and redistribute the material in any medium or format for any purpose, even commercially; as long as you give appropriate credit to `Privacy Guides (www.privacyguides.org)` and provide a link to the license. You may do so in any reasonable manner, but not in any way that suggests Privacy Guides endorses you or your use. If you remix, transform, or build upon the content of this website, you may not distribute the modified material.
-
-This license is in place to prevent people from sharing our work without giving proper credit, and to prevent people from modifying our work in a way that could be used to mislead people. If you find the terms of this license too restrictive for the project you're working on, please reach out to us at `jonah@privacyguides.org`. We are happy to provide alternative licensing options for well-intentioned projects in the privacy space!

docs/about/criteria.md

@@ -0,0 +1,40 @@
+---
+title: General Criteria
+---
+
+!!! example "Work in Progress"
+
+    The following page is a work in progress, and does not reflect the full criteria for our recommendations at this time. Past discussion on this topic: [#24](https://github.com/privacyguides/privacyguides.org/discussions/24)
+
+Below are some things that must apply to all submissions to Privacy Guides. Each category will have additional requirements for inclusion.
+
+## Financial Disclosure
+
+We do not make money from recommending certain products, we do not use affiliate links, and we do not provide special consideration to project donors.
+
+## General Guidelines
+
+We apply these priorities when considering new recommendations:
+
+- **Secure**: Tools should follow security best-practices wherever applicable.
+- **Source Availability**: Open source projects are generally preferred over equivalent proprietary alternatives.
+- **Cross-Platform**: We typically prefer recommendations to be cross-platform, to avoid vendor lock-in.
+- **Active Development**: The tools that we recommend should be actively developed, unmaintained projects will be removed in most cases.
+- **Usability**: Tools should be accessible to most computer users, an overly technical background should not be required.
+- **Documented**: Tools should have clear and extensive documentation for use.
+
+## Developer Self-Submissions
+
+We have these requirements in regard to developers which wish to submit their project or software for consideration.
+
+- Must disclose affiliation, i.e. your position within the project being submitted.
+
+- Must have a security whitepaper if it is a project that involves handling of sensitive information like a messenger, password manager, encrypted cloud storage etc.
+    - Third party audit status. We want to know if you have one, or have one planned. If possible please mention who will be conducting the audit.
+
+- Must explain what the project brings to the table in regard to privacy.
+    - Does it solve any new problem?
+    - Why should anyone use it over the alternatives?
+
+- Must state what the exact threat model is with their project.
+    - It should be clear to potential users what the project can provide, and what it cannot.

docs/about/index.md

@@ -0,0 +1,61 @@
+---
+title: "About Privacy Guides"
+---
+
+**Privacy Guides** is a socially motivated website that provides information for protecting your data security and privacy. We are a non-profit collective operated entirely by volunteer [team members](https://discuss.privacyguides.org/g/team) and contributors.
+
+[:material-hand-coin-outline: Support the project](donate.md){ .md-button .md-button--primary }
+
+## Our Team
+
+??? person "@jonah"
+
+    - [:simple-discourse: Discourse](https://discuss.privacyguides.org/u/jonah)
+    - [:simple-github: GitHub](https://github.com/jonaharagon "@jonaharagon")
+    - [:simple-mastodon: Mastodon](https://mastodon.neat.computer/@jonah "@jonah@neat.computer"){rel=me}
+    - [:fontawesome-solid-house: Homepage](https://www.jonaharagon.com)
+
+??? person "@niek-de-wilde"
+
+    - [:simple-discourse: Discourse](https://discuss.privacyguides.org/u/Niek-de-Wilde)
+    - [:simple-github: GitHub](https://github.com/blacklight447 "@blacklight447")
+    - [:simple-mastodon: Mastodon](https://mastodon.social/@blacklight447 "@blacklight447@mastodon.social"){rel=me}
+
+??? person "@dngray"
+
+    - [:simple-discourse: Discourse](https://discuss.privacyguides.org/u/dngray)
+    - [:simple-github: GitHub](https://github.com/dngray "@dngray")
+    - [:simple-mastodon: Mastodon](https://mastodon.social/@dngray "@dngray@mastodon.social"){rel=me}
+    - [:fontawesome-solid-envelope: Email](mailto:dngray@privacyguides.org)
+
+??? person "@freddy"
+
+    - [:simple-discourse: Discourse](https://discuss.privacyguides.org/u/freddy)
+    - [:simple-github: GitHub](https://github.com/freddy-m "@freddy-m")
+    - [:simple-mastodon: Mastodon](https://social.lol/@freddy "@freddy@social.lol"){rel=me}
+    - [:fontawesome-solid-envelope: Email](mailto:freddy@privacyguides.org)
+    - [:fontawesome-solid-house: Homepage](https://freddy.omg.lol)
+
+??? person "@mfwmyfacewhen"
+
+    - [:simple-discourse: Discourse](https://discuss.privacyguides.org/u/mfwmyfacewhen)
+    - [:simple-github: GitHub](https://github.com/mfwmyfacewhen "@mfwmyfacewhen")
+    - [:fontawesome-solid-house: Homepage](https://mfw.omg.lol)
+    
+??? person "@olivia"
+
+    - [:simple-discourse: Discourse](https://discuss.privacyguides.org/u/olivia)
+    - [:simple-github: GitHub](https://github.com/hook9 "@hook9")
+    - [:simple-mastodon: Mastodon](https://mastodon.neat.computer/@oliviablob "@oliviablob@neat.computer"){rel=me}
+
+Additionally, [many people](https://github.com/privacyguides/privacyguides.org/graphs/contributors) have made contributions to the project. You can too, we're open sourced on GitHub!
+
+Our team members review all changes made to the website and handle administrative duties such as web hosting and financials, however they do not personally profit from any contributions made to this site. Our financials are transparently hosted by the Open Collective Foundation 501(c)(3) at [opencollective.com/privacyguides](https://opencollective.com/privacyguides). Donations to Privacy Guides are generally tax deductible in the United States.
+
+## Site License
+
+*The following is a human-readable summary of (and not a substitute for) the [license](https://github.com/privacyguides/privacyguides.org/blob/main/LICENSE):*
+
+:fontawesome-brands-creative-commons: :fontawesome-brands-creative-commons-by: :fontawesome-brands-creative-commons-nd: Unless otherwise noted, the original content on this website is made available under the [Creative Commons Attribution-NoDerivatives 4.0 International Public License](https://github.com/privacyguides/privacyguides.org/blob/main/LICENSE). This means that you are free to copy and redistribute the material in any medium or format for any purpose, even commercially; as long as you give appropriate credit to `Privacy Guides (www.privacyguides.org)` and provide a link to the license. You may do so in any reasonable manner, but not in any way that suggests Privacy Guides endorses you or your use. If you remix, transform, or build upon the content of this website, you may not distribute the modified material.
+
+This license is in place to prevent people from sharing our work without giving proper credit, and to prevent people from modifying our work in a way that could be used to mislead people. If you find the terms of this license too restrictive for the project you're working on, please reach out to us at `jonah@privacyguides.org`. We are happy to provide alternative licensing options for well-intentioned projects in the privacy space!

docs/about/privacy-policy.md

@@ -14,7 +14,7 @@ The privacy of our website visitors is important to us, so we do not track any i
 - No information is mined and harvested for personal and behavioral trends
 - No information is monetized
 
-You can view the data we collect at [stats.privacyguides.net/privacyguides.org](https://stats.privacyguides.net/privacyguides.org).
+You can view the data we collect on our [statistics](statistics.md) page.
 
 We run a self-hosted installation of [Plausible Analytics](https://plausible.io) to collect some anonymous usage data for statistical purposes. The goal is to track overall trends in our website traffic, it is not to track individual visitors. All the data is in aggregate only. No personal data is collected.
 
@@ -43,7 +43,7 @@ We will store your account data as long as your account remains open. After clos
 
 The Privacy Guides team generally does not have access to personal data outside of limited access granted via some moderation panels. Inquiries regarding your personal information should be sent directly to:
 
-```
+```text
 Jonah Aragon
 Services Administrator
 jonah@privacyguides.org
@@ -55,6 +55,6 @@ For complaints under GDPR more generally, you may lodge complaints with your loc
 
 ## About This Policy
 
-We will post any new versions of this statement [here](privacy-policy.en.md). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](privacy-policy.en.md) for the latest contact information at any time.
+We will post any new versions of this statement [here](privacy-policy.md). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](privacy-policy.md) for the latest contact information at any time.
 
-A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.en.md) of this page can be found on GitHub.
+A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.md) of this page can be found on GitHub.

docs/about/services.md

@@ -0,0 +1,31 @@
+# Privacy Guides Services
+
+We run a number of web services to test out features and promote cool decentralized, federated, and/or open-source projects. Many of these services are available to the public and are detailed below.
+
+[:material-comment-alert: Report an issue](https://discuss.privacyguides.net/c/services/2){ .md-button .md-button--primary }
+
+## Discourse
+
+- Domain: [discuss.privacyguides.net](https://discuss.privacyguides.net)
+- Availability: Public
+- Source: [github.com/discourse/discourse](https://github.com/discourse/discourse)
+
+## Gitea
+
+- Domain: [code.privacyguides.dev](https://code.privacyguides.dev)
+- Availability: Invite-Only  
+Access may be granted upon request to any team working on *Privacy Guides*-related development or content.
+- Source: [snapcraft.io/gitea](https://snapcraft.io/gitea)
+
+## Matrix
+
+- Domain: [matrix.privacyguides.org](https://matrix.privacyguides.org)
+- Availability: Invite-Only  
+Access may be granted upon request to Privacy Guides team members, Matrix moderators, third-party Matrix community administrators, Matrix bot operators, and other individuals in need of a reliable Matrix presence.
+- Source: [github.com/spantaleev/matrix-docker-ansible-deploy](https://github.com/spantaleev/matrix-docker-ansible-deploy)
+
+## SearXNG
+
+- Domain: [search.privacyguides.net](https://search.privacyguides.net)
+- Availability: Public
+- Source: [github.com/searxng/searxng-docker](https://github.com/searxng/searxng-docker)

docs/about/statistics.md

@@ -0,0 +1,60 @@
+---
+title: Traffic Statistics
+---
+## Website Statistics
+
+<iframe plausible-embed src="https://stats.privacyguides.net/share/privacyguides.org?auth=IxTl2wRhi3uxF09rd1NSn&embed=true&theme=system&background=transparent" scrolling="no" frameborder="0" loading="lazy" style="width: 1px; min-width: 100%; height: 1600px;" id="plausibleFrame"></iframe>
+<div style="font-size: 14px; padding-bottom: 14px;">Stats powered by <a target="_blank" style="color: #4F46E5; text-decoration: underline;" href="https://plausible.io">Plausible Analytics</a></div>
+<script async src="https://stats.privacyguides.net/js/embed.host.js"></script>
+
+<script>
+
+    /* Set palette on initial load */
+    var palette = __md_get("__palette")
+    if (palette && typeof palette.color === "object") {
+        var theme = palette.color.scheme === "slate" ? "dark" : "light"
+        document.getElementById('plausibleFrame').src = 'https://stats.privacyguides.net/share/privacyguides.org?auth=IxTl2wRhi3uxF09rd1NSn&embed=true&theme=' + theme + '&background=transparent';
+    }
+
+    /* Register event handlers after documented loaded */
+    document.addEventListener("DOMContentLoaded", function() {
+        var ref = document.querySelector("[data-md-component=palette]")
+        ref.addEventListener("change", function() {
+        var palette = __md_get("__palette")
+        if (palette && typeof palette.color === "object") {
+            var theme = palette.color.scheme === "slate" ? "dark" : "light"
+
+            document.getElementById('plausibleFrame').src = 'https://stats.privacyguides.net/share/privacyguides.org?auth=IxTl2wRhi3uxF09rd1NSn&embed=true&theme=' + theme + '&background=transparent';
+        }
+        })
+    })
+</script>
+
+## Blog Statistics
+
+<iframe plausible-embed src="https://stats.privacyguides.net/share/blog.privacyguides.org?auth=onWV76WWcsDifUqlaHEAg&embed=true&theme=system&background=transparent" scrolling="no" frameborder="0" loading="lazy" style="width: 1px; min-width: 100%; height: 1600px;" id="blogFrame"></iframe>
+<div style="font-size: 14px; padding-bottom: 14px;">Stats powered by <a target="_blank" style="color: #4F46E5; text-decoration: underline;" href="https://plausible.io">Plausible Analytics</a></div>
+<script async src="https://stats.privacyguides.net/js/embed.host.js"></script>
+
+<script>
+
+    /* Set palette on initial load */
+    var palette = __md_get("__palette")
+    if (palette && typeof palette.color === "object") {
+        var theme = palette.color.scheme === "slate" ? "dark" : "light"
+        document.getElementById('blogFrame').src = 'https://stats.privacyguides.net/share/blog.privacyguides.org?auth=onWV76WWcsDifUqlaHEAg&embed=true&theme=' + theme + '&background=transparent';
+    }
+
+    /* Register event handlers after documented loaded */
+    document.addEventListener("DOMContentLoaded", function() {
+        var ref = document.querySelector("[data-md-component=palette]")
+        ref.addEventListener("change", function() {
+        var palette = __md_get("__palette")
+        if (palette && typeof palette.color === "object") {
+            var theme = palette.color.scheme === "slate" ? "dark" : "light"
+
+            document.getElementById('blogFrame').src = 'https://stats.privacyguides.net/share/blog.privacyguides.org?auth=onWV76WWcsDifUqlaHEAg&embed=true&theme=' + theme + '&background=transparent';
+        }
+        })
+    })
+</script>

docs/advanced/communication-network-types.en.md

@@ -84,7 +84,7 @@ P2P networks do not use servers, as peers communicate directly between each othe
 
 A messenger using [anonymous routing](https://doi.org/10.1007/978-1-4419-5906-5_628) hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three.
 
-There are [many](https://doi.org/10.1145/3182658) different ways to implement anonymous routing. One of the most famous is [onion routing](https://en.wikipedia.org/wiki/Onion_routing) (i.e. [Tor](../basics/tor-overview.md)), which communicates encrypted messages through a virtual [overlay network](https://en.wikipedia.org/wiki/Overlay_network) that hides the location of each node as well as the recipient and sender of each message. The sender and recipient never interact directly and only meet through a secret rendezvous node so that there is no leak of IP addresses nor physical location. Nodes cannot decrypt messages, nor the final destination; only the recipient can. Each intermediary node can only decrypt a part that indicates where to send the still encrypted message next, until it arrives at the recipient who can fully decrypt it, hence the "onion layers."
+There are [many](https://doi.org/10.1145/3182658) different ways to implement anonymous routing. One of the most famous is [onion routing](https://en.wikipedia.org/wiki/Onion_routing) (i.e. [Tor](tor-overview.md)), which communicates encrypted messages through a virtual [overlay network](https://en.wikipedia.org/wiki/Overlay_network) that hides the location of each node as well as the recipient and sender of each message. The sender and recipient never interact directly and only meet through a secret rendezvous node so that there is no leak of IP addresses nor physical location. Nodes cannot decrypt messages, nor the final destination; only the recipient can. Each intermediary node can only decrypt a part that indicates where to send the still encrypted message next, until it arrives at the recipient who can fully decrypt it, hence the "onion layers."
 
 Self-hosting a node in an anonymous routing network does not provide the hoster with additional privacy benefits, but rather contributes to the whole network's resilience against identification attacks for everyone's benefit.
 

docs/advanced/dns-overview.en.md

@@ -1,5 +1,5 @@
 ---
-title: "Introduction to DNS"
+title: "DNS Overview"
 icon: material/dns
 ---
 
@@ -109,7 +109,7 @@ We can see the [connection establishment](https://en.wikipedia.org/wiki/Transmis
 
 ## Why **shouldn't** I use encrypted DNS?
 
-In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](threat-modeling.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](../vpn.md) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
+In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](../basics/threat-modeling.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](../vpn.md) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
 
 When we do a DNS lookup, it's generally because we want to access a resource. Below, we will discuss some of the methods that may disclose your browsing activities even when using encrypted DNS:
 

docs/advanced/erasing-data.md

@@ -1,36 +0,0 @@
----
-title: "Secure Data Erasure"
-icon: 'material/harddisk-remove'
----
-**Erasing data** from your computer may seem like a simple task, but if you want to make sure the data is truly unrecoverable, there are some things you should consider.
-
-!!! tip
-    You should use [full disk encryption](../encryption.md#os-full-disk-encryption) on your storage devices. If your device is stolen or needs to be returned under warranty your privacy may be at risk.
-
-To erase a storage device **thoroughly**, you should securely erase the whole device and not individual files.
-
-## Erasing Your Entire Drive
-
-When you delete a file, the operating system marks the space where the deleted file was as "empty." That "empty" space can be fairly easily undeleted, yielding the original file.
-
-### Magnetic storage
-
-If the disk is a magnetic storage device, such as a spinning hard disk, we suggest using [`nwipe`](https://en.wikipedia.org/wiki/Nwipe). `nwipe` can be installed in most Linux distributions. If you wish to use a complete boot environment on a system, consider using [ShredOS Disk Eraser](https://github.com/PartialVolume/shredos.x86_64). ShredOS boots straight into `nwipe` and allows you to erase available disks. To install it to a flash USB stick see the [installation methods](https://github.com/PartialVolume/shredos.x86_64/blob/master/README.md#obtaining-and-writing-shredos-to-a-usb-flash-drive-the-easy-way-).
-
-Once you have your boot media, enter your system's UEFI settings and boot from the USB stick. Commonly used keys to access UEFI are ++f2++, ++f12++, or ++del++. Follow the on-screen prompts to wipe your data.
-
-![ShredOS](../assets/img/erasing-data/shredos.png)
-
-### Flash Storage
-
-For [flash memory](https://en.wikipedia.org/wiki/Flash_memory) (SSD, NVMe, etc) devices we suggest the ATA Secure Erase command. Methods such as `nwipe` should not be used on flash storage devices as it may damage their performance. The "Secure Erase" feature is often accessible through the UEFI setup menu.
-
-It is also possible to complete a Secure Erase using the [`hdparm`](https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase) command, or [Microsoft Secure Group Commands](https://docs.microsoft.com/en-us/windows-hardware/drivers/storage/security-group-commands).
-
-Physical destruction may be necessary to securely erase devices such as memory cards, USB sticks and unusable hard disks.
-
-## Erasing Specific Files
-
-Securely shredding **individual files** is difficult if not impossible. Copies can exist in a variety of ways such as through manual, or automatic backups, [wear leveling](https://en.wikipedia.org/wiki/Wear_leveling) (on modern [flash storage](https://en.wikipedia.org/wiki/Solid-state_drive)), caching and filesystem [journaling](https://en.wikipedia.org/wiki/Journaling_file_system).
-
-Wear leveled devices do not guarantee a fixed relationship between [logical blocks addressed](https://en.wikipedia.org/wiki/Logical_block_addressing) through the interface. This means that the physical locations in which the data is stored may be different to where it is actually located, so shredding may not provide adequate security.

docs/advanced/integrating-metadata-removal.en.md

@@ -1,162 +0,0 @@
----
-title: "Integrating Metadata Removal"
-icon: 'material/data-matrix-remove'
----
-
-When sharing files, it's important to remove associated metadata. Image files commonly include [Exif](https://en.wikipedia.org/wiki/Exif) data, and sometimes photos even include GPS coordinates within its metadata.
-
-While there are plenty of metadata removal tools, they typically aren't convenient to use. The guides featured here aim to detail how to integrate metadata removal tools in a simple fashion by utilizing easy-to-access system features.
-
-- [Recommended metadata removal tools :material-arrow-right-drop-circle:](../data-redaction.md)
-
-## macOS
-
-This guide uses the [Shortcuts](https://support.apple.com/guide/shortcuts-mac/intro-to-shortcuts-apdf22b0444c/mac) app to add an [ExifTool](../data-redaction.md#exiftool) script to the *Quick Actions* context menu within Finder. Shortcuts is developed by Apple and bundled in with macOS by default.
-
-Shortcuts is quite intuitive to work with, so if you don't like the behavior demoed here then experiment with your own solution. For example, you could set the shortcut to take a clipboard input instead. The sky's the limit.
-
-![ExifTool Quick Action](../assets/img/integrating-metadata-removal/preview-macos.png)
-
-### Prerequisites
-
-1. [Homebrew](https://brew.sh): a package manager.
-
-    ```bash
-    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-    ```
-
-2. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata.
-
-    ```bash
-    brew install exiftool
-    ```
-
-!!! note
-    You can check if ExifTool is installed by running `exiftool -ver`. You should see a version number.
-
-### Creating the Shortcut
-
-1. Open **Shortcuts.app** and create a new shortcut
-
-2. In the shortcut's options, check **Use as Quick Action** and **Finder**
-
-3. Set up the retrieval options:
-
-    - Receive **Images, Media, and PDFs** input from **Quick Actions**
-    - If there is no input select **Continue**
-
-4. Add the **Run Shell Script** action to the shortcut. You may need to enable **Allow Running Scripts** in Shortcut.app's settings
-
-5. Set up the shell script action:
-     - Select **zsh** from the shell list
-     - Set the input to **Shortcut Input**
-     - Select **as arguments** for the pass input
-     - Leave **Run as administrator** unchecked
-
-6. Use the following as the body of the script:
-
-    ```bash
-    for f in "$@"
-    do
-        exiftool -all= "$f";
-    done
-    ```
-
-![macOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-macos.png)
-
-!!! tip "Worth Mentioning"
-    The open-source [ImageOptim](https://imageoptim.com/mac) app integrates into Finder's *Services* context menu by default. While it is primarily an image optimization app, it also removes metadata.
-
-### Enabling & using the Shortcut
-
-1. The shortcut will be accessible through **Quick Actions** context menu within Finder.
-
-2. If you want to reposition the shortcut within the context menu, go to:<br>
-   **System Preferences** → **Extensions** → **Finder and drag the shortcut's position**.
-
-## iOS and iPadOS
-
-[Shortcuts](https://support.apple.com/guide/shortcuts/welcome/ios) can be made accessible through the system Share Sheet, making accessing those shortcuts very convenient. This guide will show you how to build a metadata removal shortcut and integrate it into the system *Share Sheet*.
-
-!!! warning
-    This method of metadata removal is not as comprehensive at removing metadata as utilities like [ExifTool](../data-redaction.md#exiftool) and [mat2](../data-redaction.md#mat2) are.
-
-The lack of *good* metadata removal apps on the App Store is what makes this solution worthwhile.
-
-![Don't preserve metadata shortcut](../assets/img/integrating-metadata-removal/preview-ios.png)
-
-### Prerequisites
-
-1. [Shortcuts](https://apps.apple.com/us/app/shortcuts/id915249334) via the App Store.
-
-### Creating the Shortcut
-
-1. Create a new Shortcut
-
-2. Enter the Shortcut's settings and check **Show in Share Sheet**
-
-3. Add a **Receive** action and set it to receive **Images** from **Share Sheet**
-
-4. Add an **If** action
-
-5. Set the **If** action to **Shortcut Input** and **has any value**
-
-6. Add an **Otherwise** action
-
-7. Add an **End If** action
-
-8. Add a **Convert** action and set it to **If Result** and **Match Input**
-
-9. Finally, add a **Share** action and set that to **Converted Image**
-
-10. Make sure that you uncheck **preserve metadata**
-
-![iOS/iPadOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-ios.png)
-
-### Enabling & using the Shortcut
-
-1. The shortcut should be available through the system Share Sheet. If it is not, then a device restart may be required.
-2. Optionally, you can add the shortcut to your home screen.
-
-## Windows
-
-Windows allows you to place files in a **SendTo** folder which then appear in the *Send to* context menu. This guide will show you how to add an [ExifTool](../data-redaction.md#exiftool) batch script to this menu.
-
-![Send to metadata removal shortcut](../assets/img/integrating-metadata-removal/preview-windows.jpg)
-
-### Prerequisites
-
-1. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata. We suggest you read the [Installation instructions](https://exiftool.org/install.html#Windows) on the official website.
-
-!!! note
-    You can check if ExifTool is present in your [PATH](https://www.computerhope.com/issues/ch000549.htm) by running `exiftool -ver` in Command Prompt. You should see a version number.
-
-### Creating the shortcut
-
-1. Navigate to `%appdata%\Microsoft\Windows\SendTo`
-
-2. Right click in the **SendTo** folder and create a new **Text Document**
-
-3. Name the file `ExifTool.bat` (any name works, however it must end in `.bat`)
-
-    !!! note
-        You may need to check if [file name extensions](https://support.microsoft.com/en-us/windows/common-file-name-extensions-in-windows-da4a4430-8e76-89c5-59f7-1cdbbc75cb01) are enabled.
-
-4. Open **ExifTool.bat** in Notepad
-
-5. Copy the following into the document:
-
-    ```bat
-    exiftool -fast4 -if "$filepermissions =~ /^.w/" %*
-    if not errorlevel 0 (
-        echo Some files are write protected
-        exit /b %errorlevel%
-    )
-    exiftool -all= %*
-    ```
-
-6. Save
-
-### Using the shortcut
-
-1. Right click a supported file and choose **ExifTool.bat** within the *Send to* context menu.

docs/android.en.md

@@ -13,8 +13,8 @@ The **Android Open Source Project** is an open-source mobile operating system le
 
 These are the Android operating systems, devices, and apps we recommend to maximize your mobile device's security and privacy. To learn more about Android:
 
-- [General Android Overview :material-arrow-right-drop-circle:](android/overview.md)
-- [Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](android/grapheneos-vs-calyxos.md)
+- [General Android Overview :material-arrow-right-drop-circle:](os/android-overview.md)
+- [Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/)
 
 ## AOSP Derivatives
 
@@ -41,7 +41,7 @@ We recommend installing one of these custom Android operating systems on your de
     [:octicons-code-16:](https://grapheneos.org/source){ .card-link title="Source Code" }
     [:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
 
-GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as [push notifications](https://firebase.google.com/docs/cloud-messaging/), while giving you full control over their permissions and access, and while containing them to a specific [work profile](android/overview.md#work-profile) or [user profile](android/overview.md#user-profiles) of your choice.
+GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as [push notifications](https://firebase.google.com/docs/cloud-messaging/), while giving you full control over their permissions and access, and while containing them to a specific [work profile](os/android-overview.md#work-profile) or [user profile](os/android-overview.md#user-profiles) of your choice.
 
 Google Pixel phones are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#device-support).
 
@@ -64,7 +64,7 @@ Google Pixel phones are the only devices that currently meet GrapheneOS's [hardw
 DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates.
 DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747/) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
 
-DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) and SENSORS permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](android/grapheneos-vs-calyxos.md#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and higher features GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features).
+DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) and SENSORS permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and higher features GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features).
 
 DivestOS uses F-Droid as its default app store. Normally, we would recommend avoiding F-Droid due to its numerous [security issues](#f-droid). However, doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repositories ([DivestOS Official](https://divestos.org/fdroid/official/?fingerprint=E4BE8D6ABFA4D9D4FEEF03CDDA7FF62A73FD64B75566F6DD4E5E577550BE8467) and [DivestOS WebView](https://divestos.org/fdroid/webview/?fingerprint=FB426DA1750A53D7724C8A582B4D34174E64A84B38940E5D5A802E1DFF9A40D2)). We recommend disabling the official F-Droid app and using [Neo Store](https://github.com/NeoApplications/Neo-Store/) with the DivestOS repositories enabled to keep those components up to date. For other apps, our recommended methods of obtaining them still apply.
 
@@ -308,7 +308,7 @@ If you download APK files to install manually, you can verify their signature wi
 
 ![F-Droid logo](assets/img/android/f-droid.svg){ align=right width=120px }
 
-==We do **not** currently recommend F-Droid as a way to obtain apps.== F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds/) for some applications and is dedicated to free and open-source software. However, there are [notable problems](https://wonderfall.dev/fdroid-issues/) with the official F-Droid client, their quality control, and how they build, sign, and deliver packages.
+==We do **not** currently recommend F-Droid as a way to obtain apps.== F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds/) for some applications and is dedicated to free and open-source software. However, there are [notable problems](https://privsec.dev/posts/android/f-droid-security-issues/) with the official F-Droid client, their quality control, and how they build, sign, and deliver packages.
 
 Due to their process of building apps, apps in the official F-Droid repository often fall behind on updates. F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust.
 

docs/android/grapheneos-vs-calyxos.en.md

@@ -1,70 +0,0 @@
----
-title: "GrapheneOS or CalyxOS?"
-icon: 'material/cellphone-cog'
----
-
-GrapheneOS and CalyxOS are often compared as similar options for people looking for an alternative Android OS for their Pixel devices. Below are some of the reasons why we recommend GrapheneOS over CalyxOS.
-
-- [General Android Overview :material-arrow-right-drop-circle:](overview.md)
-- [Android Recommendations :material-arrow-right-drop-circle:](../android.md)
-
-## Update Frequency
-
-CalyxOS has a track record of being slower to apply security and feature updates to its OS and core applications than other custom Android operating systems. Timely security updates are one of the most important factors to consider when determining whether an OS is secure enough for regular use, which is a requirement for privacy.
-
-In contrast to that, GrapheneOS manages to stay close to upstream and in some cases even [deliver updates before the stock OS does](https://grapheneos.org/features#more-complete-patching).
-
-As an example, [GrapheneOS's first Android 12 release](https://grapheneos.org/releases#2021102020) was in October 2021, whereas [CalyxOS moved to Android 12](https://calyxos.org/news/2022/01/19/android-12-changelog/) in January 2022.
-
-## Sandboxed Google Play vs Privileged microG
-
-When Google Play Services are used on GrapheneOS, they are confined using the highly restrictive, default [`untrusted_app`](https://source.android.com/security/selinux/concepts) [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) domain. As a result, you have full control as to what these apps can access via permissions, just like any other app you install. Additionally, you can selectively choose which profile(s) to install the Sandboxed Google Play in.
-
-microG is a partially open-source re-implementation of Google Play Services.[^1] On CalyxOS, it runs in the highly privileged [`system_app`](https://source.android.com/security/selinux/concepts) SELinux domain like regular Google Play Services, and it uses [signature spoofing](https://github.com/microg/GmsCore/wiki/Signature-Spoofing) to masquerade as Google Play Services. This is less secure than Sandboxed Google Play's approach, which does not need access to sensitive system APIs.
-
-When using Sandboxed Google Play, you have the option to reroute location requests to the Play Services API back to the OS location API, which uses satellite based location services. With microG, you have the option to choose between different backend location providers, including *shifting trust* to another location backend, like Mozilla; using [DejaVu](https://github.com/n76/DejaVu), a location backend that locally collects and saves RF-based location data to an offline database which can be used when GPS is not available; or to simply not use a network location backend at all.
-
-Network location providers like Play Services or Mozilla rely the on the MAC addresses of surrounding WiFi access points and Bluetooth devices being submitted for location approximation. Choosing a network location like Mozilla to use with microG provides little to no privacy benefit over Google because you are still submitting the same data and trusting them to not profile you.
-
-Local RF location backends like DejaVu require that the phone has a working GPS first for the local RF data collected to be useful. This makes them less effective as location providers, as the job of a location provider is to assist location approximation when satellite based services are not working.
-
-If your [threat model](../basics/threat-modeling.md) requires protecting your location or the MAC addresses of nearby devices, rerouting location requests to the OS location API is probably the best option. The benefit brought by microG's custom location backend is minimal at best when compared to Sandboxed Google Play.
-
-In terms of application compatibility, ==Sandboxed Google Play on GrapheneOS is always going to be more compatible== as it is the same code as what is released by Google. microG is a reimplementation of these services. As a result, it only supports the various parts that have been reimplemented, meaning some things such as [Google Play Games](https://play.google.com/googleplaygames) and [In-app Billing API](https://android-doc.github.io/google/play/billing/api.html) are not yet supported.
-
-Larger apps, especially games, require [Play Asset Delivery](https://android-developers.googleblog.com/2020/06/introducing-google-play-asset-delivery.html) to be installed, which is currently not implemented in microG. Authentication using [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) with online services on Android also relies on Play Services, and does not currently work with microG.
-
-[^1]: It should be noted that microG still uses proprietary Google binaries for some of its components such as DroidGuard. Push notifications, if enabled, still go through Google's servers just like with Play Services. Outside of default microG setups like on CalyxOS, it is possible to run microG in the unprivileged [`untrusted app`](https://source.android.com/security/selinux/concepts) SELinux domain and without the signature spoofing patch. However, microG's functionality and compatibility, which is already not nearly as broad as Sandboxed Google Play, will greatly diminish.
-
-## Privileged eSIM Activation Application
-
-Currently, eSIM activation is tied to a privileged proprietary application by Google. The app has the `READ_PRIVILEGED_PHONE_STATE` permission, giving Google access to your hardware identifiers such as the IMEI.
-
-On GrapheneOS, the app comes disabled and you can *optionally* enable it after installing Sandboxed Google Play.
-
-On CalyxOS, the app comes installed by default (regardless of whether you choose to have microG or not) and you cannot opt-out. This means that Google still has access to your hardware identifiers regardless of whether or not you need eSIM activation and they can be accessed persistently.
-
-## Privileged App Extensions
-
-Android 12 comes with special support for seamless app updates with [third-party app stores](https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html). The popular Free and Open-Source Software (FOSS) repository [F-Droid](https://f-droid.org) doesn't implement this feature and requires a [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged) to be included with the Android distribution in order to have unattended app updates.
-
-CalyxOS includes the [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged), which may lower device security.
-
-On the other hand, GrapheneOS officially recommends [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play) instead. Many FOSS Android apps are also in Google's Play Store but sometimes they are not (like [NewPipe](../frontends.md#newpipe-android)). In those cases, you can [keep up with updates using RSS](../android.md#manually-with-rss-notifications).
-
-## Profiles
-
-GrapheneOS significantly improves [user profiles](overview.md#user-profiles) in [multiple ways](https://grapheneos.org/features#improved-user-profiles), such as increasing the limit of how many profiles you can create (32 instead of the standard 4), allowing you to log out of user profiles, disabling app installation, and notification forwarding. All of these improvements make it so user profiles can be daily driven without sacrificing too much usability.
-
-CalyxOS doesn't feature any improvements to user profiles over AOSP, and instead includes a device controller app so that the [work profile](overview.md#work-profile) can be used without needing to download a third party app such as [Shelter](../android.md#shelter). However, work profiles are not nearly as flexible (as you're limited to only one) and don't provide the same amount of isolation and security.
-
-## Additional Hardening
-
-GrapheneOS improves upon [AOSP](https://source.android.com/) security with:
-
-- **Hardened WebView:** Vanadium WebView requires [64-bit](https://en.wikipedia.org/wiki/64-bit_computing) processes on the [WebView](https://developer.android.com/reference/android/webkit/WebView) process and disables legacy [32-bit](https://en.wikipedia.org/wiki/32-bit_computing) processes. It uses hardened compiler options such as [`-fwrapv`](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html) and [`-fstack-protector-strong`](https://gcc.gnu.org/onlinedocs/gcc-4.9.3/gcc/Optimize-Options.html), which can help protect against [stack buffer overflows](https://en.wikipedia.org/wiki/Stack_buffer_overflow). [API](https://en.wikipedia.org/wiki/API)s such as the [battery status API](https://chromestatus.com/feature/4537134732017664) are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means that apps which use WebView will also benefit from Vanadium's hardening. The [Vanadium patch set](https://github.com/GrapheneOS/Vanadium) is a lot more comprehensive than CalyxOS's [Chromium patch set](https://gitlab.com/CalyxOS/chromium-patches) which is derived from it.
-- **Hardened Kernel:** GrapheneOS kernel includes some hardening from the [linux-hardened](https://github.com/GrapheneOS/linux-hardened) project and the [Kernel Self Protection Project (KSPP)](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). CalyxOS uses the [same kernel](https://calyxos.org/docs/development/build/kernel/) as regular Android with some minor modifications.
-- **Hardened Memory Allocator:** GrapheneOS uses the [hardened malloc](https://github.com/GrapheneOS/hardened_malloc) subproject as its memory allocator. This focuses on hardening against [memory heap corruption](https://en.wikipedia.org/wiki/Memory_corruption). CalyxOS uses the default AOSP [Scudo Malloc](https://source.android.com/devices/tech/debug/scudo), which is generally [less effective](https://twitter.com/danielmicay/status/1033671709197398016). Hardened Malloc has uncovered vulnerabilities in AOSP which have been [fixed](https://github.com/GrapheneOS/platform_system_core/commit/be11b59725aa6118b0e1f0712572e835c3d50746) by GrapheneOS such as [CVE-2021-0703](https://nvd.nist.gov/vuln/detail/CVE-2021-0703).
-- **Secure Exec Spawning:** GrapheneOS [spawns](https://en.wikipedia.org/wiki/Spawn_(computing)) fresh processes as opposed to using the [Zygote model](https://ayusch.com/android-internals-the-android-os-boot-process) used by AOSP and CalyxOS. The Zygote model weakens [Address Space Layout Randomization](https://en.wikipedia.org/wiki/Address_space_layout_randomization) (ASLR) and is considered [less secure](https://wenke.gtisc.gatech.edu/papers/morula.pdf). Creating [fresh processes](https://grapheneos.org/usage#exec-spawning) is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an [old device](https://support.google.com/nexus/answer/4457705) with slow storage such as the Pixel 3a/3a XL as it has [eMMC](https://en.wikipedia.org/wiki/MultiMediaCard#eMMC).
-
-**Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening**. For a more complete list, please read GrapheneOS' [official documentation](https://grapheneos.org/features).

docs/articles.en.md

@@ -1,12 +0,0 @@
----
-title: Curated Articles from Around the Web
-hide:
-    - navigation
-    - feedback
----
-<script>
-    window.location.href = "https://discuss.privacyguides.org/c/blog/10";
-</script>
-{% for article in articles %}
-- **{{ article.date }}**: [{{ article.name }}]({{ article.url }}) from *{{ article.publisher }}*
-{% endfor %}

docs/assets/img/calendar-contacts/etesync.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><defs><filter id="filter4510-5" color-interpolation-filters="sRGB"><feFlood flood-color="rgb(0,0,0)" flood-opacity=".49804" result="flood"/><feComposite in="flood" in2="SourceGraphic" operator="in" result="composite1"/><feGaussianBlur in="composite1" result="blur" stdDeviation="4"/><feOffset dx="0" dy="4" result="offset"/><feComposite in="SourceGraphic" in2="offset" result="composite2"/></filter><filter id="filter4498-9" color-interpolation-filters="sRGB"><feFlood flood-color="rgb(0,0,0)" flood-opacity=".49804" result="flood"/><feComposite in="flood" in2="SourceGraphic" operator="in" result="composite1"/><feGaussianBlur in="composite1" result="blur" stdDeviation="4"/><feOffset dx="0" dy="4" result="offset"/><feComposite in="SourceGraphic" in2="offset" result="composite2"/></filter></defs><g transform="translate(0 -263.13)"><g transform="matrix(.072143 0 0 .072143 -44.234 303.31)"><path d="m616.42-553.5h460.75v460.75h-460.75z" fill="none" stroke-width="19.198"/><path d="m616.42-553.5h460.75v460.75h-460.75z" fill="none" stroke-width="19.198"/><path transform="matrix(2.4096 0 0 2.3916 493.87 -784.51)" d="m210.91 166.8v-37.52h-37.52l-26.48-26.48-26.48 26.48h-37.52v37.52l-26.48 26.48 26.48 26.48v37.52h37.52l26.48 26.48 26.48-26.48h37.52v-37.52l26.48-26.48z" fill="#ffc107" filter="url(#filter4498-9)" stroke-width="8"/><g transform="matrix(3.4337 0 0 3.196 364.57 -621.88)"><path d="m73.384 21.914h134.74v143.68h-134.74z" fill="none" stroke-width="5.7972"/><ellipse cx="140.78" cy="93.719" rx="11.3" ry="12.05" fill="#ffd740" stroke="#ffd740" stroke-linecap="round" stroke-linejoin="round" stroke-width="44.182"/><path transform="matrix(.71931 0 0 .73752 35.063 302.34)" d="m146.91-329.25v-17.45l-23.295 23.266 23.295 23.266v-17.45c19.276 0 34.942 15.647 34.942 34.9 0 5.8748-1.4559 11.459-4.0766 16.287l8.5026 8.4923c4.5425-7.1544 7.2214-15.647 7.2214-24.779 0-25.709-20.849-46.533-46.59-46.533zm0 81.433c-19.277 0-34.942-15.647-34.942-34.9 0-5.8748 1.4559-11.459 4.0766-16.287l-8.5026-8.4923c-4.5425 7.1544-7.2214 15.647-7.2214 24.779 0 25.709 20.849 46.533 46.59 46.533v17.45l23.295-23.266-23.295-23.266z" fill="#448aff" filter="url(#filter4510-5)" stroke-width="5.8202"/><path d="m73.384 21.914h134.74v143.68h-134.74z" fill="none" stroke-width="5.7972"/></g></g></g></svg>

docs/assets/img/frontends/proxitok.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(1.4916 0 0 1.4916 -108.81 -169.4)"><path d="m75.442 117.85c3.3426-0.62057 5.8921-0.31143 8.1139 2.4694 2.9164-2.5188 5.4372-2.8222 9.1722-2.8222-4.1614-5.3918-13.3-5.0479-17.286 0.35278m-2.4694 8.8194h0.35278c0.57274-2.4745 1.4387-4.7979 3.5278-6.35-0.0024 3.6523-2.0171 8.0642-1.0975 11.636 0.49495 1.9227 3.2713 3.1322 4.9781 3.7012 4.9853 1.6617 10.772-0.5401 13.344-5.1071 2.4443-4.3407 2.4887-10.227-3.1135-10.936-0.54247 2.8791-1.2627 5.8902-1.3972 8.8194-0.0545 1.1867 0.16563 2.8529-1.1229 3.4973-1.6634 0.83189-2.0984-1.2819-2.0042-2.439 0.26141-3.2124 1.2561-6.5356 2.4076-9.525-1.338 0.0285-3.3185 0.0732-4.3735 1.0352-0.7456 0.67987-0.64012 1.9754-1.0793 2.8451-1.3627 2.6986-3.871 3.4357-6.5416 2.4697 1.198-0.74525 2.8991-1.1261 3.5245-2.5076 1.8751-4.1413-4.1426-6.0016-6.4428-3.0566-1.2381 1.5851-0.96224 4.037-0.96224 5.9169z" fill="#4343ff"/></g></svg>

docs/assets/img/messengers/molly.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="127.99" height="128" version="1.1" viewBox="0 0 33.864 33.867" xmlns="http://www.w3.org/2000/svg"><g transform="translate(-48.383 -89.279)"><g transform="matrix(.083544 0 0 .083551 36.799 77.694)"><path d="m220.51 504.06 120.82 39.937 1.2e-4 4e-5 -143.92-5e-5zm323.49-162.73c0 111.93-90.737 202.67-202.67 202.67-111.93-1e-5 -202.67-90.737-202.67-202.67s90.737-202.67 202.67-202.67c111.93 0 202.67 90.737 202.67 202.67z" fill="#7663f0"/><g transform="translate(-5.1601e-6,-4.0973)"><circle cx="341" cy="433.47" r="23.536" fill="#f9f8fe" stroke-width=".64448"/><circle cx="439.19" cy="375.64" r="23.536" fill="#aaa4ce" stroke-width=".64448"/><circle cx="242.81" cy="375.64" r="23.536" fill="#cba1fe" stroke-width=".64447"/><g stroke-width=".64448"><circle cx="439.19" cy="433.47" r="23.536" fill="#f9f8fe"/><circle cx="439.19" cy="317.82" r="23.536" fill="#aacdf4"/><circle cx="242.81" cy="260" r="23.536" fill="#4b0f9f"/></g><circle cx="242.81" cy="317.82" r="23.536" fill="#aaa4ce" stroke-width=".64447"/><g stroke-width=".64448"><circle cx="242.81" cy="433.47" r="23.536" fill="#f9f8fe"/><circle cx="341" cy="317.82" r="23.536" fill="#4b0f9f"/><circle cx="341" cy="375.64" r="23.536" fill="#aacdf4"/></g><circle cx="439.19" cy="260" r="23.536" fill="#4b0f9f" stroke-width=".64447"/></g></g></g></svg>

docs/assets/img/messengers/simplex.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><defs><linearGradient id="paint0_linear_40_164" x1="135.95" x2="132.1" y1="-.81633" y2="36.986" gradientTransform="matrix(.26458 0 0 .26458 5.515 28.687)" gradientUnits="userSpaceOnUse"><stop stop-color="#01F1FF" offset="0"/><stop stop-color="#0197FF" offset="1"/></linearGradient></defs><g transform="matrix(3.1801 0 0 3.1801 -119.14 -91.124)" clip-rule="evenodd" fill-rule="evenodd" stroke-width=".26458"><path d="m38.412 31.362 1.7518 1.7407 1.8005-1.7891 0.87577 0.87034-1.8005 1.789 1.7518 1.7407-0.90011 0.89453-1.7518-1.7407-1.8005 1.7891-0.87577-0.87035 1.8002-1.7891-1.7515-1.7407z" fill="#030749"/><path d="m41.877 36.625 0.89323-0.88757-5.29e-4 -2.38e-4 1.7867-1.775-1.7526-1.7412 2.65e-4 -1.58e-4 -0.8763-0.87072-1.7523-1.7414 0.89297-0.88756 1.7526 1.7414 1.7865-1.7752 0.8763 0.8707-1.7867 1.7751 1.7526 1.7414 1.7865-1.7751 0.8763 0.87071-1.7867 1.775 1.7529 1.7415-0.89323 0.88757-1.7529-1.7415-1.7862 1.7751 1.7526 1.7415-0.89323 0.88754-1.7526-1.7415-1.7862 1.7752-0.8763-0.87069z" fill="url(#paint0_linear_40_164)"/></g></svg>

docs/assets/img/qubes/qubes_os.svg

@@ -1,2 +1,2 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.52916 0 0 .52916 .0017986 -523)"><g transform="matrix(.40296 0 0 .40296 360.66 978.2)"><path d="m-816.29 25.214a15.882 15.918 0 0 0-8.3171 2.135l-53.648 31.034a15.882 15.918 0 0 0-7.9452 13.784v62.1a15.882 15.918 0 0 0 7.9452 13.768l53.648 31.058a15.882 15.918 0 0 0 15.882 0l53.656-31.058a15.882 15.918 0 0 0 7.9371-13.768v-62.1a15.882 15.918 0 0 0-7.9371-13.784l-53.656-31.034a15.882 15.918 0 0 0-7.5652-2.135zm-0.17228 35.101a8.7349 8.755 0 0 1 4.1636 1.169l29.512 17.071a8.7349 8.755 0 0 1 4.3663 7.582v34.159a8.7349 8.755 0 0 1-4.3663 7.5656l-29.512 17.088a8.7349 8.755 0 0 1-8.7305 0l-29.513-17.088a8.7349 8.755 0 0 1-4.3653-7.5656v-34.159a8.7349 8.755 0 0 1 4.3653-7.582l29.513-17.071a8.7349 8.755 0 0 1 4.5669-1.169z" fill="#63a0ff"/><path d="m-749.26 64.233-30.34 17.551a8.7349 8.755 0 0 1 1.1738 4.375v34.15a8.7349 8.755 0 0 1-4.3652 7.5742l-29.504 17.08a8.7349 8.755 0 0 1-4.3496 1.1602v35.102a15.882 15.918 0 0 0 7.9219-2.1191l11.936-6.9082 15.23 8.8633c6.8122 3.9643 17.78 3.9643 24.592 0l6.8106-3.9629c6.8122-3.9643 6.8122-10.348 0-14.312l-15.146-8.8144 10.234-5.9238a15.882 15.918 0 0 0 7.9375-13.768v-62.092a15.882 15.918 0 0 0-2.1309-7.9551z" fill="#3874d8"/><path d="m-884.06 64.207 30.334 17.56a8.7349 8.755 0 0 1 3.1929-3.2071l29.508-17.075a8.7349 8.755 0 0 1 8.7265 3e-3l29.51 17.071a8.7349 8.755 0 0 1 3.1777 3.1948l30.328-17.55a15.882 15.918 0 0 0-5.791-5.8162l-53.664-31.045a15.882 15.918 0 0 0-15.864-5e-3l-53.649 31.046a15.882 15.918 0 0 0-5.8092 5.8265z" fill="#99bfff"/></g></g></svg>
+<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.52917 0 0 .52917 .0016651 -523.01)"><g transform="matrix(.40296 0 0 .40296 360.66 978.2)"><path d="m-816.29 25.214a15.882 15.918 0 0 0-8.3171 2.135l-53.648 31.034a15.882 15.918 0 0 0-7.9452 13.784v62.1a15.882 15.918 0 0 0 7.9452 13.768l53.648 31.058a15.882 15.918 0 0 0 15.882 0l53.656-31.058a15.882 15.918 0 0 0 7.9371-13.768v-62.1a15.882 15.918 0 0 0-7.9371-13.784l-53.656-31.034a15.882 15.918 0 0 0-7.5652-2.135zm-0.17228 35.101a8.7349 8.755 0 0 1 4.1636 1.169l29.512 17.071a8.7349 8.755 0 0 1 4.3663 7.582v34.159a8.7349 8.755 0 0 1-4.3663 7.5656l-29.512 17.088a8.7349 8.755 0 0 1-8.7305 0l-29.513-17.088a8.7349 8.755 0 0 1-4.3653-7.5656v-34.159a8.7349 8.755 0 0 1 4.3653-7.582l29.513-17.071a8.7349 8.755 0 0 1 4.5669-1.169z" fill="#63a0ff"/><path d="m-749.26 64.233-30.34 17.551a8.7349 8.755 0 0 1 1.1738 4.375v34.15a8.7349 8.755 0 0 1-4.3652 7.5742l-29.504 17.08a8.7349 8.755 0 0 1-4.3496 1.1602v35.102a15.882 15.918 0 0 0 7.9219-2.1191l11.936-6.9082 15.23 8.8633c6.8122 3.9643 17.78 3.9643 24.592 0l6.8106-3.9629c6.8122-3.9643 6.8122-10.348 0-14.312l-15.146-8.8144 10.234-5.9238a15.882 15.918 0 0 0 7.9375-13.768v-62.092a15.882 15.918 0 0 0-2.1309-7.9551z" fill="#3874d8"/><path d="m-884.06 64.207 30.334 17.56a8.7349 8.755 0 0 1 3.1929-3.2071l29.508-17.075a8.7349 8.755 0 0 1 8.7265 3e-3l29.51 17.071a8.7349 8.755 0 0 1 3.1777 3.1948l30.328-17.55a15.882 15.918 0 0 0-5.791-5.8162l-53.664-31.045a15.882 15.918 0 0 0-15.864-5e-3l-53.649 31.046a15.882 15.918 0 0 0-5.8092 5.8265z" fill="#99bfff"/></g></g></svg>

docs/assets/stylesheets/blog.css

@@ -1,34 +0,0 @@
-/* Homepage hero section */
-
-.mdx-hero {
-    color: var(--pg-hero-color);
-    margin: 0 0.8rem;
-    text-align: center;
-}
-.mdx-hero h1 {
-    color: currentcolor;
-    margin-bottom: 1rem;
-    font-size: 2.6rem;
-}
-@media screen and (max-width: 29.9375em) {
-    .mdx-hero h1 {
-        font-size: 1.4rem;
-    }
-}
-.mdx-hero__content {
-    margin-top: 2rem;
-    padding-bottom: 0rem;
-}
-[data-md-color-scheme="slate"] .mdx-hero .md-button--primary {
-    color: var(--md-primary-fg-color);
-}
-.mdx-hero .md-button--primary {
-    color: var(--md-primary-fg-color);
-    background-color: var(--pg-hero-color);
-    border-color: transparent;
-    margin-right: 0.5rem;
-    margin-top: 0.5rem;
-}
-nav[class="md-tabs"] {
-    border-bottom: none;
-}

docs/assets/stylesheets/extra.css

@@ -193,12 +193,11 @@ img[align="right"], svg[align="right"] {
 .md-typeset .admonition.downloads,
 .md-typeset details.downloads {
     border: none;
+    box-shadow: none;
 }
 .md-typeset .downloads > .admonition-title,
 .md-typeset .downloads > summary {
     background-color: rgba(43, 155, 70, 0.0);
-    border: none;
-    padding-left: 0.6rem;
 }
 .md-typeset .downloads > .admonition-title::before,
 .md-typeset .downloads > .admonition-title,
@@ -230,6 +229,25 @@ details[class="downloads annotate"] > p .md-annotation span span::before {
     list-style-type: none;
 }
 
+
+.md-typeset .admonition.person,
+.md-typeset details.person {
+    border-color: var(--md-default-bg-color);
+    box-shadow: none;
+    background-color: var(--md-default-bg-color);
+    margin: 0;
+}
+.md-typeset .person > .admonition-title,
+.md-typeset .person > summary {
+    background-color: var(--md-default-bg-color);
+}
+.md-typeset .person > .admonition-title::before,
+.md-typeset .person > summary::before {
+    background-color: var(--md-accent-fg-color);
+    -webkit-mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" height="48" width="48"><path d="M24 23.95q-3.3 0-5.4-2.1-2.1-2.1-2.1-5.4 0-3.3 2.1-5.4 2.1-2.1 5.4-2.1 3.3 0 5.4 2.1 2.1 2.1 2.1 5.4 0 3.3-2.1 5.4-2.1 2.1-5.4 2.1ZM8 40v-4.7q0-1.9.95-3.25T11.4 30q3.35-1.5 6.425-2.25Q20.9 27 24 27q3.1 0 6.15.775 3.05.775 6.4 2.225 1.55.7 2.5 2.05.95 1.35.95 3.25V40Z"/></svg>');
+            mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" height="48" width="48"><path d="M24 23.95q-3.3 0-5.4-2.1-2.1-2.1-2.1-5.4 0-3.3 2.1-5.4 2.1-2.1 5.4-2.1 3.3 0 5.4 2.1 2.1 2.1 2.1 5.4 0 3.3-2.1 5.4-2.1 2.1-5.4 2.1ZM8 40v-4.7q0-1.9.95-3.25T11.4 30q3.35-1.5 6.425-2.25Q20.9 27 24 27q3.1 0 6.15.775 3.05.775 6.4 2.225 1.55.7 2.5 2.05.95 1.35.95 3.25V40Z"/></svg>');
+}
+
 @media screen and (max-width: 600px) {
   .downloads > ul {
     grid-template-columns: repeat(2, 1fr);
@@ -445,28 +463,8 @@ div[class="md-source__icon md-icon"], div[class="md-source__repository md-source
 
 /* Redesigned admonitions */
 
-.md-typeset .admonition.recommendation {
-    border: 1px solid var(--pg-light-border);
-}
-
 .md-typeset :is(.admonition, details) {
     background-color: var(--md-primary-fg-color);
-    box-shadow: none;
-    border-radius: 6px;
-    border: 1px solid;
-    border-left-width: 1px!important;
-}
-
-.md-typeset :is(.admonition-title, summary) {
-    margin-left: -0.6rem!important;
-}
-
-.md-typeset details:not(.downloads, [open]) summary:hover {
-    box-shadow: inset 0 0 100px 100px rgba(255, 255, 255, 0.6);
-}
-
-[data-md-color-scheme="slate"] .md-typeset details:not(.downloads, [open]) summary:hover {
-    box-shadow: inset 0 0 100px 100px rgba(255, 255, 255, 0.1);
 }
 
 .md-typeset .recommendation img[align="right"] {

docs/basics/account-creation.en.md

@@ -0,0 +1,80 @@
+---
+title: "Account Creation"
+icon: 'material/account-plus'
+---
+
+Often people sign up for services without thinking. Maybe it's a streaming service so you can watch that new show everyone's talking about, or an account that gives you a discount for your favorite fast food place. Whatever the case may be, you should consider the implications for your data now and later on down the line.
+
+There are risks associated with every new service that you use. Data breaches; disclosure of customer information to third parties; rogue employees accessing data; all are possibilities that must be considered when giving your information out. You need to be confident that you can trust the service, which is why we don't recommend storing valuable data on anything but the most mature and battle-tested products. That usually means services which provide E2EE and have undergone a cryptographic audit. An audit increases assurance that the product was designed without glaring security issues caused by an inexperienced developer.
+
+It can also be difficult to delete the accounts on some services. Sometimes [overwriting data](account-deletion.en.md#overwriting-account-information) associated with an account can be possible, but in other cases the service will keep an entire history of changes to the account.
+
+## Terms of Service & Privacy Policy
+
+The ToS are the rules that you agree to follow when using the service. With larger services these rules are often enforced by automated systems. Sometimes these automated systems can make mistakes. For example, you may be banned or locked out of your account on some services for using a VPN or VOIP number. Appealing such bans is often difficult, and involves an automated process too, which isn't always successful. This would be one of the reasons why we wouldn't suggest using Gmail for email as an example. Email is crucial for access to other services you might have signed up for.
+
+The Privacy Policy is how the service says they will use your data and it is worth reading so that you understand how your data will be used. A company or organization might not be legally obligated to follow everything contained in the policy (it depends on the jurisdiction). We would recommend having some idea what your local laws are and what they permit a provider to collect.
+
+We recommend looking for particular terms such as "data collection", "data analysis", "cookies", "ads" or "3rd-party" services. Sometimes you will be able to opt-out from data collection or from sharing your data, but it is best to choose a service that respects your privacy from the start.
+
+You also also placing your trust in the company or organization to actually comply with their own privacy policy.
+
+## Authentication methods
+
+There are usually multiple ways to sign up for an account, each with their own benefits and drawbacks.
+
+### Email and password
+
+The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](passwords-overview.md) regarding passwords.
+
+!!! tip
+
+    You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key.
+
+You will be responsible for managing your login credentials. For added security, you can set up [MFA](multi-factor-authentication.md) on your accounts.
+
+[Recommended password managers](../passwords.md){ .md-button }
+
+#### Email aliases
+
+If you don't want to give your real email address to a service, you have the option to use an alias. We described them in more detail on our email services recommendation page. Essentially, alias services allow you to generate new email addresses that forward all emails to your main address. This can help prevent tracking across services and help you manage the marketing emails that sometimes come with the sign up process. Those can be filtered automatically based on the alias they are sent to.
+
+Should a service get hacked, you might start receiving phishing or spam emails to the address you used to sign up. Using unique aliases for each service can assist in identifying exactly what service was hacked.
+
+[Recommended email aliasing services](../email.md#email-aliasing-services){ .md-button }
+
+### Single sign-on
+
+!!! note
+  
+    We are discussing Single sign-on for personal use, not enterprise users.
+
+Single sign-on (SSO) is an authentication method that allows you to register for a service without sharing much information, if any. Whenever you see something along the lines of "Sign-in with *provider name*" on a registration form it's SSO.
+
+When you choose single sign-on in a website, it will prompt your SSO provider login page and after that your account will be connected. Your password won't be shared but some basic information will (you can review it during the login request). This process is needed every time you want to log in to the same account.
+
+The main advantages are:
+
+- **Security**: no risk of being involved in a [data breach](https://en.wikipedia.org/wiki/Data_breach) because the website does not store your credentials.
+- **Ease of use**: multiple accounts are managed by a single login.
+
+But there are disadvantages:
+
+- **Privacy**: a SSO provider will know the services you use.
+- **Centralization**: if your SSO account gets compromised or you aren't able to login to it, all other accounts connected to it are affected.
+
+SSO can be especially useful in those situations where you could benefit from deeper integration between services. For example, one of those services may offer SSO for the others. Our recommendation is to limit SSO to only where you need it and protect the main account with [MFA](multi-factor-authentication.md).
+
+All services that use SSO will be as secure as your SSO account. For example, if you want to secure an account with a hardware key but that service doesn't support hardware keys, you can secure your SSO account with a hardware key and now you essentially have hardware MFA on all your accounts. It is worth noting though that weak authentication on your SSO account means that any account tied to that login will also be weak.
+
+### Phone number
+
+We recommend avoiding services that require a phone number for sign up. A phone number can identity you across multiple services and depending on data sharing agreements this will make your usage easier to track, particularly if one of those services is breached as the phone number is often **not** encrypted.
+
+You should avoid giving out your real phone number if you can. Some services will allow the use of VOIP numbers, however these often trigger fraud detection systems, causing an account to be locked down, so we don't recommend that for important accounts.
+
+In many cases you will need to provide a number that you can receive SMS or calls from, particularly when shopping internationally, in case there is a problem with your order at border screening. It's common for services to use your number as a verification method; don't let yourself get locked out of an important account because you wanted to be clever and give a fake number!
+
+### Username and password
+
+Some services allow you to register without using an email address and only require you to set a username and password. These services may provide increased anonymity when combined with a VPN or Tor. Keep in mind that for these accounts there will most likely be **no way to recover your account** in the event you forget your username or password.

docs/basics/common-misconceptions.en.md

@@ -0,0 +1,59 @@
+---
+title: "Common Misconceptions"
+icon: 'material/robot-confused'
+---
+
+## "Open-source software is always secure" or "Proprietary software is more secure"
+
+These myths stem from a number of prejudices, but whether the source code is available and how software is licensed does not inherently affect its security in any way. ==Open-source software has the *potential* to be more secure than proprietary software, but there is absolutely no guarantee this is the case.== When you evaluate software, you should look at the reputation and security of each tool on an individual basis.
+
+Open-source software *can* be audited by third-parties, and is often more transparent about potential vulnerabilities than proprietary counterparts. It also allows you to review the code and disable any suspicious functionality you find yourself. However, *unless you do so*, there is no guarantee that code has ever been evaluated, especially with smaller software projects. The open development process has also sometimes been exploited to introduce new vulnerabilities into even large projects.[^1]
+
+On the flip side, proprietary software is less transparent, but that doesn't imply that it's not secure. Major proprietary software projects can be audited internally and by third-party agencies, and independent security researchers can still find vulnerabilities with techniques like reverse engineering.
+
+To avoid biased decisions, it's *vital* that you evaluate the privacy and security standards of the software you use.
+
+## "Shifting trust can increase privacy"
+
+We talk about "shifting trust" a lot when discussing solutions like VPNs (which shift the trust you place in your ISP to the VPN provider). While this protects your browsing data from your ISP *specifically*, the VPN provider you choose still has access to your browsing data: Your data isn't completely secured from all parties. This means that:
+
+1. You must exercise caution when choosing a provider to shift trust to.
+2. You should still use other techniques, like E2EE, to protect your data completely. Merely distrusting one provider to trust another is not securing your data.
+
+## "Privacy-focused solutions are inherently trustworthy"
+
+Focusing solely on the privacy policies and marketing of a tool or provider can blind you to its weaknesses. When you're looking for a more private solution, you should determine what the underlying problem is and find technical solutions to that problem. For example, you may want to avoid Google Drive, which gives Google access to all of your data. The underlying problem in this case is lack of E2EE, so you should make sure that the provider you switch to actually implements E2EE, or use a tool (like [Cryptomator](../encryption.md#cryptomator-cloud)) which provides E2EE on any cloud provider. Switching to a "privacy-focused" provider (that doesn't implement E2EE) doesn't solve your problem: it just shifts trust from Google to that provider.
+
+The privacy policies and business practices of providers you choose are very important, but should be considered secondary to technical guarantees of your privacy: You shouldn't shift trust to another provider when trusting a provider isn't a requirement at all.
+
+## "Complicated is better"
+
+We often see people describing privacy threat models that are overly complex. Often, these solutions include problems like many different email accounts or complicated setups with lots of moving parts and conditions. The replies are usually answers to "What is the best way to do *X*?"
+
+Finding the "best" solution for yourself doesn't necessarily mean you are after an infallible solution with dozens of conditions—these solutions are often difficult to work with realistically. As we discussed previously, security often comes at the cost of convenience. Below, we provide some tips:
+
+1. ==Actions need to serve a particular purpose:== think about how to do what you want with the fewest actions.
+2. ==Remove human failure points:== We fail, get tired, and forget things. To maintain security, avoid relying on manual conditions and processes that you have to remember.
+3. ==Use the right level of protection for what you intend.== We often see recommendations of so-called law-enforcement or subpoena-proof solutions. These often require specialist knowledge and generally aren't what people want. There's no point in building an intricate threat model for anonymity if you can be easily de-anonymized by a simple oversight.
+
+So, how might this look?
+
+One of the clearest threat models is one where people *know who you are* and one where they do not. There will always be situations where you must declare your legal name and there are others where you don't need to.
+
+1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses.
+
+    We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means.
+
+    !!! tip
+
+        When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private.
+
+2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc.
+
+    You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC.
+
+3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly.
+
+    Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.)
+
+[^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident).

docs/basics/common-threats.en.md

@@ -38,7 +38,7 @@ To minimize the damage that a malicious piece of software *could* do, you should
 
     Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources.
 
-    Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as Qubes OS.
+    Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../../desktop/#qubes-os).
 
 <span class="pg-red">:material-target-account: Targeted Attacks</span>
 
@@ -68,7 +68,7 @@ Thankfully, E2EE can alleviate this issue by encrypting communications between y
 
     Therefore, you should use native applications over web clients whenever possible.
 
-Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](basics/threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all.
+Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all.
 
 ## Mass Surveillance Programs
 
@@ -124,74 +124,18 @@ Censorship online can be carried out (to varying degrees) by actors including to
 
 Censorship on corporate platforms is increasingly common, as platforms like Twitter and Facebook give in to public demand, market pressures, and pressures from government agencies. Government pressures can be covert requests to businesses, such as the White House [requesting the takedown](https://www.nytimes.com/2012/09/17/technology/on-the-web-a-fine-line-on-free-speech-across-globe.html) of a provocative YouTube video, or overt, such as the Chinese government requiring companies to adhere to a strict regime of censorship.
 
-People concerned with the threat of censorship can use technologies like [Tor](tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily.
+People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily.
 
 !!! important
 
     While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic.
 
-    You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](basics/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection).
+    You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection).
 
 You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught.
 
-## Common Misconceptions
-
-:material-numeric-1-circle: **"Open-source software is always secure"** or **"Proprietary software is more secure"**
-
-These myths stem from a number of prejudices, but whether the source code is available and how software is licensed does not inherently affect its security in any way. ==Open-source software has the *potential* to be more secure than proprietary software, but there is absolutely no guarantee this is the case.== When you evaluate software, you should look at the reputation and security of each tool on an individual basis.
-
-Open-source software *can* be audited by third-parties, and is often more transparent about potential vulnerabilities than proprietary counterparts. It also allows you to review the code and disable any suspicious functionality you find yourself. However, *unless you do so*, there is no guarantee that code has ever been evaluated, especially with smaller software projects. The open development process has also sometimes been exploited to introduce new vulnerabilities into even large projects.[^6]
-
-On the flip side, proprietary software is less transparent, but that doesn't imply that it's not secure. Major proprietary software projects can be audited internally and by third-party agencies, and independent security researchers can still find vulnerabilities with techniques like reverse engineering.
-
-To avoid biased decisions, it's *vital* that you evaluate the privacy and security standards of the software you use.
-
-:material-numeric-2-circle: **"Shifting trust can increase privacy"**
-
-We talk about "shifting trust" a lot when discussing solutions like VPNs (which shift the trust you place in your ISP to the VPN provider). While this protects your browsing data from your ISP *specifically*, the VPN provider you choose still has access to your browsing data: Your data isn't completely secured from all parties. This means that:
-
-1. You must exercise caution when choosing a provider to shift trust to.
-2. You should still use other techniques, like E2EE, to protect your data completely. Merely distrusting one provider to trust another is not securing your data.
-
-:material-numeric-3-circle: **"Privacy-focused solutions are inherently trustworthy"**
-
-Focusing solely on the privacy policies and marketing of a tool or provider can blind you to its weaknesses. When you're looking for a more private solution, you should determine what the underlying problem is and find technical solutions to that problem. For example, you may want to avoid Google Drive, which gives Google access to all of your data. The underlying problem in this case is lack of E2EE, so you should make sure that the provider you switch to actually implements E2EE, or use a tool (like [Cryptomator](encryption.md#cryptomator-cloud)) which provides E2EE on any cloud provider. Switching to a "privacy-focused" provider (that doesn't implement E2EE) doesn't solve your problem: it just shifts trust from Google to that provider.
-
-The privacy policies and business practices of providers you choose are very important, but should be considered secondary to technical guarantees of your privacy: You shouldn't shift trust to another provider when trusting a provider isn't a requirement at all.
-
-:material-numeric-4-circle: **"Complicated is better"**
-
-We often see people describing privacy threat models that are overly complex. Often, these solutions include problems like many different email accounts or complicated setups with lots of moving parts and conditions. The replies are usually answers to "What is the best way to do *X*?"
-
-Finding the "best" solution for yourself doesn't necessarily mean you are after an infallible solution with dozens of conditions—these solutions are often difficult to work with realistically. As we discussed previously, security often comes at the cost of convenience. Below, we provide some tips:
-
-1. ==Actions need to serve a particular purpose:== think about how to do what you want with the fewest actions.
-2. ==Remove human failure points:== We fail, get tired, and forget things. To maintain security, avoid relying on manual conditions and processes that you have to remember.
-3. ==Use the right level of protection for what you intend.== We often see recommendations of so-called law-enforcement or subpoena-proof solutions. These often require specialist knowledge and generally aren't what people want. There's no point in building an intricate threat model for anonymity if you can be easily de-anonymized by a simple oversight.
-
-So, how might this look?
-
-One of the clearest threat models is one where people *know who you are* and one where they do not. There will always be situations where you must declare your legal name and there are others where you don't need to.
-
-1. **Known identity** - A known identity is used for things where you must declare your name. There are many legal documents and contracts where a legal identity is required. This could range from opening a bank account, signing a property lease, obtaining a passport, customs declarations when importing items, or otherwise dealing with your Government. These things will usually lead to credentials such as credit cards, credit rating checks, account numbers, and possibly physical addresses.
-
-    We don't suggest using a VPN or Tor for any of these things, as your identity is already known through other means.
-
-    !!! tip
-
-        When shopping online, the use of a [parcel locker](https://en.wikipedia.org/wiki/Parcel_locker) can help keep your physical address private.
-
-2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc.
-
-    You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](https://www.getmonero.org/). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC.
-
-3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly.
-
-    Using Tor can help with this. It is also worth noting that greater anonymity is possible through asynchronous communication: Real-time communication is vulnerable to analysis of typing patterns (i.e. more than a paragraph of text, distributed on a forum, via email, etc.)
-
 [^1]: Wikipedia: [*Mass Surveillance*](https://en.wikipedia.org/wiki/Mass_surveillance) and [*Surveillance*](https://en.wikipedia.org/wiki/Surveillance).
 [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf)
 [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism)
 [^4]: "[Enumerating badness](https://www.ranum.com/security/computer_security/editorials/dumb/)" (or, "listing all the bad things that we know about"), as many adblockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques.
 [^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights).
-[^6]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident).

docs/basics/multi-factor-authentication.en.md

@@ -1,8 +1,8 @@
 ---
-title: "Multi-factor Authentication"
+title: "Multi-Factor Authentication"
 icon: 'material/two-factor-authentication'
 ---
-**Multi-factor authentication** is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method is time limited codes you might receive from SMS or an app.
+**Multi-Factor Authentication** (**MFA**) is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method is time limited codes you might receive from SMS or an app.
 
 Normally, if a hacker (or adversary) is able to figure out your password then they’d gain access to the account that password belongs to. An account with MFA forces the hacker to have both the password (something you *know*) and a device that you own (something you *have*), like your phone.
 

docs/basics/passwords-overview.en.md

@@ -1,6 +1,6 @@
 ---
 title: "Introduction to Passwords"
-icon: 'material/shield-key-outline'
+icon: 'material/form-textbox-password'
 ---
 
 Passwords are an essential part of our everyday digital lives. We use them to protect our accounts, our devices and our secrets. Despite often being the only thing between us and an adversary who's after our private information, not a lot of thought is put into them, which often leads to people using passwords that can be easily guessed or brute-forced.
@@ -108,4 +108,4 @@ There are many good options to choose from, both cloud-based and local. Choose o
 
 ### Backups
 
-You should store an [encrypted](../encryption.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using.
+You should store an [encrypted](../encryption.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using.

docs/basics/vpn-overview.en.md

@@ -5,7 +5,7 @@ icon: material/vpn
 
 Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world. An ISP can see the flow of internet traffic entering and exiting your network termination device (i.e. modem).
 
-Encryption protocols such as HTTPS are commonly used on the internet, so they may not be able to see exactly what you're posting or reading but they can get an idea of the [domains you request](dns-overview.md#why-shouldnt-i-use-encrypted-dns).
+Encryption protocols such as HTTPS are commonly used on the internet, so they may not be able to see exactly what you're posting or reading but they can get an idea of the [domains you request](../advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns).
 
 A VPN can help as it can shift trust to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing into it.
 
@@ -39,7 +39,7 @@ Needless to say, **you shouldn't use encrypted DNS with Tor**. This would direct
 
 ## Should I use Tor *and* a VPN?
 
-By using a VPN with Tor, you're creating essentially a permanent entry node, often with a money trail attached. This provides zero additional benefits to you, while increasing the attack surface of your connection dramatically. If you wish to hide your Tor usage from your ISP or your government, Tor has a built-in solution for that: Tor bridges. [Read more about Tor bridges and why using a VPN is not necessary](tor-overview.md).
+By using a VPN with Tor, you're creating essentially a permanent entry node, often with a money trail attached. This provides zero additional benefits to you, while increasing the attack surface of your connection dramatically. If you wish to hide your Tor usage from your ISP or your government, Tor has a built-in solution for that: Tor bridges. [Read more about Tor bridges and why using a VPN is not necessary](../advanced/tor-overview.md).
 
 ## What if I need anonymity?
 
@@ -64,13 +64,13 @@ For use cases like these, or if you have another compelling reason, the VPN prov
 ## Sources and Further Reading
 
 1. [VPN - a Very Precarious Narrative](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) by Dennis Schubert
-1. [Tor Network Overview](tor-overview.md) by blacklight447
+1. [Tor Network Overview](../advanced/tor-overview.md)
 1. [IVPN Privacy Guides](https://www.ivpn.net/privacy-guides)
 1. ["Do I need a VPN?"](https://www.doineedavpn.com), a tool developed by IVPN to challenge aggressive VPN marketing by helping individuals decide if a VPN is right for them.
 
 ## Related VPN Information
 
-- [The Trouble with VPN and Privacy Review Sites](https://jonaharagon.com/2019/11/the-trouble-with-vpn-and-privacy-review-sites/)
+- [The Trouble with VPN and Privacy Review Sites](https://blog.privacyguides.org/2019/11/20/the-trouble-with-vpn-and-privacy-review-sites/)
 - [Free VPN App Investigation](https://www.top10vpn.com/free-vpn-app-investigation/)
 - [Hidden VPN owners unveiled: 101 VPN products run by just 23 companies](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/)
 - [This Chinese company is secretly behind 24 popular apps seeking dangerous permissions](https://vpnpro.com/blog/chinese-company-secretly-behind-popular-apps-seeking-dangerous-permissions/)

docs/blog/2021/09/14/welcome-to-privacy-guides.md

@@ -1,59 +0,0 @@
----
-title: Welcome to Privacy Guides
-created: "2021-09-14"
-author: 'Jonah'
-template: overrides/blog.en.html
----
-<script>
-    window.location.href = "https://discuss.privacyguides.org/t/welcome-to-privacy-guides/39";
-</script>
-We are excited to announce the launch of [Privacy Guides](https://www.privacyguides.org/) and [r/PrivacyGuides](https://www.reddit.com/r/PrivacyGuides/), and welcome the privacy community to participate in our crowdsourced software recommendations and share tips and tricks for keeping your data safe online. Our goal is to be a central resource for privacy and security-related tips that are usable by anybody, and to carry on the trusted legacy of PrivacyTools.
-
-As we [announced](https://web.archive.org/web/20210729184422/https://blog.privacytools.io/the-future-of-privacytools/) on the PrivacyTools blog in July, we made the decision to migrate off our former privacytools.io domain for various reasons, including an inability to contact the current domain holder for over a year and [growing](http://www.thedarksideof.io/) [issues](https://fortune.com/2020/08/31/crypto-fraud-io-domain-chagos-islands-uk-colonialism-cryptocurrency/) [with the .IO top-level domain](https://github.com/privacytools/privacytools.io/issues/1324). As attempts to regain ownership of the domain have proven fruitless, we found it necessary to make this switch sooner rather than later to ensure people would find out about this transition as soon as possible. This gives us adequate time to transition the domain name, which is currently redirecting to [www.privacyguides.org](https://www.privacyguides.org/), and it hopefully gives everyone enough time to notice the change, update bookmarks and websites, etc.
-
-We chose the name Privacy Guides because it represents two things for us as an organization: An expansion beyond simple recommendation lists, and a goal of acting as the trusted guides to anyone newly learning about protecting their personal data.
-
-As a name, it moves us past recommendations of various tools and focuses us more on the bigger picture. We want to provide more _education_ — rather than _direction_ — surrounding privacy-related topics. You can see the very beginnings of this work in our new page on [threat modeling](https://www.privacyguides.org/basics/threat-modeling/), or our [VPN](https://www.privacyguides.org/vpn) and [Email Provider](https://www.privacyguides.org/email) recommendations, but this is just the start of what we eventually hope to accomplish.
-
-## Website Development
-
-Our project has always been community-oriented and open-sourced. The source code for PrivacyTools is currently archived at [https://github.com/privacytools/privacytools.io](https://github.com/privacytools/privacytools.io). This repository will remain online as an archive of everything on PrivacyTools up to this transition.
-
-The source code for our new website is available at [https://github.com/privacyguides/privacyguides.org](https://github.com/privacyguides/privacyguides.org). All updates from PrivacyTools have been merged into this new repository, and this is where all future work will take place.
-
-## Services
-
-PrivacyTools also runs a number of online services in use by many users. Some of these services are federated, namely Mastodon, Matrix, and PeerTube. Due to the technical nature of federation, it is impossible for us to change the domain name on these services, and because we cannot guarantee the future of the privacytools.io domain name we will be shutting down these services in the coming months.
-
-We strongly urge users of these services to migrate to alternative providers in the near future. We hope that we will be able to provide enough time to make this as seamless of a transition as possible for our users.
-
-At this time we do not plan on launching public Matrix, Mastodon, or PeerTube instances under the Privacy Guides domain. Any users affected by this transition can get in touch with [@jonah:aragon.sh](https://matrix.to/#/@jonah:aragon.sh) on Matrix if any assistance is needed.
-
-Other services being operated by PrivacyTools currently will be discontinued. This includes Searx, WriteFreely, and GhostBin.
-
-Our future direction for online services is uncertain, but will be a longer-term discussion within our community after our work is complete on this initial transition. We are very aware that whatever direction we move from here will have to be done in a way that is sustainable in the very long term.
-
-## r/PrivacyGuides
-
-PrivacyTools has a sizable community on Reddit, but to ensure a unified image we have created a new Subreddit at [r/PrivacyGuides](https://www.reddit.com/r/PrivacyGuides/) that we encourage all Reddit users to join.
-
-In the coming weeks our current plan is to wind down discussions on r/privacytoolsIO. We will be opening r/PrivacyGuides to lots of the discussions most people are used to shortly, but encouraging general “privacy news” or headline-type posts to be posted on [r/Privacy](https://www.reddit.com/r/privacy/) instead. In our eyes, r/Privacy is the “who/what/when/where” of the privacy community on Reddit, the best place to find the latest news and information; while r/PrivacyGuides is the “how”: a place to share and discuss tools, tips, tricks, and other advice. We think focusing on these strong points will serve to strengthen both communities, and we hope the good moderators of r/Privacy agree 🙂
-
-## Final Thoughts
-
-The former active team at PrivacyTools universally agrees on this direction towards Privacy Guides, and will be working exclusively on Privacy Guides rather than any “PrivacyTools” related projects. We intend to redirect PriavcyTools to new Privacy Guides properties for as long as possible, and archive existing PrivacyTools work as a pre-transition snapshot.
-
-Privacy Guides additionally welcomes back PrivacyTools’ former sysadmin [Jonah](https://twitter.com/JonahAragon), who will be joining the project’s leadership team.
-
-We are not accepting sponsorships or donations at this time, while we work out our financial plan. We will be in touch with existing sponsors on PrivacyTools’ OpenCollective to determine what the best way forward is soon.
-
-We are all very excited about this new brand and direction, and hope to have your continued support through all of this. If you have any questions, concerns, or suggestions, please reach out to us. We are always happy to receive guidance and input from our community! ❤
-
----
-
-**_Privacy Guides_** _is a socially motivated website that provides information for protecting your data security and privacy._
-
-- [Join r/PrivacyGuides on Reddit](https://www.reddit.com/r/privacyguides)
-- [Follow @privacy_guides on Twitter](https://twitter.com/privacy_guides)
-- [Collaborate with us on GitHub](https://github.com/privacyguides/privacyguides.org)
-- [Join our chat on Matrix](https://matrix.to/#/#privacyguides:aragon.sh)

docs/blog/2021/11/01/virtual-insanity.md

@@ -1,33 +0,0 @@
----
-title: Virtual Insanity
-image: 'blog/2021/11/01/virtual-insanity.jpg'
-created: "2021-11-01"
-author: 'Freddy'
-template: overrides/blog.en.html
----
-<script>
-    window.location.href = "https://discuss.privacyguides.org/t/virtual-insanity/38";
-</script>
-Not so long ago, the world was predicting the end for Facebook. Now it is no more. Gone from the face of the planet – never to be seen again. Except it isn’t.
-
-Facebook has not disappeared. No, not even the damning ‘Facebook Papers’ can shut it down. Mark Zuckerberg stood up on stage, and announced that it had changed its name to: Meta.
-
-A key part of this new vision for the company is the idea of the metaverse. If it sounds like something out of a sci-fi movie or novel, that’s because it is. The term was first coined by author Neal Stephenson in his 1992 book _Snow Crash_. Zuckerberg’s only problem is that novel was dystopian. Here’s a brief snippet of Stephenson’s description of the metaverse:
-
-> “Your avatar can look any way you want it to, up to the limitations of your equipment. If you’re ugly, you can make your avatar beautiful. If you’ve just gotten out of bed, your avatar can still be wearing beautiful clothes and professionally applied makeup. You can look like a gorilla or a dragon or a giant talking penis in the Metaverse. Spend five minutes walking down the Street and you will see all of these.”
-
-In fairness, that doesn’t seem unlike the sort of content you see on Facebook today. Compare this to what Zuckerberg [wrote](https://about.fb.com/news/2021/10/founders-letter/) in his 2021 Founders Letter:
-
-> “In this future, you will be able to teleport instantly as a hologram to be at the office without a commute, at a concert with friends, or in your parents’ living room to catch up. This will open up more opportunity no matter where you live. You’ll be able to spend more time on what matters to you, cut down time in traffic, and reduce your carbon footprint.”
-
-The similarities are uncanny.
-
-This wouldn’t be the first time that Facebook has been described as dystopian. One _Mashable_ article [called](https://mashable.com/article/facebook-dystopia) the social media giant ‘Orwellian and Huxleyan at the same time.’ Quite a feat.
-
-The ‘Facebook Papers’ have some pretty shocking - though not entirely surprising - revelations as well. The leaked documents demonstrate the extent to which Facebook values engagement above all else (including a good experience). For instance, we learnt that the algorithm is [optimised](https://www.wired.com/story/facebook-transparency-biggest-sites-pages-links/) for low quality content, [prioritises](https://www.washingtonpost.com/technology/2021/10/26/facebook-angry-emoji-algorithm/) rage over happiness for profit, and [promotes](https://www.theatlantic.com/ideas/archive/2021/10/facebook-papers-democracy-election-zuckerberg/620478/) extremist content. Most alarming was that the firm [failed](https://apnews.com/article/the-facebook-papers-covid-vaccine-misinformation-c8bbc569be7cc2ca583dadb4236a0613) to reduce disinformation during the pandemic even when given the opportunity. Zuckerberg said no to this, presumably because it would reduce engagement and, in turn, Facebook’s advertising revenue.
-
-Let’s not forget all Facebook’s previous scandals. From the Cambridge Analytica kerfuffle to [conducting](https://www.theregister.com/2014/06/29/researchers_mess_with_facebook_users_emotions/) manipulative social experiments in secret.
-
-In light of this, the name change makes sense. It deceives you into thinking the company has evolved into a benevolent corporation, when it simply hasn’t. Zuckerberg would much prefer you to think about Meta as a playful universe where you can meet with friends across the globe in virtual reality. Where humans train themselves to sound like heavily discounted robots. Where Facebook is not a Horrid Company.
-
-Despite all this: Meta _is_ Facebook, just worse. It doesn’t matter about the new name, the company has not changed. It will still be violating our privacy, daily, on an unprecedented scale. It will still be as reliably scandalous as a Carry On film. It will still be terrible. Plus it will have all the added claptrap of a sub-par holographic universe attached.

docs/blog/2021/12/01/firefox-privacy-2021-update.md

@@ -1,63 +0,0 @@
----
-title: 'Firefox Privacy: 2021 Update'
-image: 'blog/2021/12/01/firefox-privacy-2021-update.png'
-created: "2021-12-01"
-author: 'Daniel'
-template: overrides/blog.en.html
----
-<script>
-    window.location.href = "https://discuss.privacyguides.org/t/firefox-privacy-2021-update/37";
-</script>
-A lot changed between 2019 and now, not least in regards to Firefox. Since our last post, Mozilla has [improved](https://blog.mozilla.org/en/products/firefox/latest-firefox-rolls-out-enhanced-tracking-protection-2-0-blocking-redirect-trackers-by-default/) privacy with [Enhanced Tracking Protection (ETP)](https://blog.mozilla.org/en/products/firefox/firefox-now-available-with-enhanced-tracking-protection-by-default/). Earlier this year Mozilla introduced [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/) (Dynamic First Party Isolation dFPI). This was then further tightened with [Enhanced Cookie Clearing](https://blog.mozilla.org/security/2021/08/10/firefox-91-introduces-enhanced-cookie-clearing/). We’re also looking very forward to [Site Isolation](https://blog.mozilla.org/security/2021/05/18/introducing-site-isolation-in-firefox/) (code named Fission) being enabled by default in the coming releases.
-
-Now that so many privacy features are built into the browser, there is little need for extensions made by third-party developers. Accordingly, we have updated our very outdated [browser](../../../../desktop-browsers.md) section. If you’ve got an old browser profile we suggest **creating a new one**. Some of the old advice may make your browser _more_ unique.
-
-#### Privacy Tweaks “about:config”
-
-We’re no longer recommending that users set `about:config` switches manually. Those switches need to be up to date and continuously maintained. They should be studied before blindly making modifications. Sometimes their behaviour changes in between Firefox releases, is superseded by other keys or they are removed entirely. We do not see any point in duplicating the efforts of the community [Arkenfox](https://github.com/arkenfox/user.js) project. Arkenfox has very good documentation in their [wiki](https://github.com/arkenfox/user.js/wiki) and we use it ourselves.
-
-#### LocalCDN and Decentraleyes
-
-These extensions aren’t required with Total Cookie Protection (TCP), which is enabled if you’ve set Enhanced Tracking Protection (ETP) to **Strict**.
-
-Replacing scripts on CDNs with local versions is not a comprehensive solution and is a form of [enumeration of badness](https://www.ranum.com/security/computer_security/editorials/dumb/). While it may work with some scripts that are included it doesn’t help with most other third-party connections.
-
-CDN extensions never really improved privacy as far as sharing your IP address was concerned and their usage is fingerprintable as this Tor Project developer [points out](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22089#note_2639603). They are the wrong tool for the job and are not a substitute for a good VPN or Tor. Its worth noting the [resources](https://git.synz.io/Synzvato/decentraleyes/-/tree/master/resources) for Decentraleyes are hugely out of date and would not be likely used anyway.
-
-#### NeatURLs and ClearURLS
-
-Previously we recommended ClearURLs to remove tracking parameters from URLs you might visit. These extensions are no longer needed with uBlock Origin’s [`removeparam`](https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#removeparam) feature.
-
-#### HTTPS Everywhere
-
-The EFF announced back in September they were [deprecating HTTPS-Everywhere](https://www.eff.org/deeplinks/2021/09/https-actually-everywhere) as most browsers now have an HTTPS-Only feature. We are pleased to see privacy features built into the browser and Firefox 91 introduced [HTTPS by Default in Private Browsing](https://blog.mozilla.org/security/2021/08/10/firefox-91-introduces-https-by-default-in-private-browsing/).
-
-#### Multi Account Containers and Temporary Containers
-
-Container extensions aren’t as important as they used to be for privacy now that we have [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/).
-
-Multi Account Container will still have some use if you use [Mozilla VPN](https://en.wikipedia.org/wiki/Mozilla_VPN) as it is going to be [integrated](https://github.com/mozilla/multi-account-containers/issues/2210) allowing you to configure specified containers to use a particular VPN server. Another use might be if you want to login to multiple accounts on the same domain.
-
-#### Just-In-Time Compilation (JIT)
-
-What is “Disable JIT” in Bromite? This option disables the JavaScript performance feature [JIT](https://en.wikipedia.org/wiki/Just-in-time_compilation). It can increase security but at the cost of performance. Those trade-offs vary wildly and are explored in [this](https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/) publication by Johnathan Norman from the Microsoft Edge team. This option is very much a security vs performance option.
-
-#### Mozilla browsers on Android
-
-We don’t recommend any Mozilla based browsers on Android. This is because we don’t feel that [GeckoView](https://mozilla.github.io/geckoview) is quite as secure as it could be as it doesn’t support [site isolation](https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture), soon to be coming in desktop browsers or [isolated processes](https://bugzilla.mozilla.org/show_bug.cgi?id=1565196).
-
-We also noticed that there isn’t an option for [HTTPS-Only mode](https://github.com/mozilla-mobile/fenix/issues/16952#issuecomment-907960218). The only way to get something similar is to install the [deprecated](https://www.eff.org/deeplinks/2021/09/https-actually-everywhere) extension [HTTPS Everywhere](https://www.eff.org/https-everywhere).
-
-There are places which Firefox on Android shines for example browsing news websites where you may want to _partially_ load some JavaScript (but not all) using medium or hard [blocking mode](https://github.com/gorhill/uBlock/wiki/Blocking-mode). The [reader view](https://support.mozilla.org/en-US/kb/view-articles-reader-view-firefox-android) is also pretty cool. We expect things will change in the future, so we’re keeping a close eye on this.
-
-#### Fingerprinting
-
-Firefox has the ability to block known third party [fingerprinting resources](https://blog.mozilla.org/security/2020/01/07/firefox-72-fingerprinting/). Mozilla has [advanced protection](https://support.mozilla.org/kb/firefox-protection-against-fingerprinting) against fingerprinting (RFP is enabled with Arkenfox).
-
-We do not recommend extensions that promise to change your [browser fingerprint](https://blog.torproject.org/browser-fingerprinting-introduction-and-challenges-ahead/). Some of those extensions [are detectable](https://www.cse.chalmers.se/~andrei/codaspy17.pdf) by websites through JavaScript and [CSS](https://hal.archives-ouvertes.fr/hal-03152176/file/style-fingerprinting-usenix.pdf) methods, particularly those which inject anything into the web content.
-
-This includes **all** extensions that try to change the user agent or other browser behaviour to prevent fingerprinting. We see these often recommended on Reddit and would like to say that they will likely make you more unique and can be circumvented. Arkenfox has [a good list](https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no) of extensions you shouldn’t be using. They also have [another list](https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-dont-bother) of extensions you needn’t bother with either. We also like to say testing sites which show you how unique you are in a set of users are often using hugely tainted results that are not indicative of real-world usage.
-
-----------
-
-_Special thanks to [Thorin-Oakenpants](https://github.com/Thorin-Oakenpants) and [Tommy](https://tommytran.io) for their help with providing advice and further documentation during the research phase.

docs/blog/2022/04/04/move-fast-and-break-things.md

@@ -1,31 +0,0 @@
----
-title: '"Move Fast and Break Things"'
-image: 'blog/2022/04/04/move-fast-and-break-things.jpg'
-created: "2022-04-04"
-author: 'Freddy'
-template: overrides/blog.en.html
----
-<script>
-    window.location.href = "https://discuss.privacyguides.org/t/move-fast-and-break-things/36";
-</script>
-Mark Zuckerberg does not look comfortable on stage. Yet, there he was proclaiming that “the future is private”. If someone has to tell you that they care about your privacy, they probably don’t.
-
-For someone trying not to appear like a cartoon villain, Zuckerberg doesn’t do a great job. He gives the impression of some strange cyborg algorithmically attempting to impersonate human life. His movements are not quite robotic, but he lacks the charisma you might expect from one of the most powerful people on the planet. A _New Yorker_ [profile](https://www.newyorker.com/magazine/2018/09/17/can-mark-zuckerberg-fix-facebook-before-it-breaks-democracy) of him revealed that he had an affinity for Emperor Augustus, an ancient Roman tyrant. ‘Through a really harsh approach, [Augustus] established two hundred years of world peace,’ he said.
-
-It’s the first part of that sentence that is worrying.
-
-Is this what Zuckerberg sees himself as: a modern-day emperor hellbent on using any means he can to gain world peace? Probably not, but it would have been reassuring if he just told us he liked doing Sudoku and dad-dancing with his daughter (interestingly named August).
-
-The Zuck once [joked](https://www.esquire.com/uk/latest-news/a19490586/mark-zuckerberg-called-people-who-handed-over-their-data-dumb-f/) to a friend that he could get them ‘info’ about anyone in Harvard. He had email addresses, pictures, real addresses: the lot. When the friend asked how, this was his riposte: ‘People just submitted it. I don’t know why. They trust me. Dumb f*cks.’ We now live in a reality where Zuckerberg can get ‘info’ about almost anyone in the world.
-
-Like a depraved tabloid journalist fishing through a minor celebrity’s trash, Facebook collects everything it can about its users. Even if it means sifting through garbage, they want that data. But Facebook is not technically in the data business. It is in what author and professor Carissa Véliz [terms](https://aeon.co/essays/privacy-matters-because-it-empowers-us-all) ‘the business of power’ – which sounds rather more sinister than flogging off mildly irritating adverts.
-
-Véliz argues that privacy is a form of power. It is the power to influence you, show you adverts and predict your behaviour. In this sense, personal data is being used to make us do things we otherwise would not do: to buy a certain product or to vote a certain way. Filmmaker Laura Poitras [described](https://www.washingtonpost.com/news/the-switch/wp/2014/10/23/snowden-filmmaker-laura-poitras-facebook-is-a-gift-to-intelligence-agencies/) Facebook as ‘a gift to intelligence agencies’. It allows governments to arrest people planning to participate in protests before they have even begun.
-
-The social media giant is tip-toeing ever closer into our personal lives. When Facebook encountered competition it just bought it, adding Instagram and WhatsApp to its roster. The company even tried to make its own cryptocurrency so that one day the Facebook would control all our purchases too. Earlier this year, the project was [killed](https://www.ft.com/content/a88fb591-72d5-4b6b-bb5d-223adfb893f3) by regulators. It is worth noting that when Zuckerberg purchased WhatsApp and Instagram, they had no revenue. Author Tim Wu notes in his book _The Attention Merchants_ that Facebook is ‘a business with an exceedingly low ratio of invention to success’. Perhaps that is a part of Zuck’s genius.
-
-‘Move fast and break things’ was the old company motto. When there were a few too many scandals, they moved fast and [rebranded](https://www.privacyguides.org/blog/2021/11/01/virtual-insanity) to Meta. No one expected online privacy to be the ‘thing’ they broke.
-
-Before it became a global behemoth, Facebook started out as a dorm-room project. Zuckerberg sat at his keyboard after a few drinks and built it mainly because he could. It now has nearly three billion users. In the same way, Facebook [conducted](https://www.theguardian.com/technology/2014/jul/02/facebook-apologises-psychological-experiments-on-users) social experiments seemingly just for fun. Why he did it doesn’t really matter. As John Lanchester [put it](https://www.lrb.co.uk/the-paper/v39/n16/john-lanchester/you-are-the-product): he simply did it _because_.
-
-It is unfair to say that Zuckerberg does not care about privacy – he does. That’s why he [spared](https://www.theguardian.com/technology/2013/oct/11/mark-zuckerberg-facebook-neighbouring-houses) no expense buying the houses that surrounded his home. Zuckerberg knows the power of privacy, which is painfully ironic given he has built his career on exploiting it. For Zuckerberg, at least, the future is private. It’s the rest of us that should be worried.

docs/blog/2022/06/09/hide-nothing.md

@@ -1,45 +0,0 @@
----
-title: '"Hide Nothing"'
-image: 'blog/2022/06/09/hide-nothing.jpg'
-created: "2022-06-09"
-author: 'Dan Arel'
-template: overrides/blog.en.html
----
-<script>
-    window.location.href = "https://discuss.privacyguides.org/t/hide-nothing/35";
-</script>
-In the wake of the September 11, 2001, attack on the United States, the US government enacted laws that weakened citizen privacy in the name of national emergency. This sent up many red flags for human rights and privacy advocates.
-
-These concerns were met with “if you have nothing to hide, you have nothing to fear.” The argument goes that if you're not doing anything illegal, then these violations of your privacy shouldn't bother you. If you care about privacy, you clearly can't be up to anything good.
-
-On the surface, this seems true to many people – but the reality is very different. We may not have had anything to hide in the immediate aftermath of 9/11, but that was not the only information being sought after by governments. Indeed, following the passage of the Patriot Act in the US, the FBI issued 192,499 [National Security Letters](https://www.aclu.org/other/national-security-letters), meaning they collected the records and online activity of nearly 200,000 people.
-
-In the end it only convicted one person.
-
-Now, many have argued that stopping one terrorist might be worth giving up some security for, but [according](https://www.aclu.org/issues/national-security/privacy-and-surveillance/surveillance-under-patriot-act) to the ACLU, the conviction would have occurred without the Patriot Act.
-
-Many legal actions you take today could be deemed illegal by future laws or future government. In the US today there is discussion around the possibility of Roe v. Wade being overturned, allowing states to outlaw abortions. You may not currently feel the need to hide internet searches, menstrual cycle apps, or donations to women's health clinics today because it's not illegal, but tomorrow that information could be used against you.
-
-In countries were organizing around political dissent is legal, that doesn't mean the government is tracking those taking part and using that information to create informants or infiltrate such groups. Or worse, when or if laws change, using that surveillance to punish those involved.
-
-And even if you break away from the legal aspects, we all have something to hide. You may not be ready to reveal your sexual or gender identity, but your internet usage could potentially do that for you. You don't want to make your bank account public; you have that information to hide. And you can continue to list things about your life you'd just rather not make public, regardless of potential legality.
-
-In July of 2021, a Catholic priest by the name of Jeffrey Burrill lost his job and was forced to resign after data collected through his cell phone showed that he was active on the gay dating app Grindr, and that he had visited multiple gay bars in the area. [According](https://www.washingtonpost.com/religion/2021/07/20/bishop-misconduct-resign-burrill/) to the *Washington Post*:
-
-> “A mobile device correlated to Burrill emitted app data signals from the location-based hookup app Grindr on a near-daily basis during parts of 2018, 2019, and 2020 —– at both his USCCB office and his USCCB-owned residence, as well as during USCCB meetings and events in other cities,” the Pillar reported.
-
-> “The data obtained and analyzed by The Pillar conveys mobile app date signals during two 26-week periods, the first in 2018 and the second in 2019 and 2020. The data was obtained from a data vendor and authenticated by an independent data consulting firm contracted by The Pillar,” the site reported. It did not identify who the vendor was or if the site bought the information or got it from a third party.
-
-> The Pillar story says app data “correlated” to Burrill's phone shows the priest visited gay bars, including while traveling for the USCCB.
-
-While it was not clear who was tracking Burrill's device, the Post went on to say that:
-
-> Privacy experts have long raised concerns about “anonymized” data collected by apps and sold to or shared with aggregators and marketing companies. While the information is typically stripped of obviously identifying fields, like a user's name or phone number, it can contain everything from age and gender to a device ID. It's possible for experts to de-anonymize some of this data and connect it to real people.
-
-While Burrill was without a doubt in violation of his work's own code of conduct, he did decide on his own to be a priest. However, his personal life was not harming others and was just that, his personal life. While the question looms about who was tracking him to begin with and why, the fact it was so easy to do is alarming.
-
-What if Burrill wasn't a priest, but just happened to work for someone who held anti-homosexual views who used this data to out him, humiliate him, and fire him under false pretenses? This data, which should be private could (and likely did in the real-life circumstance) ruin his life.
-
-That is what makes internet privacy so important. It's not hiding nefarious activity, it's that we all have an innate right to our privacy.
-
-You might not feel today that you have anything to hide, but you might not feel that way tomorrow and once something is public, it cannot be made private again.

docs/calendar-contacts.en.md

@@ -31,29 +31,6 @@ Calendars and contacts contain some of your most sensitive data; use products th
         - [:simple-flathub: Flathub](https://flathub.org/apps/details/com.tutanota.Tutanota)
         - [:octicons-browser-16: Web](https://mail.tutanota.com/)
 
-## EteSync
-
-!!! recommendation
-
-    ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ align=right }
-
-    **EteSync** is a secure, E2EE, and privacy-respecting cloud backup and synchronization software for your personal information, including contacts and calendars. There are native clients for Android, iOS, with a web client and an adapter layer for most desktop clients available too. Etesync does [not](https://www.etesync.com/faq/#2fa) currently support multi-factor authentication.
-
-    EteSync offers a [SaaS](https://dashboard.etebase.com/user/partner/pricing/), or you can host the server yourself for free.
-
-    [:octicons-home-16: Homepage](https://www.etesync.com){ .md-button .md-button--primary }
-    [:octicons-eye-16:](https://www.etesync.com/tos/#privacy){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://www.etesync.com/user-guide/){ .card-link title=Documentation}
-    [:octicons-code-16:](https://github.com/etesync){ .card-link title="Source Code" }
-    [:octicons-heart-16:](https://www.etesync.com/contribute/){ .card-link title=Contribute }
-
-    ??? downloads
-
-        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.etesync.syncadapter)
-        - [:simple-appstore: App Store](https://apps.apple.com/us/app/apple-store/id1489574285)
-        - [:octicons-device-desktop-16: Client Setup](https://github.com/etesync/etesync-dav/blob/master/README.md#specific-client-notes-and-instructions)
-        - [:simple-docker: Docker Hub](https://hub.docker.com/r/victorrds/etesync)
-
 ## Proton Calendar
 
 !!! recommendation

docs/cloud.en.md

@@ -26,13 +26,31 @@ If these alternatives do not fit your needs, we suggest you look into [Encryptio
     
         - [:octicons-globe-16: PWA](https://crypt.ee/download)
 
+## Proton Drive
+
+!!! recommendation
+
+    ![Proton Drive logo](assets/img/cloud/protondrive.svg){ align=right }
+
+    **Proton Drive** is an E2EE general file storage service by the popular encrypted email provider [Proton Mail](https://proton.me/mail).
+
+    [:octicons-home-16: Homepage](https://proton.me/drive){ .md-button .md-button--primary }
+    [:octicons-eye-16:](https://proton.me/legal/privacy){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://proton.me/support/drive){ .card-link title=Documentation}
+    [:octicons-code-16:](https://github.com/ProtonMail/WebClients){ .card-link title="Source Code" }
+
+    ??? downloads
+
+        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=me.proton.android.drive)
+        - [:simple-appstore: App Store](https://apps.apple.com/app/id1509667851)
+
 ## Nextcloud
 
 !!! recommendation
 
     ![Nextcloud logo](assets/img/cloud/nextcloud.svg){ align=right }
 
-    **Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control. It also comes with experimental E2EE.
+    **Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control.
 
     [:octicons-home-16: Homepage](https://nextcloud.com){ .md-button .md-button--primary }
     [:octicons-eye-16:](https://nextcloud.com/privacy){ .card-link title="Privacy Policy" }
@@ -52,25 +70,6 @@ If these alternatives do not fit your needs, we suggest you look into [Encryptio
         - [:simple-openbsd: OpenBSD](https://openports.se/www/nextcloud)
         - [:simple-netbsd: NetBSD](https://pkgsrc.se/www/php-nextcloud)
 
-We recommend checking if your Nextcloud provider supports E2EE, otherwise you have to trust the provider to not look at your files.
+!!! danger
 
-When self-hosting, you should also enable E2EE to protect against your hosting provider snooping on your data.
-
-## Proton Drive
-
-!!! recommendation
-
-    ![Proton Drive logo](assets/img/cloud/protondrive.svg){ align=right }
-
-    **Proton Drive** is an E2EE general file storage service by the popular encrypted email provider [Proton Mail](https://proton.me/mail).
-
-    [:octicons-home-16: Homepage](https://proton.me/drive){ .md-button .md-button--primary }
-    [:octicons-eye-16:](https://proton.me/legal/privacy){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://proton.me/support/drive){ .card-link title=Documentation}
-    [:octicons-code-16:](https://github.com/ProtonMail/WebClients){ .card-link title="Source Code" }
-
-    ??? downloads
-
-        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=me.proton.android.drive)
-
-Proton Drive is currently only available through a web client and an Android app.
+    We don't recommend using the [E2EE App](https://apps.nextcloud.com/apps/end_to_end_encryption) for Nextcloud as it may lead to data loss; it is highly experimental and not production quality.

docs/coc.md

@@ -1,8 +0,0 @@
----
-title: Code of Conduct
-hide:
-    - toc
-    - feedback
----
-
-{% include 'CODE_OF_CONDUCT.md' %}

docs/desktop-browsers.en.md

@@ -50,9 +50,7 @@ This protects you from persistent cookies, but does not protect you against cook
 
 ##### Search Suggestions
 
-- [ ] Disable **Suggestions from the web**
-- [ ] Disable **Suggestions from sponsors**
-- [ ] Disable **Improve the Firefox Suggest experience**
+- [ ] Uncheck **Provide search suggestions**
 
 Search suggestion features may not be available in your region.
 
@@ -72,7 +70,7 @@ Search suggestions send everything you type in the address bar to the default se
 
 This prevents you from unintentionally connecting to a website in plain-text HTTP. Sites without HTTPS are uncommon nowadays, so this should have little to no impact on your day to day browsing.
 
-#### Sync
+#### Firefox Sync
 
 [Firefox Sync](https://hacks.mozilla.org/2018/11/firefox-sync-privacy/) allows your browsing data (history, bookmarks, etc.) to be accessible on all your devices and protects it with E2EE.
 
@@ -181,6 +179,10 @@ Under the *System* menu
 
 1. This option is not present on all platforms.
 
+#### Brave Sync
+
+[Brave Sync](https://support.brave.com/hc/en-us/articles/360059793111-Understanding-Brave-Sync) allows your browsing data (history, bookmarks, etc.) to be accessible on all your devices without requiring an account and protects it with E2EE.
+
 ## Additional Resources
 
 We generally do not recommend installing any extensions as they increase your attack surface. However, uBlock Origin may prove useful if you value content blocking functionality.

docs/desktop.en.md

@@ -1,12 +1,10 @@
 ---
-title: "Linux"
+title: "Desktop/PC"
 icon: simple/linux
 ---
-Linux distributions are commonly recommended for privacy protection and software freedom.
+Linux distributions are commonly recommended for privacy protection and software freedom. If you don't already use Linux, below are some distributions we suggest trying out, as well as some general privacy and security improvement tips that are applicable to many Linux distributions.
 
-- [General Linux Overview :material-arrow-right-drop-circle:](linux-desktop/overview.md)
-
-If you don't already use Linux, below are some distributions we suggest trying out, as well as some general privacy and security improvement tips that are applicable to many Linux distributions.
+- [General Linux Overview :material-arrow-right-drop-circle:](os/linux-overview.md)
 
 ## Traditional Distributions
 
@@ -54,7 +52,7 @@ Tumbleweed follows a rolling release model where each update is released as a sn
 
 Arch Linux has a rolling release cycle. There is no fixed release schedule and packages are updated very frequently.
 
-Being a DIY distribution, you are [expected to set up and maintain](linux-desktop/overview.md#arch-based-distributions) your system on your own. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
+Being a DIY distribution, you are [expected to set up and maintain](os/linux-overview.md#arch-based-distributions) your system on your own. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
 
 A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org) are [reproducible](https://reproducible-builds.org).
 
@@ -110,9 +108,10 @@ Nix is a source-based package manager; if there’s no pre-built available in th
 
     ![Whonix logo](assets/img/linux-desktop/whonix.svg){ align=right }
 
-    **Whonix** is based on [Kicksecure](https://www.whonix.org/wiki/Kicksecure), a security-focused fork of Debian. It aims to provide privacy, security, and anonymity on the internet. Whonix is best used in conjunction with [Qubes OS](qubes.md).
+    **Whonix** is based on [Kicksecure](https://www.whonix.org/wiki/Kicksecure), a security-focused fork of Debian. It aims to provide privacy, security, and anonymity on the internet. Whonix is best used in conjunction with [Qubes OS](#qubes-os).
 
     [:octicons-home-16: Homepage](https://www.whonix.org/){ .md-button .md-button--primary }
+    [:simple-torbrowser:](http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion){ .card-link title="Onion Service" }
     [:octicons-info-16:](https://www.whonix.org/wiki/Documentation){ .card-link title=Documentation}
     [:octicons-heart-16:](https://www.whonix.org/wiki/Donate){ .card-link title=Contribute }
 
@@ -138,6 +137,28 @@ Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qube
 
 Tails is great for counter forensics due to amnesia (meaning nothing is written to the disk); however, it is not a hardened distribution like Whonix. It lacks many anonymity and security features that Whonix has and gets updated much less often (only once every six weeks). A Tails system that is compromised by malware may potentially bypass the transparent proxy allowing for the user to be deanonymized.
 
-Tails also installs uBlock Origin in Tor Browser by default, which potentially makes it easier for adversaries to fingerprint Tails users, and increases the attack surface of the browser. For all of these reasons, if your only goal is to browse the internet anonymously, Tails is not as good of a choice as using [Whonix](linux-desktop.md/#whonix) with [Qubes OS](qubes.md), which is much more secure and leakproof. If your goal is to use a computer without leaving any trace afterwards, Tails may be a good solution for you.
+Tails includes [uBlock Origin](desktop-browsers.md#ublock-origin) in Tor Browser by default, which may potentially make it easier for adversaries to fingerprint Tails users. [Whonix](desktop.md#whonix) virtual machines may be more leak-proof, however they are not amnesic, meaning data may be recovered from your storage device.
 
 By design, Tails is meant to completely reset itself after each reboot. Encrypted [persistent storage](https://tails.boum.org/doc/first_steps/persistence/index.en.html) can be configured to store some data between reboots.
+
+## Security-focused Distributions
+
+### Qubes OS
+
+!!! recommendation
+
+    ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ align=right }
+
+    **Qubes OS** is an open-source operating system designed to provide strong security for desktop computing. Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
+
+    [:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
+    [:material-arrow-right-drop-circle: Overview](os/qubes-overview.md){ .md-button .md-button--primary }
+    [:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
+    [:octicons-eye-16:](https://www.qubes-os.org/privacy/){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://www.qubes-os.org/doc/){ .card-link title=Documentation }
+    [:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
+    [:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
+
+Qubes OS is a Xen-based operating system meant to provide strong security for desktop computing through secure virtual machines (VMs), also known as *Qubes*.
+
+The Qubes OS operating system secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system. For further details see the Qubes [FAQ](https://www.qubes-os.org/faq/).

docs/dns.en.md

@@ -7,7 +7,7 @@ icon: material/dns
 
     Encrypted DNS with third-party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
 
-    [Learn more about DNS](basics/dns-overview.md){ .md-button }
+    [Learn more about DNS](advanced/dns-overview.md){ .md-button }
 
 ## Recommended Providers
 
@@ -17,7 +17,7 @@ icon: material/dns
 | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/) | Cleartext <br> DoH <br> DoT | Some[^2] | No | Based on server choice.|
 | [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt <br> DoQ <br> DoH3 | Optional[^3] | No | Based on server choice. |
 | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy/) | DoH <br> DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
-| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Optional[^5] | Optional | Based on server choice. |
+| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Cleartext <br> DoH <br> DoT | Optional[^5] | Optional | Based on server choice. |
 | [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy/) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional |  Based on server choice, Malware blocking by default. |
 
 [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
@@ -29,16 +29,16 @@ icon: material/dns
 
 The criteria for the servers listed above are:
 
-- Must support [DNSSEC](basics/dns-overview.md#what-is-dnssec)
+- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec)
 - Must have [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support
-- [QNAME Minimization](basics/dns-overview.md#what-is-qname-minimization)
-- Allow for [ECS](basics/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled
+- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization)
+- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled
 
 ## Native Operating System Support
 
 ### Android
 
-Android 9 and above support DNS over TLS. Android 13 will support DNS over HTTPS. The settings can be found in: **Settings** &rarr; **Network & Internet** &rarr; **Private DNS**.
+Android 9 and above support DNS over TLS. The settings can be found in: **Settings** &rarr; **Network & Internet** &rarr; **Private DNS**.
 
 ### Apple Devices
 
@@ -50,31 +50,13 @@ After installation of either a configuration profile or an app that uses the DNS
 
 Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://www.quad9.net/news/blog/ios-mobile-provisioning-profiles/).
 
-#### iOS/iPadOS
+!!! info
 
-Select **Settings** &rarr; **General** &rarr; **VPN, DNS, & Device Management** &rarr; **DNS**
-
-#### macOS
-
-Select **System Preferences &rarr; Profiles** or **System Preferences** &rarr; **Network** &rarr; **Advanced**, (depending on if you have configuration profiles installed).
-
-#### tvOS
-
-Select **Settings** &rarr; **General** &rarr; **Privacy** &rarr; **Share Apple TV Analytics** &rarr; then press the *Play* button on the remote.
-
-### Windows
-
-You can [turn on DoH](https://docs.microsoft.com/en-us/windows-server/networking/dns/doh-client-support) by accessing Windows settings in the control panel.
-
-Select **Settings** &rarr; **Network & Internet** &rarr; **Ethernet or WiFi**, &rarr; **Edit DNS Settings** &rarr; **Preferred DNS encryption** &rarr; **Encrypted only (DNS over HTTPS)**.
-
-### Linux
-
-`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
+    `systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
 
 ## Encrypted DNS Proxies
 
-Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](basics/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](basics/dns-overview.md#what-is-encrypted-dns).
+Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
 
 ### RethinkDNS
 
@@ -83,7 +65,7 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ba
     ![RethinkDNS logo](assets/img/android/rethinkdns.svg#only-light){ align=right }
     ![RethinkDNS logo](assets/img/android/rethinkdns-dark.svg#only-dark){ align=right }
 
-    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](basics/dns-overview.md#dns-over-https-doh), [DNS-over-TLS](basics/dns-overview.md#dns-over-tls-dot), [DNSCrypt](basics/dns-overview.md#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
+    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](advanced/dns-overview.md#dns-over-https-doh), [DNS-over-TLS](advanced/dns-overview.md#dns-over-tls-dot), [DNSCrypt](advanced/dns-overview.md#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
 
     [:octicons-home-16: Homepage](https://rethinkdns.com){ .md-button .md-button--primary }
     [:octicons-eye-16:](https://rethinkdns.com/privacy){ .card-link title="Privacy Policy" }
@@ -101,9 +83,9 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ba
 
     ![dnscrypt-proxy logo](assets/img/dns/dnscrypt-proxy.svg){ align=right }
 
-    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](basics/dns-overview.md#dnscrypt), [DNS-over-HTTPS](basics/dns-overview.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
+    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](advanced/dns-overview.md#dnscrypt), [DNS-over-HTTPS](advanced/dns-overview.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
 
-    !!! warning "The anonymized DNS feature does [**not**](basics/dns-overview.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."
+    !!! warning "The anonymized DNS feature does [**not**](advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."
 
     [:octicons-repo-16: Repository](https://github.com/DNSCrypt/dnscrypt-proxy){ .md-button .md-button--primary }
     [:octicons-info-16:](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .card-link title=Documentation}

docs/email-clients.en.md

@@ -33,6 +33,25 @@ Our recommendation list contains email clients that support both [OpenPGP](encry
         - [:simple-linux: Linux](https://www.thunderbird.net)
         - [:simple-flathub: Flathub](https://flathub.org/apps/details/org.mozilla.Thunderbird)
 
+#### Recommended Configuration
+
+We recommend changing some of these settings to make Thunderbird a little more private.
+
+These options can be found in :material-menu: → **Settings** → **Privacy & Security**.
+
+##### Web Content
+
+- [ ] Uncheck  **Remember websites and links I've visited**
+- [ ] Uncheck  **Accept cookies from sites**
+
+##### Telemetry
+
+- [ ] Uncheck  **Allow Thunderbird to send technical and interaction data to Mozilla**
+
+#### Thunderbird-user.js (advanced)
+
+[`thunderbird-user.js`](https://github.com/HorlogeSkynet/thunderbird-user.js), is a set of configurations options that aims to disable as many of the web-browsing features within Thunderbird as possible in order to reduce surface area and maintain privacy. Some of the changes are backported from the [Arkenfox project](https://github.com/arkenfox/user.js).
+
 ## Platform Specific
 
 ### Apple Mail (macOS)

docs/email.en.md

@@ -28,6 +28,8 @@ For everything else, we recommend a variety of email providers based on sustaina
 
     If you have the Proton Unlimited, Business, or Visionary Plan, you also get [SimpleLogin](#simplelogin) Premium for free.
 
+    Proton Mail has internal crash reports that they **do not** share with third parties. This can be disabled in: **Settings** > **Go to Settings** > **Account** > **Security and privacy** > **Send crash reports**.
+
     [:octicons-home-16: Homepage](https://proton.me/mail){ .md-button .md-button--primary }
     [:simple-torbrowser:](https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion){ .card-link title="Onion Service" }
     [:octicons-eye-16:](https://proton.me/legal/privacy){ .card-link title="Privacy Policy" }
@@ -68,6 +70,14 @@ For everything else, we recommend a variety of email providers based on sustaina
 
     Proton Mail also supports the discovery of public keys via HTTP from their [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD). This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily, for cross-provider E2EE.
 
+??? warning "Digital Legacy"
+
+    Proton Mail doesn't offer a digital legacy feature.
+
+??? info "Account Termination"
+
+    If you have a paid account and your [bill is unpaid](https://proton.me/support/delinquency) after 14 days, you won't be able to access your data. After 30 days, your account will become delinguent and won't receive incoming mail. You will continue to be billed during this period.
+
 ??? info "Additional Functionality"
 
     Proton Mail offers an "Unlimited" account for €9.99/Month, which also enables access to Proton VPN in addition to providing multiple accounts, domains, aliases, and 500GB of storage.
@@ -112,6 +122,14 @@ For everything else, we recommend a variety of email providers based on sustaina
 
     Mailbox.org also supports the discovery of public keys via HTTP from their [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD). This allows people outside of Mailbox.org to find the OpenPGP keys of Mailbox.org accounts easily, for cross-provider E2EE.
 
+??? check "Digital Legacy"
+
+    Mailbox.org has a digital legacy feature for all plans. You can choose whether you want any of your data to be passed to heirs providing that they apply and provide your testament. Alternatively, you can nominate a person by name and address.
+
+??? info "Account Termination"
+
+    Your account will be set to a restricted user account when your contract ends, after [30 days it will be irrevocably deleted](https://kb.mailbox.org/en/private/payment-article/what-happens-at-the-end-of-my-contract).
+
 ??? info "Additional Functionality"
 
     You can access your Mailbox.org account via IMAP/SMTP using their [.onion service](https://kb.mailbox.org/display/MBOKBEN/The+Tor+exit+node+of+mailbox.org). However, their webmail interface cannot be accessed via their .onion service and you may experience TLS certificate errors.
@@ -157,6 +175,14 @@ For everything else, we recommend a variety of email providers based on sustaina
 
     StartMail has [integrated encryption](https://support.startmail.com/hc/en-us/sections/360001889078-Encryption) in their webmail, which simplifies sending encrypted messages with public OpenPGP keys.
 
+??? warning "Digital Legacy"
+
+    StartMail does not offer a digital legacy feature.
+
+??? info "Account Termination"
+
+    On account expiration, StartMail will permanently delete your account after [6 months in 3 phases](https://support.startmail.com/hc/en-us/articles/360006794398-Account-expiration).
+
 ??? info "Additional Functionality"
 
     StartMail allows for proxying of images within emails. If you allow the remote image to be loaded, the sender won't know what your IP address is.
@@ -178,16 +204,14 @@ For everything else, we recommend a variety of email providers based on sustaina
     ??? downloads
 
         - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=de.tutao.tutanota)
-        - [:simple-appstore: App Store](https://itunes.apple.com/de/app/tutanota/id922429609)
+        - [:simple-appstore: App Store](https://apps.apple.com/app/tutanota/id922429609)
         - [:simple-github: GitHub](https://github.com/tutao/tutanota/releases)
         - [:simple-windows11: Windows](https://tutanota.com/#download)
         - [:simple-apple: macOS](https://tutanota.com/#download)
         - [:simple-linux: Linux](https://tutanota.com/#download)
         - [:octicons-browser-16: Web](https://mail.tutanota.com/)
 
-Tutanota [doesn't allow](https://tutanota.com/faq/#imap) the use of third-party [email clients](email-clients.md). Tutanota has no plans pull email from [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) using the IMAP protocol. [Email import](https://github.com/tutao/tutanota/issues/630) is currently not possible.
-
-Emails can be exported [individually or by bulk selection](https://tutanota.com/howto#generalMail). Tutanota does not allow for [subfolders](https://github.com/tutao/tutanota/issues/927) as you might expect with other email providers.
+Tutanota doesn't use the [IMAP protocol](https://tutanota.com/faq/#imap) or the use of third-party [email clients](email-clients.md), and you also won't be able to add [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) to the Tutanota app. Neither [Email import](https://github.com/tutao/tutanota/issues/630) or [subfolders](https://github.com/tutao/tutanota/issues/927) are currently supported, though this is [due to be changed](https://tutanota.com/blog/posts/kickoff-import). Emails can be exported [individually or by bulk selection](https://tutanota.com/howto#generalMail) per folder, which may be inconvenient if you have many folders.
 
 ??? check "Custom Domains and Aliases"
 
@@ -199,7 +223,7 @@ Emails can be exported [individually or by bulk selection](https://tutanota.com/
 
 ??? check "Account Security"
 
-    Tutanota supports [two factor authentication](https://tutanota.com/faq#2fa) with either TOTP or U2F. U2F support is [not yet available on Android](https://github.com/tutao/tutanota/issues/443).
+    Tutanota supports [two factor authentication](https://tutanota.com/faq#2fa) with either TOTP or U2F.
 
 ??? check "Data Security"
 
@@ -211,6 +235,14 @@ Emails can be exported [individually or by bulk selection](https://tutanota.com/
 
     Tutanota [does have plans](https://github.com/tutao/tutanota/issues/198) to support [AutoCrypt](https://autocrypt.org). This would allow for non-Tutanota emails to send encrypted emails to Tutanota accounts as long as their email client supports the AutoCrypt headers.
 
+??? warning "Digital Legacy"
+
+    Tutanota doesn't offer a digital legacy feature.
+
+??? info "Account Termination"
+
+    Tutanota will [delete inactive free accounts](https://tutanota.com/faq#inactive-accounts) after six months. You can reuse a deactivated free account if you pay.
+
 ??? info "Additional Functionality"
 
     Tutanota offers the business version of [Tutanota to non-profit organizations](https://tutanota.com/blog/posts/secure-email-for-non-profit) for free or with a heavy discount.
@@ -348,6 +380,7 @@ We regard these features as important in order to provide a safe and optimal ser
 **Minimum to Qualify:**
 
 - Encrypts email account data at rest with zero-access encryption.
+- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .eml with [RFC5322](https://datatracker.ietf.org/doc/rfc5322/) standard.
 
 **Best Case:**
 
@@ -386,7 +419,8 @@ Email servers deal with a lot of very sensitive data. We expect that providers w
 - Protection of webmail with 2FA, such as TOTP.
 - Zero access encryption, builds on encryption at rest. The provider does not have the decryption keys to the data they hold. This prevents a rogue employee leaking data they have access to or remote adversary from releasing data they have stolen by gaining unauthorized access to the server.
 - [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) support.
-- No [TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) errors/vulnerabilities when being profiled by tools such as [Hardenize](https://www.hardenize.com), [testssl.sh](https://testssl.sh) or [Qualys SSL Labs](https://www.ssllabs.com/ssltest), this includes certificate related errors, poor or weak ciphers suites, weak DH parameters such as those that led to [Logjam](https://en.wikipedia.org/wiki/Logjam_(computer_security)).
+- No TLS errors or vulnerabilities when being profiled by tools such as [Hardenize](https://www.hardenize.com/), [testssl.sh](https://testssl.sh/), or [Qualys SSL Labs](https://www.ssllabs.com/ssltest); this includes certificate related errors and weak DH parameters, such as those that led to [Logjam](https://en.wikipedia.org/wiki/Logjam_(computer_security)).
+- A server suite preference (optional on TLSv1.3) for strong cipher suites which support forward secrecy and authenticated encryption.
 - A valid [MTA-STS](https://tools.ietf.org/html/rfc8461) and [TLS-RPT](https://tools.ietf.org/html/rfc8460) policy.
 - Valid [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities) records.
 - Valid [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) and [DKIM](https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail) records.
@@ -396,6 +430,7 @@ Email servers deal with a lot of very sensitive data. We expect that providers w
 - Website security standards such as:
     - [HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)
     - [Subresource Integrity](https://en.wikipedia.org/wiki/Subresource_Integrity) if loading things from external domains.
+- Must support viewing of [Message headers](https://en.wikipedia.org/wiki/Email#Message_header), as it is a crucial forensic feature to determine if an email is a phishing attempt.
 
 **Best Case:**
 

docs/encryption.en.md

@@ -146,7 +146,7 @@ BitLocker is [only supported](https://support.microsoft.com/en-us/windows/turn-o
 
     [:octicons-info-16:](https://support.apple.com/guide/mac-help/encrypt-mac-data-with-filevault-mh11785/mac){ .card-link title=Documentation}
 
-We recommend storing a local recovery key in a secure place as opposed to using iCloud FileVault recovery. As well, FileVault should be enabled **after** a complete macOS installation as more pseudorandom number generator ([PRNG](https://support.apple.com/guide/security/random-number-generation-seca0c73a75b/web)) [entropy](https://en.wikipedia.org/wiki/Entropy_(computing)) will be available.
+We recommend storing a local recovery key in a secure place as opposed to using your iCloud account for recovery.
 
 ### Linux Unified Key Setup
 

docs/frontends.en.md

@@ -33,7 +33,7 @@ Sometimes services will try to force you to sign up for an account by blocking a
 
 When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Librarian, as other peoples' usage will be linked to your hosting.
 
-When you are using a Librarian instance, make sure to read the privacy policy of that specific instance. Librarian instances can be modified by their owners and therefore may not reflect the default policy. Librarian instances feature a "privacy nutrition label" to provide an overview of their policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII (Personally Identifiable Information).
+When you are using a Librarian instance, make sure to read the privacy policy of that specific instance. Librarian instances can be modified by their owners and therefore may not reflect the default policy. Librarian instances feature a "privacy nutrition label" to provide an overview of their policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
 
 ## Twitter
 
@@ -59,7 +59,32 @@ When you are using a Librarian instance, make sure to read the privacy policy of
 
 When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Nitter, as other peoples' usage will be linked to your hosting.
 
-When you are using a Nitter instance, make sure to read the privacy policy of that specific instance. Nitter instances can be modified by their owners and therefore may not reflect the default policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII (Personally Identifiable Information).
+When you are using a Nitter instance, make sure to read the privacy policy of that specific instance. Nitter instances can be modified by their owners and therefore may not reflect the default policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
+
+## TikTok
+
+### ProxiTok
+
+!!! recommendation
+
+    ![ProxiTok logo](assets/img/frontends/proxitok.svg){ align=right }
+
+    **ProxiTok** is an open source frontend to the [TikTok](https://www.tiktok.com) website that is also self-hostable.
+
+    There are a number of public instances, with some instances having [Tor](https://www.torproject.org) onion services support.
+
+    [:octicons-repo-16: Repository](https://github.com/pablouser1/ProxiTok){ .md-button .md-button--primary }
+    [:octicons-server-16:](https://github.com/pablouser1/ProxiTok/wiki/Public-instances){ .card-link title="Public Instances"}
+    [:octicons-info-16:](https://github.com/pablouser1/ProxiTok/wiki){ .card-link title=Documentation}
+    [:octicons-code-16:](https://github.com/pablouser1/ProxiTok){ .card-link title="Source Code" }
+
+!!! tip
+
+    ProxiTok is useful if you want to disable JavaScript in your browser, such as [Tor Browser](https://www.torproject.org/) on the Safest security level.
+
+When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting ProxiTok, as other peoples' usage will be linked to your hosting.
+
+When you are using a ProxiTok instance, make sure to read the privacy policy of that specific instance. ProxiTok instances can be modified by their owners and therefore may not reflect their associated privacy policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
 
 ## YouTube
 
@@ -90,7 +115,6 @@ When you are using a Nitter instance, make sure to read the privacy policy of th
 
     When using FreeTube, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io) or [SponsorBlock](https://sponsor.ajay.app/) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
 
-
 ### NewPipe (Android)
 
 !!! recommendation annotate
@@ -114,7 +138,7 @@ When you are using a Nitter instance, make sure to read the privacy policy of th
 1. The default instance is [FramaTube](https://framatube.org/), however more can be added via **Settings** → **Content** → **PeerTube instances**
 
 !!! Warning
-    
+
     When using NewPipe, your IP address will be visible to the video providers used. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
 
 ### Invidious
@@ -144,7 +168,7 @@ When you are using a Nitter instance, make sure to read the privacy policy of th
 
 When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Invidious, as other peoples' usage will be linked to your hosting.
 
-When you are using an Invidious instance, make sure to read the privacy policy of that specific instance. Invidious instances can be modified by their owners and therefore may not reflect their associated privacy policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII (Personally Identifiable Information).
+When you are using an Invidious instance, make sure to read the privacy policy of that specific instance. Invidious instances can be modified by their owners and therefore may not reflect their associated privacy policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
 
 ### Piped
 

docs/index.en.md

@@ -40,10 +40,10 @@ It's important for a website like Privacy Guides to always stay up-to-date. We n
 <div class="grid cards" style="margin:auto;max-width:800px;text-align:center;" markdown>
 
 - [:simple-discourse: Join our forum](https://discuss.privacyguides.org/)
-- [:simple-mastodon: Follow us on Mastodon](https://mastodon.social/@privacyguides){ rel=me }
+- [:simple-mastodon: Follow us on Mastodon](https://mastodon.neat.computer/@privacyguides){ rel=me }
 - [:material-book-edit: Contribute to this website](https://github.com/privacyguides/privacyguides.org)
 - [:simple-matrix: Chat with us on Matrix](https://matrix.to/#/#privacyguides:matrix.org)
-- [:material-information-outline: Learn more about us](about.md)
+- [:material-information-outline: Learn more about us](about/index.md)
 - [:material-hand-coin-outline: Support the project](about/donate.md)
 
 </div>

docs/kb-archive.en.md

@@ -0,0 +1,15 @@
+---
+title: KB Archive
+icon: material/archive
+---
+# Pages Moved to Blog
+
+Some pages that used to be in our knowledge base can now be found on our blog:
+
+- [GrapheneOS vs. CalyxOS](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/)
+- [Signal Configuration Hardening](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening/)
+- [Linux - System Hardening](https://blog.privacyguides.org/2022/04/22/linux-system-hardening/)
+- [Linux - Application Sandboxing](https://blog.privacyguides.org/2022/04/22/linux-application-sandboxing/)
+- [Secure Data Erasure](https://blog.privacyguides.org/2022/05/25/secure-data-erasure/)
+- [Integrating Metadata Removal](https://blog.privacyguides.org/2022/04/09/integrating-metadata-removal/)
+- [iOS Configuration Guide](https://blog.privacyguides.org/2022/10/22/ios-configuration-guide/)

docs/linux-desktop/hardening.en.md

@@ -1,134 +0,0 @@
----
-title: System Hardening
-icon: material/monitor-lock
----
-There are a number of procedures you can follow to make your Linux desktop system more secure, some more advanced than others. We cover some general techniques here.
-
-## Firewalls
-
-A [firewall](https://en.wikipedia.org/wiki/Firewall_(computing)) may be used to secure connections to your system. If you’re on a public network, the necessity of this may be greater than if you’re on a local trusted network that you control. We would generally recommend that you block incoming connections only, unless you’re using an application firewall such as [OpenSnitch](https://github.com/evilsocket/opensnitch) or [Portmaster](https://safing.io/portmaster/).
-
-Red Hat distributions (such as Fedora) are typically configured through [firewalld](https://en.wikipedia.org/wiki/Firewalld). Red Hat has plenty of [documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/using-and-configuring-firewalld_configuring-and-managing-networking) regarding this topic. There is also the [Uncomplicated Firewall](https://en.wikipedia.org/wiki/Uncomplicated_Firewall) which can be used as an alternative.
-
-You could also set your default firewall zone to drop packets. If you're on a Redhat based distribution, such as Fedora this can be done with the following commands:
-
-!!! Example
-    ```
-    firewall-cmd --set-default-zone=drop;
-    firewall-cmd --add-protocol=ipv6-icmp --permanent;
-    firewall-cmd --add-service=dhcpv6-client --permanent;
-    ```
-
-All these firewalls use the [Netfilter](https://en.wikipedia.org/wiki/Netfilter) framework and therefore cannot protect against malicious programs running on the system. A malicious program could insert its own rules.
-
-If you are using Flatpak packages, you can revoke their network socket access using Flatseal and prevent those applications from accessing your network. This permission is not bypassable.
-
-If you are using non-classic [Snap](https://en.wikipedia.org/wiki/Snap_(package_manager)) packages on a system with proper snap confinement support (with both AppArmor and [cgroups](https://en.wikipedia.org/wiki/Cgroups) v1 present), you can use the Snap Store to revoke network permission as well. This is also not bypassable.
-
-## Kernel hardening
-
-Kernel hardening options such as configuring [sysctl](https://en.wikipedia.org/wiki/Sysctl#Linux) keys and [kernel command-line parameters](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) can help harden your system. We suggest looking at the following [sysctl settings](https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl) and [boot parameters](https://madaidans-insecurities.github.io/guides/linux-hardening.html#boot-parameters).
-
-We **strongly** recommend that you learn what these options do before applying them. There are also some methods of [kernel attack surface reduction](https://madaidans-insecurities.github.io/guides/linux-hardening.html#kernel-attack-surface-reduction) and [access restrictions to sysfs](https://madaidans-insecurities.github.io/guides/linux-hardening.html#restricting-sysfs) that can further improve security.
-
-!!! Note
-    Unprivileged [user namespaces](https://madaidans-insecurities.github.io/linux.html#kernel) can be disabled, due to it being responsible for various privileged escalation vulnerabilities. Some software such as Docker, Podman, and LXC require unprivileged user namespaces to function. If you use these tools you should not disable `kernel.unprivileged_userns_clone`.
-
-    Disabling access to `/sys` without a proper whitelist will lead to various applications breaking. This will unfortunately be an extremely tedious process for most users. Kicksecure, and by extension, Whonix, has an experimental [hide hardware info service](https://github.com/Kicksecure/security-misc/blob/master/lib/systemd/system/hide-hardware-info.service) which does just this. From our testing, these work perfectly fine on minimal Kicksecure installations and both Qubes-Whonix Workstation and Gateway. If you are using Kicksecure or Whonix, we recommend that you follow the [Kicksecure Wiki](https://www.kicksecure.com/wiki/Security-misc) to enable hide hardware info service.
-
-## Linux-Hardened
-
-Some distributions like Arch Linux have the [linux-hardened](https://github.com/anthraxx/linux-hardened), kernel package. It includes [hardening patches](https://wiki.archlinux.org/title/security#Kernel_hardening) and more security-conscious defaults. Linux-Hardened has `kernel.unprivileged_userns_clone=0` disabled by default. See the [note above](#kernel-hardening) about how this might impact you.
-
-## Linux Kernel Runtime Guard (LKRG)
-
-LKRG is a kernel module that performs runtime integrity check on the kernel to help detect exploits against the kernel. LKRG works in a *post*-detect fashion, attempting to respond to unauthorized modifications to the running Linux kernel. While it is [bypassable by design](https://lkrg.org/), it does stop off-the-shelf malware that does not specifically target LKRG itself. This may make exploits harder to develop and execute on vulnerable systems.
-
-If you can get LKRG and maintain module updates, it provides a worthwhile improvement to security. Debian based distributions can get the LKRG DKMS package from KickSecure's secure repository and the [KickSecure documentation](https://www.kicksecure.com/wiki/Linux_Kernel_Runtime_Guard_LKRG) has instructions.
-
-On Fedora, [fepitre](https://github.com/fepitre), a QubesOS developer has a [COPR repository](https://copr.fedorainfracloud.org/coprs/fepitre/lkrg/) where you can install it. Arch based systems can obtain the LKRG DKMS package via an [AUR package](https://aur.archlinux.org/packages/lkrg-dkms).
-
-## GRSecurity
-
-GRSecurity is a set of kernel patches that attempt to improve security of the Linux kernel. It requires [payment to access](https://grsecurity.net/purchase) the code and is worth using if you have a subscription.
-
-## Simultaneous multithreading (SMT)
-
-[SMT](https://en.wikipedia.org/wiki/Simultaneous_multithreading) has been the cause of numerous hardware vulnerabilities, and subsequent patches for those vulnerabilities often come with performance penalties that negate most of the performance gain given by SMT. If you followed the “kernel hardening” section above, some kernel parameters already disable SMT. If the option is available to you, we recommend that you disable it in your firmware as well.
-
-## Hardened memory allocator
-
-The [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) from [GrapheneOS](https://grapheneos.org) can also be used on general Linux distributions. It is available as an [AUR package](https://wiki.archlinux.org/title/Security#Hardened_malloc) on Arch based distributions, and (though not enabled by default) on Whonix and Kicksecure.
-
-If you are using Whonix, Kicksecure or the AUR package, consider setting up `LD_PRELOAD` as described in the [Kicksecure Documentation](https://www.kicksecure.com/wiki/Hardened_Malloc) or [Arch Wiki](https://wiki.archlinux.org/title/Security#Hardened_malloc).
-
-## Umask
-
-If you are not using openSUSE, consider changing the default [umask](https://en.wikipedia.org/wiki/Umask) for both regular user accounts and root to 077. Changing umask to 077 can break snapper on openSUSE and is **not** recommended.
-
-## Mountpoint hardening
-
-Consider adding the [following options](https://man7.org/linux/man-pages/man8/mount.8.html) `nodev`, `noexec`, and `nosuid` to [mountpoints](https://en.wikipedia.org/wiki/Mount_(computing)) which do not need them. Typically, these could be applied to `/boot`, `/boot/efi`, and `/var`.
-
-These flags could also be applied to `/home` and `/root` as well, however, `noexec` will prevent applications from working that require binary execution in those locations. This includes products such as Flatpak and Snap.
-
-If you use [Toolbox](https://docs.fedoraproject.org/en-US/fedora-silverblue/toolbox/), `/var/log/journal` must not have any of those options. If you are on Arch Linux, do not apply `noexec` to `/var/tmp`.
-
-## Disabling SUID
-
-SUID allows a user to execute an application as the owner of that application, which in many cases, would be the `root` user. Vulnerable SUID executables could lead to privilege escalation vulnerabilities.
-
-It is desirable to remove SUID from as many binaries as possible; however, this takes substantial effort and trial and error on the user's part, as some applications require SUID to function.
-
-Kicksecure, and by extension, Whonix has an experimental [permission hardening service](https://github.com/Kicksecure/security-misc/blob/master/lib/systemd/system/permission-hardening.service) and [application whitelist](https://github.com/Kicksecure/security-misc/tree/master/etc/permission-hardening.d) to automate SUID removal from most binaries and libraries on the system. From our testing, these work perfectly fine on a minimal Kicksecure installation and both Qubes-Whonix Workstation and Gateway.
-
-If you are using Kicksecure or Whonix, we recommend that you follow the [Kicksecure Wiki](https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener) to enable the permission hardener.
-
-Users of other distributions can adapt the permission hardener to their own system based on the source code linked above.
-
-## Secure Time Synchronization
-
-Most Linux distributions by default (especially Arch based distributions with `systemd-timesyncd`) use un-encrypted NTP for time synchronization. Securing NTP can be achieved by [configuring NTS with chronyd](https://fedoramagazine.org/secure-ntp-with-nts/) or by using [swdate](https://github.com/Kicksecure/sdwdate) on Debian based distributions.
-
-## Linux Pluggable Authentication Modules (PAM)
-
-The security of [PAM](https://en.wikipedia.org/wiki/Linux_PAM) can be [hardened](https://madaidans-insecurities.github.io/guides/linux-hardening.html#pam) to allow secure authentication to your system.
-
-On Red Hat distributions you can use [`authselect`](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel) to configure this e.g.:
-
-```bash
-sudo authselect select <profile_id, default: sssd> with-faillock without-nullok with-pamaccess
-```
-
-On systems where [`pam_faillock`](https://man7.org/linux/man-pages/man8/pam_tally.8.html) is not available, consider using [`pam_tally2`](https://man7.org/linux/man-pages/man8/pam_tally.8.html) instead.
-
-## USB port protection
-
-To better protect your [USB](https://en.wikipedia.org/wiki/USB) ports from attacks such as [BadUSB](https://en.wikipedia.org/wiki/BadUSB), we recommend [USBGuard](https://github.com/USBGuard/usbguard). USBGuard has [documentation](https://github.com/USBGuard/usbguard#documentation) as does the [Arch Wiki](https://wiki.archlinux.org/title/USBGuard).
-
-Another alternative option if you’re using the [linux-hardened](#linux-hardened) is the [`deny_new_usb`](https://github.com/GrapheneOS/linux-hardened/commit/96dc427ab60d28129b36362e1577b6673b0ba5c4) sysctl. See [Preventing USB Attacks with `linux-hardened`](https://blog.lizzie.io/preventing-usb-attacks-with-linux-hardened.html).
-
-## Secure Boot
-
-[Secure Boot](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_Boot) can be used to secure the boot process by preventing the loading of [unsigned](https://en.wikipedia.org/wiki/Public-key_cryptography) [UEFI](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface) drivers or [boot loaders](https://en.wikipedia.org/wiki/Bootloader).
-
-One of the problems with Secure Boot, particularly on Linux is, that only the [chainloader](https://en.wikipedia.org/wiki/Chain_loading#Chain_loading_in_boot_manager_programs) (shim), the [boot loader](https://en.wikipedia.org/wiki/Bootloader) (GRUB), and the [kernel](https://en.wikipedia.org/wiki/Kernel_(operating_system)) are verified and that's where verification stops. The [initramfs](https://en.wikipedia.org/wiki/Initial_ramdisk) is often left unverified, unencrypted, and open up the window for an [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attack. The firmware on most devices is also configured to trust Microsoft's keys for Windows and its partners, leading to a large attacks surface.
-
-To eliminate the need to trust Microsoft's keys, follow the "Using your own keys" section on the [Arch Wiki](https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot). The important thing that needs to be done here is to replace the OEM's key with your own Platform Key.
-
-There are several ways to work around the unverified initramfs:
-
-The first way is to [encrypt the /boot partition](https://wiki.archlinux.org/title/GRUB#Encrypted_/boot). If you are on Fedora Workstation (not Silverblue), you can follow [this guide](https://mutschler.eu/linux/install-guides/fedora-btrfs-33/) to convert the existing installation to encrypted `/boot`. openSUSE comes with this that by default.
-
-Encrypting `/boot` however have its own issues, one being that [GRUB](https://en.wikipedia.org/wiki/GNU_GRUB) only supports [LUKS1](https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup) and not the newer default LUKS2 scheme. As the bootloader runs in [protected mode](https://en.wikipedia.org/wiki/Protected_mode) and the encryption module lacks [SSE acceleration](https://en.wikipedia.org/wiki/Streaming_SIMD_Extensions) so the boot process will take minutes to complete. Another problem with this is that you have to type the encryption password twice, which could be solved by following the [openSUSE Wiki](https://en.opensuse.org/SDB:Encrypted_root_file_system#Avoiding_to_type_the_passphrase_twice).
-
-There are a few options depending on your configuration:
-
-- If you enroll your own keys as described above, and your distribution supports Secure Boot by default, you can add your distribution's EFI Key into the list of trusted keys (db keys). It can then be enrolled into the firmware. Then, you should move all of your keys off your local storage device.
-- If you enroll your own keys as described above, and your distribution does **not** support Secure Boot out of the box (like Arch Linux), you have to leave the keys on the disk and setup automatic signing of the [kernel](https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Signing_the_kernel_with_a_pacman_hook) and bootloader. If you are using Grub, you can install it with the `--no-shim-lock` option and remove the need for the chainloader.
-
-The second option is to creating an [EFI Boot Stub](https://wiki.archlinux.org/title/Unified_kernel_image) that contains the [kernel](https://en.wikipedia.org/wiki/Kernel_(operating_system)), [initramfs](https://en.wikipedia.org/wiki/Initial_ramdisk), and [microcode](https://en.wikipedia.org/wiki/Microcode). This EFI stub can then be signed. If you use [dracut](https://en.wikipedia.org/wiki/Dracut_(software)) this can easily be done with the [`--uefi-stub` switch](https://man7.org/linux/man-pages/man8/dracut.8.html) or the [`uefi_stub` config](https://www.man7.org/linux/man-pages/man5/dracut.conf.5.html) option. This option also requires you to leave the keys on the disk to setup automatic signing, which weakens the security model.
-
-After setting up Secure Boot it is crucial that you set a “firmware password” (also called a “supervisor password”, “BIOS password” or “UEFI password”), otherwise an adversary can simply disable Secure Boot.
-
-These recommendations can make you a little more resistant to [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, but they not good as a proper verified boot process such as that found on [Android](https://source.android.com/security/verifiedboot), [ChromeOS](https://www.chromium.org/chromium-os/chromiumos-design-docs/security-overview/#verified-boot), [macOS](https://support.apple.com/en-us/HT208198), or [Windows](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process).

docs/linux-desktop/sandboxing.en.md

@@ -1,64 +0,0 @@
----
-title: Application Sandboxing
-icon: octicons/apps-16
----
-Some sandboxing solutions for desktop Linux distributions do exist, however they are not as strict as those found in macOS or ChromeOS. Applications installed from the package manager (`dnf`, `apt`, etc.) typically have **no** sandboxing or confinement whatsoever. Below are a few projects that aim to solve this problem:
-
-### Flatpak
-
-[Flatpak](https://flatpak.org) aims to be a universal package manager for Linux. One of its main functions is to provide a universal package format which can be used in most Linux distributions. It provides some [permission control](https://docs.flatpak.org/en/latest/sandbox-permissions.html).However, [it is known](https://madaidans-insecurities.github.io/linux.html#flatpak) that Flatpak sandboxing could be improved as particular Flatpaks often have greater permission than required. There does seem to be [some agreement](https://theevilskeleton.gitlab.io/2021/02/11/response-to-flatkill-org.html) that this is the case.
-
-You can restrict applications further by issuing [Flatpak overrides](https://docs.flatpak.org/en/latest/flatpak-command-reference.html#flatpak-override). This can be done with the command-line or by using [Flatseal](https://flathub.org/apps/details/com.github.tchx84.Flatseal). Some sample overrides are provided by [tommytran732](https://github.com/tommytran732/Flatpak-Overrides) and [rusty-snake](https://github.com/rusty-snake/kyst/tree/main/flatpak).
-
-We generally recommend revoking access to:
-
-- the Network (`share=network`) socket (internet access)
-- the PulseAudio socket (for both audio in and out), `device=all` (access to all devices including the camera)
-- `org.freedesktop.secrets` dbus (access to secrets stored on your keychain) for applications which do not need it
-
-If an application works natively with Wayland (and not running through the [XWayland](https://wayland.freedesktop.org/xserver.html) compatibility layer), consider revoking its access to the X11 (`socket=x11`) and [Inter-process communications (IPC)](https://en.wikipedia.org/wiki/Unix_domain_socket) socket (`share=ipc`) as well.
-
-We also recommend restricting broad filesystem permissions such as `filesystem=home` and `filesystem=host` which should be revoked and replaced with just the directories that the app needs to access. Some applications like [VLC](https://www.flathub.org/apps/details/org.videolan.VLC) implement the [Portals](https://docs.flatpak.org/en/latest/portal-api-reference.html) [API](https://en.wikipedia.org/wiki/API), which allows a file manager to pass files to the Flatpak application (e.g. VLC) without specific filesystem access privileges. VLC is only able to access the specific file that you want to open, rather than requiring privileges to particular locations.
-
-Hard-coded access to some kernel interfaces like [`/sys`](https://en.wikipedia.org/wiki/Sysfs) and [`/proc`](https://en.wikipedia.org/wiki/Procfs#Linux) and weak [seccomp](https://en.wikipedia.org/wiki/Seccomp) filters unfortunately cannot be secured with Flatpak.
-
-### Firejail
-
-[Firejail](https://firejail.wordpress.com/) is another method of sandboxing. As it is a large [setuid](https://en.wikipedia.org/wiki/Setuid) binary, it has a large attack surface which may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation).
-
-[This post from a Whonix security researcher](https://madaidans-insecurities.github.io/linux.html#firejail) provides additional details on how Firejail can worsen the security of your device.
-
-### Mandatory Access Control
-
-[Mandatory access control](https://en.wikipedia.org/wiki/Mandatory_access_control) systems require policy files in order to force constraints on the system.
-
-The two main control systems are [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) (used on Android and Fedora) and [AppArmor](https://en.wikipedia.org/wiki/AppArmor).
-
-Fedora includes SELinux preconfigured with some policies that will confine [system daemons](https://en.wikipedia.org/wiki/Daemon_(computing)) (background processes). We don’t recommend disabling SELinux.
-
-openSUSE gives the choice of AppArmor or SELinux during the installation process. We recommend sticking to the default for each variant (AppArmor for [Tumbleweed](https://get.opensuse.org/tumbleweed/) and SELinux for [MicroOS](https://microos.opensuse.org/)). openSUSE’s SELinux policies are derived from Fedora.
-
-Arch and Arch-based operating systems often do not come with a mandatory access control system and that must be configured manually for either [AppArmor](https://wiki.archlinux.org/title/AppArmor) or [SELinux](https://wiki.archlinux.org/title/SELinux).
-
-Linux desktops don't usually include individual app confinement rules, unlike Android which sandboxes every application installed.
-
-### Making your own policies/profiles
-
-You can make your own AppArmor profiles, SELinux policies, Bubblewrap profiles, and [seccomp](https://en.wikipedia.org/wiki/Seccomp) blacklist to have better confinement of applications. This is an advanced and sometimes tedious task, so we won’t go into detail about how to do it here, but we do have a few projects that you could use as reference.
-
-- Whonix’s [AppArmor Everything](https://github.com/Whonix/apparmor-profile-everything)
-- Krathalan’s [AppArmor profiles](https://github.com/krathalan/apparmor-profiles)
-- noatsecure’s [SELinux templates](https://github.com/noatsecure/hardhat-selinux-templates)
-- Seirdy’s [Bubblewrap scripts](https://sr.ht/~seirdy/bwrap-scripts)
-
-### Securing Linux containers
-
-If you’re running a server, you may have heard of Linux Containers, Docker, or Podman which refer to a kind of [OS-level virtualization](https://en.wikipedia.org/wiki/OS-level_virtualization). Containers are more common in server and development environments where individual apps are built to operate independently.
-
-[Docker](https://en.wikipedia.org/wiki/Docker_(software)) is one of the most common container solutions. It does not run a proper sandbox, and this means that there is a large kernel attack surface. The [daemon](https://en.wikipedia.org/wiki/Daemon_(computing)) controls everything and [typically](https://docs.docker.com/engine/security/rootless/#known-limitations) runs as root. If it crashes for some reason, all the containers will crash too. The [gVisor](https://en.wikipedia.org/wiki/GVisor) runtime which implements an application level kernel can help limit the number of [syscalls](https://en.wikipedia.org/wiki/System_call) an application can make and can help isolate it from the host’s [kernel](https://en.wikipedia.org/wiki/Kernel_(operating_system)).
-
-Red Hat develops [Podman](https://docs.podman.io/en/latest/) and secures it with SELinux to [isolate](https://www.redhat.com/sysadmin/apparmor-selinux-isolation) containers from each other. One of the notable differences between Docker and Podman is that Docker requires [root](https://en.wikipedia.org/wiki/Superuser) while Podman can run with [rootless containers](https://developers.redhat.com/blog/2020/09/25/rootless-containers-with-podman-the-basics) that are also [daemonless](https://developers.redhat.com/blog/2018/08/29/intro-to-podman), meaning if one crashes they don’t all come down.
-
-Another option is [Kata containers](https://katacontainers.io/), where virtual machines masquerade as containers. Each Kata container has its own Linux kernel and is isolated from the host.
-
-The above container technologies can be useful if you want to run certain web app software on your local network, such as [Vaultwarden](https://github.com/dani-garcia/vaultwarden) or images provided by [LinuxServer.io](https://www.linuxserver.io), to increase privacy by decreasing dependence on various web services. A guide on [hardening Docker and OCI](https://wonderfall.dev/docker-hardening) has been written by the author "Wonderfall."

docs/meta/brand.md

@@ -0,0 +1,22 @@
+---
+title: Branding Guidelines
+---
+
+The name of the website is **Privacy Guides** and should **not** be changed to:
+
+<div class="pg-red" markdown>
+- PrivacyGuides
+- Privacy guides
+- PG
+- PG.org
+</div>
+
+The name of the subreddit is **r/PrivacyGuides** or **the Privacy Guides Subreddit**.
+
+Additional branding guidelines can be found at [github.com/privacyguides/brand](https://github.com/privacyguides/brand)
+
+## Trademark
+
+"Privacy Guides" and the shield logo are trademarks owned by Jonah Aragon, unlimited usage is granted to the Privacy Guides project.
+
+Without waiving any of its rights, Privacy Guides does not advise others on the scope of its intellectual property rights. Privacy Guides does not permit or consent to any use of its trademarks in any manner that is likely to cause confusion by implying association with or sponsorship by Privacy Guides. If you are aware of any such use, please contact Jonah Aragon at jonah@privacyguides.org. Consult your legal counsel if you have questions.

docs/meta/git-recommendations.md

@@ -0,0 +1,45 @@
+---
+title: Git Recommendations
+---
+If you make changes to this website on GitHub.com's web editor directly, you shouldn't have to worry about this. If you are developing locally and/or are a long-term website editor (who should probably be developing locally!), consider these recommendations.
+
+## Enable SSH Key Commit Signing
+
+You can use an existing SSH key for signing, or [create a new one](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).
+
+1. Configure your Git client to sign commits and tags by default (remove `--global` to only sign by default for this repo):
+   ```
+   git config --global commit.gpgsign true
+   git config --global gpg.format ssh
+   git config --global tag.gpgSign true
+   ```
+2. Copy your SSH public key to your clipboard, for example:
+   ```
+   pbcopy < ~/.ssh/id_ed25519.pub
+    # Copies the contents of the id_ed25519.pub file to your clipboard
+   ```
+3. Set your SSH key for signing in Git with the following command, replacing the last string in quotes with the public key in your clipboard:
+   ```
+   git config --global user.signingkey 'ssh-ed25519 AAAAC3(...) user@example.com'
+   ```
+
+Ensure you [add your SSH key to your GitHub account](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account#adding-a-new-ssh-key-to-your-account) **as a Signing Key** (as opposed to or in addition to as an Authentication Key).
+
+## Rebase on Git pull
+
+Use `git pull --rebase` instead of `git pull` when pulling in changes from GitHub to your local machine. This way your local changes will always be "on top of" the latest changes on GitHub, and you avoid merge commits (which are disallowed in this repo).
+
+You can set this to be the default behavior:
+
+```
+git config --global pull.rebase true
+```
+
+## Rebase from `main` before submitting a PR
+
+If you are working on your own branch, run these commands before submitting a PR:
+
+```
+git fetch origin
+git rebase origin/main
+```

docs/meta/uploading-images.md

@@ -0,0 +1,89 @@
+---
+title: Uploading Images
+---
+
+Here are a couple of general rules for contributing to Privacy Guides:
+
+## Images
+
+- We **prefer** SVG images, but if those do not exist we can use PNG images
+
+Company logos have canvas size of:
+
+- 128x128px
+- 384x128px
+
+## Optimization
+
+### PNG
+
+Use the [OptiPNG](https://sourceforge.net/projects/optipng/) to optimize the PNG image:
+
+```bash
+optipng -o7 file.png
+```
+
+### SVG
+
+#### Inkscape
+
+[Scour](https://github.com/scour-project/scour) all SVG images.
+
+In Inkscape:
+
+1. File Save As..
+2. Set type to Optimized SVG (*.svg)
+
+In the **Options** tab:
+
+- **Number of significant digits for coordinates** > **5**
+- [x] Turn on **Shorten color values**
+- [x] Turn on **Convert CSS attributes to XML attributes**
+- [x] Turn on **Collapse groups**
+- [x] Turn on **Create groups for similar attributes**
+- [ ] Turn off **Keep editor data**
+- [ ] Turn off **Keep unreferenced definitions**
+- [x] Turn on **Work around renderer bugs**
+
+In the **SVG Output** tab under **Document options**:
+
+- [ ] Turn off **Remove the XML declaration**
+- [x] Turn on **Remove metadata**
+- [x] Turn on **Remove comments**
+- [x] Turn on **Embeded raster images**
+- [x] Turn on **Enable viewboxing**
+
+In the **SVG Output** under **Pretty-printing**:
+
+- [ ] Turn off **Format output with line-breaks and indentation**
+- **Indentation characters** > Select **Space**
+- **Depth of indentation** > **1**
+- [ ] Turn off **Strip the "xml:space" attribute from the root SVG element**
+
+In the **IDs** tab:
+
+- [x] Turn on **Remove unused IDs**
+- [ ] Turn off **Shorten IDs**
+- **Prefix shortened IDs with** > `leave blank`
+- [x] Turn on **Preserve manually created IDs not ending with digits**
+- **Preserve the following IDs** > `leave blank`
+- **Preserve IDs starting with** > `leave blank`
+
+#### CLI
+
+The same can be achieved with the [Scour](https://github.com/scour-project/scour) command:
+
+```bash
+scour --set-precision=5 \
+      --create-groups \
+      --renderer-workaround \
+      --remove-descriptive-elements \
+      --enable-comment-stripping \
+      --enable-viewboxing \
+      --indent=space \
+      --nindent=1 \
+      --no-line-breaks \
+      --enable-id-stripping \
+      --protect-ids-noninkscape \
+      input.svg output.svg
+```

docs/meta/writing-style.md

@@ -0,0 +1,87 @@
+---
+title: Writing Style
+---
+
+Privacy Guides is written in American English, and you should refer to [APA Style guidelines](https://apastyle.apa.org/style-grammar-guidelines/grammar) when in doubt.
+
+In general the [United States federal plain language guidelines](https://www.plainlanguage.gov/guidelines/) provide a good overview of how to write clearly and concisely. We highlight a few important notes from these guidelines below.
+
+## Writing for our audience
+
+Privacy Guides' intended [audience](https://www.plainlanguage.gov/guidelines/audience/) is primarily average, technology using adults. Don't dumb down content as if you are addressing a middle-school class, but don't overuse complicated terminology about concepts average computer users wouldn't be familiar with.
+
+### Address only what people want to know
+
+People don't need overly complex articles with little relevance to them. Figure out what you want people to accomplish when writing an article, and only include those details.
+
+> Tell your audience why the material is important to them. Say, “If you want a research grant, here’s what you have to do.” Or, “If you want to mine federal coal, here’s what you should know.” Or, “If you’re planning a trip to Rwanda, read this first.”
+
+### Address people directly
+
+We're writing *for* a wide variety of people, but we are writing *to* the person who is actually reading it. Use "you" to address the reader directly.
+
+> More than any other single technique, using “you” pulls users into the information and makes it relevant to them.
+>
+> When you use “you” to address users, they are more likely to understand what their responsibility is.
+
+Source: [plainlanguage.gov](https://www.plainlanguage.gov/guidelines/audience/address-the-user/)
+
+### Avoid "users"
+
+Avoid calling people "users", in favor of "people", or a more specific description of the group of people you are writing for.
+
+## Organizing content
+
+Organization is key. Content should flow from most to least important information, and use headers as much as needed to logically separate different ideas.
+
+- Limit the document to around five or six sections. Long documents should probably be broken up into separate pages.
+- Mark important ideas with **bold** or *italics*.
+
+Source: [plainlanguage.gov](https://www.plainlanguage.gov/guidelines/design/)
+
+### Begin with a topic sentence
+
+> If you tell your reader what they’re going to read about, they’re less likely to have to read your paragraph again. Headings help, but they’re not enough. Establish a context for your audience before you provide them with the details.
+>
+> We often write the way we think, putting our premises first and then our conclusion. It may be the natural way to develop thoughts, but we wind up with the topic sentence at the end of the paragraph. Move it up front and let users know where you’re going. Don’t make readers hold a lot of information in their heads before getting to the point.
+
+Source: [plainlanguage.gov](https://www.plainlanguage.gov/guidelines/organize/have-a-topic-sentence/)
+
+## Choose your words carefully
+
+> Words matter. They are the most basic building blocks of written and spoken communication. Don’t complicate things by using jargon, technical terms, or abbreviations that people won’t understand.
+
+We should try to avoid abbreviations where possible, but technology is full of abbreviations. In general, spell out the abbreviation/acronym the first time it is used on a page, and add the abbreviation to the abbreviation glossary file when it is used repeatedly.
+
+> Kathy McGinty offers tongue-in-cheek instructions for bulking up your simple, direct sentences:
+>
+> > There is no escaping the fact that it is considered very important to note that a number of various available applicable studies ipso facto have generally identified the fact that additional appropriate nocturnal employment could usually keep juvenile adolescents off thoroughfares during the night hours, including but not limited to the time prior to midnight on weeknights and/or 2 a.m. on weekends.
+>
+>And the original, using stronger, simpler words:
+>
+> > More night jobs would keep youths off the streets.
+
+## Be concise
+
+> Unnecessary words waste your audience’s time. Great writing is like a conversation. Omit information that the audience doesn’t need to know. This can be difficult as a subject matter expert so it’s important to have someone look at the information from the audience’s perspective.
+
+Source: [plainlanguage.gov](https://www.plainlanguage.gov/guidelines/concise/)
+
+## Keep text conversational
+
+> Verbs are the fuel of writing. They give your sentences power and direction. They enliven your writing and make it more interesting.
+>
+> Verbs tell your audience what to do. Make sure it’s clear who does what.
+
+### Use active voice
+
+> Active voice makes it clear who is supposed to do what. It eliminates ambiguity about responsibilities. Not “It must be done,” but “You must do it.”
+
+Source: [plainlanguage.gov](https://www.plainlanguage.gov/guidelines/conversational/use-active-voice/)
+
+### Use "must" for requirements
+
+> - “must” for an obligation
+> - “must not” for a prohibition
+> - “may” for a discretionary action
+> - “should” for a recommendation

docs/mobile-browsers.en.md

@@ -75,6 +75,10 @@ InterPlanetary File System (IPFS) is a decentralized, peer-to-peer network for s
 - [x] Select **Close tabs on exit**
 - [x] Select **Clear data on exit**
 
+#### Brave Sync
+
+[Brave Sync](https://support.brave.com/hc/en-us/articles/360059793111-Understanding-Brave-Sync) allows your browsing data (history, bookmarks, etc.) to be accessible on all your devices without requiring an account and protects it with E2EE.
+
 ## iOS
 
 On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so there is little reason to use a third-party web browser.
@@ -127,9 +131,13 @@ Do note that Private Browsing does not save cookies and website data, so it won'
 
 ##### iCloud Sync
 
-Synchronization of Safari History, Tab Groups, iCloud Tabs and saved passwords are E2EE. However, bookmarks are [not](https://support.apple.com/en-us/HT202303). Apple can decrypt and access them in accordance with their [privacy policy](https://www.apple.com/legal/privacy/en-ww/).
+Synchronization of Safari History, Tab Groups, iCloud Tabs and saved passwords are E2EE. However, by default, bookmarks are [not](https://support.apple.com/en-us/HT202303). Apple can decrypt and access them in accordance with their [privacy policy](https://www.apple.com/legal/privacy/en-ww/).
 
-If you use iCloud, we also recommend checking to ensure Safari's default download location is set to locally on your device. This option can be found in :gear: **Settings** → **Safari** → **General** → **Downloads**.
+You can enable E2EE for you Safari bookmarks and downloads by enabling [Advanced Data Protection](https://support.apple.com/en-us/HT212520). Go to your **Apple ID name → iCloud → Advanced Data Protection**.
+
+- [x] Turn On **Advanced Data Protection**
+
+If you use iCloud with Advanced Data Protection disabled, we also recommend checking to ensure Safari's default download location is set to locally on your device. This option can be found in :gear: **Settings** → **Safari** → **General** → **Downloads**.
 
 ### AdGuard
 

docs/notebooks.en.md

@@ -9,28 +9,6 @@ If you are currently using an application like Evernote, Google Keep, or Microso
 
 ## Cloud-based
 
-### EteSync Notes
-
-!!! recommendation
-
-    ![EteSync Notes logo](assets/img/notebooks/etesync-notes.png){ align=right }
-
-    **EteSync Notes** is a secure, E2EE, and privacy-respecting note taking app. EteSync also offers optional [software as a service](https://dashboard.etebase.com/user/partner/pricing/), or you can host the server yourself for free.
-
-    [etebase](https://docs.etebase.com), which is the foundation of EteSync, can also be used by other apps as a backend to store data with E2EE.
-
-    [:octicons-home-16: Homepage](https://www.etesync.com){ .md-button .md-button--primary }
-    [:octicons-eye-16:](https://www.etesync.com/tos/#privacy){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://www.etesync.com/user-guide/){ .card-link title=Documentation}
-    [:octicons-code-16:](https://github.com/etesync){ .card-link title="Source Code" }
-    [:octicons-heart-16:](https://www.etesync.com/contribute/){ .card-link title=Contribute }
-
-    ??? downloads
-
-        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.etesync.notes)
-        - [:simple-appstore: App Store](https://apps.apple.com/us/app/etesync-notes/id1533806351)
-        - [:octicons-globe-16: Web](https://notes.etesync.com)
-
 ### Joplin
 
 !!! recommendation

docs/os/android-overview.en.md

@@ -1,6 +1,6 @@
 ---
 title: Android Overview
-icon: material/cellphone-check
+icon: simple/android
 ---
 Android is a secure operating system that has strong [app sandboxing](https://source.android.com/security/app-sandbox), [Verified Boot](https://source.android.com/security/verifiedboot) (AVB), and a robust [permission](https://developer.android.com/guide/topics/permissions/overview) control system.
 

docs/os/linux-overview.en.md

@@ -18,7 +18,7 @@ Despite these drawbacks, desktop GNU/Linux distributions are great if you want t
 
 Our website generally uses the term “Linux” to describe desktop GNU/Linux distributions. Other operating systems which also use the Linux kernel such as ChromeOS, Android, and Qubes OS are not discussed here.
 
-[Our Linux Recommendations :material-arrow-right-drop-circle:](../linux-desktop.md){ .md-button }
+[Our Linux Recommendations :material-arrow-right-drop-circle:](../desktop.md){ .md-button }
 
 ## Choosing your distribution
 
@@ -81,7 +81,7 @@ We strongly recommend **against** using the Linux-libre kernel, since it [remove
 
 Most Linux distributions have an option within its installer for enabling [LUKS](../encryption.md#linux-unified-key-setup) FDE. If this option isn’t set at installation time, you will have to backup your data and re-install, as encryption is applied after [disk partitioning](https://en.wikipedia.org/wiki/Disk_partitioning), but before [file systems](https://en.wikipedia.org/wiki/File_system) are formatted. We also suggest securely erasing your storage device:
 
-- [Secure Data Erasure :material-arrow-right-drop-circle:](../advanced/erasing-data.md)
+- [Secure Data Erasure :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/05/25/secure-data-erasure/)
 
 ### Swap
 
@@ -97,7 +97,7 @@ We recommend **against** using desktop environments or window managers that do n
 
 ### Proprietary Firmware (Microcode Updates)
 
-Linux distributions such as those which are [Linux-libre](https://en.wikipedia.org/wiki/Linux-libre) or DIY (Arch Linux) don’t come with the proprietary [microcode](https://en.wikipedia.org/wiki/Microcode) updates. Some notable examples of these vulnerabilities include [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)), [Meltdown](https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)), [SSB](https://en.wikipedia.org/wiki/Speculative_Store_Bypass), [Foreshadow](https://en.wikipedia.org/wiki/Foreshadow), [MDS](https://en.wikipedia.org/wiki/Microarchitectural_Data_Sampling), [SWAPGS](https://en.wikipedia.org/wiki/SWAPGS_(security_vulnerability)), and other [hardware vulnerabilities](https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html).
+Linux distributions such as those which are [Linux-libre](https://en.wikipedia.org/wiki/Linux-libre) or DIY (Arch Linux) don’t come with the proprietary [microcode](https://en.wikipedia.org/wiki/Microcode) updates that often patch vulnerabilities. Some notable examples of these vulnerabilities include [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)), [Meltdown](https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)), [SSB](https://en.wikipedia.org/wiki/Speculative_Store_Bypass), [Foreshadow](https://en.wikipedia.org/wiki/Foreshadow), [MDS](https://en.wikipedia.org/wiki/Microarchitectural_Data_Sampling), [SWAPGS](https://en.wikipedia.org/wiki/SWAPGS_(security_vulnerability)), and other [hardware vulnerabilities](https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html).
 
 We **highly recommend** that you install the microcode updates, as your CPU is already running the proprietary microcode from the factory. Fedora and openSUSE both have the microcode updates applied by default.
 

docs/os/qubes-overview.en.md

@@ -0,0 +1,53 @@
+---
+title: "Qubes Overview"
+icon: simple/qubesos
+---
+[**Qubes OS**](../desktop.md#qubes-os) is an operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
+
+## How does Qubes OS work?
+
+Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
+
+![Qubes architecture](../assets/img/qubes/qubes-trust-level-architecture.png)
+<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
+
+Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
+
+![Colored border](../assets/img/qubes/r4.0-xfce-three-domains-at-work.png)
+<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
+
+## Why Should I use Qubes?
+
+Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical use-case for Qubes OS is for opening documents from an unknown source.
+
+Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
+
+### Copying and Pasting Text
+
+You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
+
+1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
+2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
+3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
+4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
+
+### File Exchange
+
+To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more security than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
+
+??? info "AppVMs or qubes do not have their own file systems"
+
+    You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
+
+### Inter-VM Interactions
+
+The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
+
+## Additional Resources
+
+For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
+
+- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
+- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
+- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
+- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)

docs/passwords.en.md

@@ -6,6 +6,12 @@ Password managers allow you to securely store and manage passwords and other cre
 
 [Introduction to Passwords :material-arrow-right-drop-circle:](./basics/passwords-overview.md)
 
+!!! info
+
+    Built-in password managers in software like browsers and operating systems are sometimes not as good as dedicated password manager software. The advantage of a built-in password manager is good integration with the software, but it can often be very simple and lack privacy and security features standalone offerings have.
+
+    For example, the password manager in Microsoft Edge doesn't offer E2EE at all. Google's password manager has [optional](https://support.google.com/accounts/answer/11350823) E2EE, and [Apple's](https://support.apple.com/en-us/HT202303) offers E2EE by default.
+
 ## Cloud-based
 
 These password managers sync your passwords to a cloud server for easy accessibility from all your devices and safety against device loss.
@@ -67,7 +73,6 @@ Bitwarden's server-side code is [open-source](https://github.com/bitwarden/serve
         - [:simple-windows11: Windows](https://1password.com/downloads/windows/)
         - [:simple-apple: macOS](https://1password.com/downloads/mac/)
         - [:simple-linux: Linux](https://1password.com/downloads/linux/)
-        
 
 Traditionally, **1Password** has offered the best password manager user experience for people using macOS and iOS; however, it has now achieved feature-parity across all platforms. It boasts many features geared towards families and less technical people, as well as advanced functionality.
 
@@ -85,7 +90,7 @@ One advantage 1Password has over Bitwarden is its first-class support for native
 
     [:octicons-home-16: Homepage](https://psono.com){ .md-button .md-button--primary }
     [:octicons-eye-16:](https://psono.com/privacy-policy){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://doc.psono.com/){ .card-link title=Documentation}
+    [:octicons-info-16:](https://doc.psono.com){ .card-link title=Documentation}
     [:octicons-code-16:](https://gitlab.com/psono){ .card-link title="Source Code" }
 
     ??? downloads
@@ -96,7 +101,7 @@ One advantage 1Password has over Bitwarden is its first-class support for native
         - [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/psonopw-password-manager/eljmjmgjkbmpmfljlmklcfineebidmlo)
         - [:simple-docker: Docker Hub](https://hub.docker.com/r/psono/psono-client)
 
-Psono provides [extensive documentation](https://doc.psono.com/) for their product. The [web-client](https://doc.psono.com/admin/installation/install-webclient.html#installation-with-docker) for Psono can be self-hosted; alternatively, you can choose the full [Community Edition](https://doc.psono.com/admin/installation/install-server-ce.html) or the [Enterprise Edition](https://doc.psono.com/admin/installation/install-server-ee.html) with additional features.
+Psono provides extensive documentation for their product. The web-client for Psono can be self-hosted; alternatively, you can choose the full Community Edition or the Enterprise Edition with additional features.
 
 ## Local Storage
 

docs/productivity.en.md

@@ -56,6 +56,7 @@ For other platforms, consider below:
         - [:simple-windows11: Windows](https://www.onlyoffice.com/download-desktop.aspx)
         - [:simple-apple: macOS](https://www.onlyoffice.com/download-desktop.aspx)
         - [:simple-linux: Linux](https://www.onlyoffice.com/download-desktop.aspx)
+        - [:simple-flathub: Flathub](https://flathub.org/apps/details/org.onlyoffice.desktopeditors)
         - [:simple-freebsd: FreeBSD](https://www.freshports.org/www/onlyoffice-documentserver/)
 
 ### CryptPad

docs/qubes.en.md

@@ -1,19 +0,0 @@
----
-title: "Qubes OS"
-icon: simple/qubesos
----
-!!! recommendation
-
-    ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ align=right }
-
-    **Qubes OS** is an open-source operating system designed to provide strong security for desktop computing. Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
-
-    [:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
-    [:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
-    [:octicons-eye-16:](https://www.qubes-os.org/privacy/){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://www.qubes-os.org/doc/){ .card-link title=Documentation}
-    [:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
-
-!!! info
-
-    This page is a work-in-progress. Expect more thorough information on Qubes OS in the future.

docs/real-time-communication.en.md

@@ -5,7 +5,7 @@ icon: material/chat-processing
 
 These are our recommendations for encrypted real-time communication.
 
-[Types of Communication Networks :material-arrow-right-drop-circle:](./real-time-communication/communication-network-types.md)
+[Types of Communication Networks :material-arrow-right-drop-circle:](./advanced/communication-network-types.md)
 
 ## Cross-Platform Messengers
 
@@ -40,7 +40,7 @@ The protocol was independently [audited](https://eprint.iacr.org/2016/1013.pdf)
 
 We have some additional tips on configuring and hardening your Signal installation:
 
-[Signal Configuration and Hardening :material-arrow-right-drop-circle:](./real-time-communication/signal-configuration-hardening.md)
+[Signal Configuration and Hardening :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening/)
 
 ### Element
 
@@ -73,6 +73,31 @@ Group voice and video calls are [not](https://github.com/vector-im/element-web/i
 
 The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last) in 2016. The specification for the Matrix protocol can be found in their [documentation](https://spec.matrix.org/latest/). The [Olm](https://matrix.org/docs/projects/other/olm) cryptographic ratchet used by Matrix is an implementation of Signal’s [Double Ratchet algorithm](https://signal.org/docs/specifications/doubleratchet/).
 
+### SimpleX Chat
+
+!!! recommendation
+
+    ![Simplex logo](assets/img/messengers/simplex.svg){ align=right }
+
+    **SimpleX** Chat is an instant messenger that is decentralized and doesn't depend on any unique identifiers such as phone numbers or usernames. Users of SimpleX Chat can scan a QR code or click an invite link to participate in group conversations.
+
+    [:octicons-home-16: Homepage](https://simplex.chat){ .md-button .md-button--primary }
+    [:octicons-eye-16:](https://github.com/simplex-chat/simplex-chat/blob/stable/PRIVACY.md){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://github.com/simplex-chat/simplex-chat/tree/stable/docs){ .card-link title=Documentation}
+    [:octicons-code-16:](https://github.com/simplex-chat){ .card-link title="Source Code" }
+
+    ??? downloads
+
+        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=chat.simplex.app)
+        - [:simple-appstore: App Store](https://apps.apple.com/us/app/simplex-chat/id1605771084)
+        - [:simple-github: GitHub](https://github.com/simplex-chat/simplex-chat/releases)
+
+SimpleX Chat [was audited](https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html) by Trail of Bits in October 2022.
+
+Currently SimpleX Chat only provides a client for Android and iOS. Basic group chatting functionality, direct messaging, editing of messages and markdown are supported. E2EE Audio and Video calls are also supported. 
+
+Your data can be exported, and imported onto another device, as there are no central servers where this is backed up.
+
 ### Session
 
 !!! recommendation

docs/real-time-communication/signal-configuration-hardening.en.md

@@ -1,259 +0,0 @@
----
-title: "Signal Configuration and Hardening"
-icon: 'simple/signal'
----
-
-[Signal](../real-time-communication.md#signal) is a widely regarded instant messaging service that is not only easy to use but is also private and secure. Signal's strong E2EE implementation and metadata protections provide a level of assurance that only you and your intended recipients are able to read communications.
-
-This guide details actions you can take to configure and harden Signal in accordance with your [threat model](../basics/threat-modeling.md).
-
-## Signal Configuration
-
-### Signal PIN
-
-When you register for Signal with your phone number, you will be asked to set up a Signal PIN. This PIN can be used to recover your profile, settings, contacts and who you've blocked in case you ever lose or switch devices.
-
-Additionally, your Signal PIN can also double as a registration lock that prevents others from registering with your number.
-
-!!! attention "Registration Lock"
-
-    The server will not enforce the registration lock after 7 days of inactivity. After that, someone will be able to reset the PIN at registration and register with your phone number. This will wipe the data stored in your Signal account, as it is encrypted by the PIN, but it won't prevent someone from registering with your number provided that they can receive a text on it.
-
-If you haven't set up a Signal PIN, or have previously opted out of setting one up, follow these steps on Android/iOS:
-
-- Select :material-dots-vertical: > **Settings** > **Account** > **Signal PIN**
-- Select **Create new PIN**
-
-Signal will prompt you to enter a PIN. We suggest using a strong alphanumeric PIN that can be stored in a [password manager](../passwords.md).
-
-Once you have done that, or if you already have set up a PIN, make sure that **Registration Lock** is also enabled.
-
-- Select :material-dots-vertical: > **Settings** > **Account** > **Signal PIN**
-- [x] Turn on **Registration Lock**
-
-!!! Important
-
-    If you forget the PIN and have enabled a registration lock, you may be locked out of your account for up to 7 days.
-
-You can learn more about Signal PIN on [Signal's website](https://support.signal.org/hc/en-us/articles/360007059792-Signal-PIN).
-
-### Safety Numbers
-
-Safety numbers are a feature in Signal that allows you to ensure that messages are delivered securely between verified devices.
-
-It is best practice to always compare safety numbers with your contacts. This can be done in a couple of ways:
-
-- Scanning your contact's QR code while viewing their safety number.
-- Comparing the safety numbers on both ends, be it visually or audibly.
-
-!!! Important
-
-    In order for safety numbers to also verify that the intended recipient has access to the device you're verifying, you need a secondary communication channel where you can authenticate the person that is holding the device. For example, an in-person meeting or during a video call.
-
-To view the safety number for a particular contact, you need to follow these steps within Signal:
-
-- Go to a chat with a contact.
-- Select the chat header or :material-dots-vertical: > **View Safety Number**
-
-Once you've compared the safety numbers on both devices, you can mark that contact as **Verified**.
-
-A checkmark will appear in the chat header by your contact's name when the safety number is marked as verified. It will remain verified unless the safety number changes or you manually change the verification status.
-
-After doing that, any time the safety number changes, you'll be notified.
-
-If the safety number with one of your contacts changes, we recommend asking the contact what happened (if they switched to a new device or re-installed Signal, for example) and verify the safety numbers again.
-
-For more demanding threat models, you should agree on a protocol with your contacts in advance on what to do in case the safety number ever changes.
-
-You can learn more about safety numbers on [Signal's website](https://support.signal.org/hc/en-us/articles/360007060632-What-is-a-safety-number-and-why-do-I-see-that-it-changed-).
-
-### Disappearing Messages
-
-While communication in Signal is E2EE, the messages are still available on the devices, unless they are manually deleted.
-
-It is good practice to set up disappearing messages in Signal's settings so that any chats you start will disappear after a specified amount of time has passed.
-
-On Android/iOS:
-
-- Select :material-dots-vertical: > **Settings** > **Privacy**
-- Under **Disappearing messages**, select **Default timer for new chats**
-- Select the desired amount of time and select **Save**
-
-!!! tip "Override the global default for specific contacts"
-
-    - Go to a chat with a contact
-    - Select :material-dots-vertical: on the top right
-    - Select **Disappearing messages**
-    - Select the desired amount of time and select **Save**
-
-We recommend setting up a reasonable timer by default, such as one week, and adjusting it per contact as you see fit.
-
-!!! tip "Snapchat-like Functionality"
-
-    Signal allows you to send "view-once" media that are automatically removed from the conversation after they have been viewed.
-
-### Disable Link Previews
-
-Signal offers the ability to retrieve previews of webpages linked within a conversation.
-
-This means that when you send a link, a request will be sent to that website so that a preview of the website can be displayed alongside the link. Thus, we recommend disabling link previews.
-
-Your recipient doesn't make any requests unless they open the link on their end.
-
-On Android/iOS:
-
-- Select :material-dots-vertical: > **Settings** > **Chats**
-- [ ] Turn off **Generate link previews**
-
-### Screen Security
-
-Signal allows you to prevent a preview of the app being shown (i.e., in the app switcher) unless you explicitly open it.
-
-On Android:
-
-- Select :material-dots-vertical: > **Settings** > **Privacy**
-- [x] Turn on **Screen Security**
-
-On iOS:
-
-- Select :material-dots-vertical: > **Settings** > **Privacy**
-- [x] Turn on **Hide Screen in App Switcher**
-
-### Screen Lock
-
-If someone gets a hold of your device while it is unlocked, you run the risk of them being able to open the Signal app and look at your conversations.
-
-To mitigate this, you can leverage the Screen Lock option to require additional authentication before Signal can be accessed.
-
-On Android/iOS:
-
-- Select :material-dots-vertical: > **Settings** > **Privacy**
-- [x] Turn on **Screen Lock**
-
-### Notification Privacy
-
-Even when your phone is locked, anyone who can lay eyes on the device can read messages and sender names from your lock screen.
-
-On Signal, you have the ability to hide message content and sender name, or just the message content itself.
-
-On Android:
-
-- Select :material-dots-vertical: > **Settings** > **Notifications**
-- Select **Show**
-- Select **No name or message** or **Name only** respectively.
-
-On iOS:
-
-- Select :material-dots-vertical: > **Settings** > **Notifications**
-- Select **Show**
-- Select **No name or Content** or **Name Only** respectively.
-
-### Call Relaying
-
-Signal allows you to relay all calls (including video calls) through the Signal server to avoid revealing your IP address to your contact. This may reduce call quality.
-
-On Android/iOS:
-
-- Select :material-dots-vertical: > **Settings** > **Privacy** > **Advanced**
-- [x] Turn on **Always Relay Calls**
-
-For incoming calls from people who are not in your Contacts app, the call will be relayed through the Signal server regardless of how you've set it up.
-
-### Proxy Support
-
-If Signal is blocked in your country, Signal allows you to set up a proxy to bypass it.
-
-!!! Warning
-
-    All traffic remains opaque to the proxy operator. However, the censoring party could learn that you are using Signal through a proxy because the app [fails to route all the IP connections to the proxy](https://community.signalusers.org/t/traffic-not-routed-to-tls-proxies-can-expose-users-to-censors/27479).
-
-You can learn more about Signal's proxy support on their [website](https://support.signal.org/hc/en-us/articles/360056052052-Proxy-Support).
-
-### Disable Signal Call History (iOS)
-
-Signal allows you to see your call history from your regular phone app. This allows your iOS device to sync your call history with iCloud, including who you spoke to, when, and for how long.
-
-If you use iCloud and you don’t want to share call history on Signal, confirm it’s turned off:
-
-- Select :material-dots-vertical: > **Settings** > **Privacy**
-- [ ] Turn off **Show Calls in Recents**
-
-## Signal Hardening
-
-### Avoid Device Linking
-
-While it may be tempting to link your Signal account to your desktop device for convenience, keep in mind that this extends your trust to an additional and potentially less secure operating system.
-
-If your threat model calls for it, avoid linking your Signal account to a desktop device to reduce your attack surface.
-
-### Endpoint Security
-
-Signal takes security very seriously, however there is only so much an app can do to protect you.
-
-It is very important to take device security on both ends into account to ensure that your conversations are kept private.
-
-We recommend an up-to-date [GrapheneOS](../android.md#grapheneos) or iOS device.
-
-### Molly (Android)
-
-On Android you can consider using **Molly**, a fork of the Signal mobile client which aims to provide extensive hardening and anti-forensic features.
-
-!!! recommendation
-
-    ![Molly logo](../assets/img/messengers/molly.svg){ align=right }
-
-    **Molly** is an independent Signal fork which offers additional security features, including locking the app at rest, securely shredding unused RAM data, routing via Tor, and more.
-
-    [:octicons-home-16: Homepage](https://molly.im/){ .md-button .md-button--primary }
-    [:octicons-eye-16:](https://signal.org/legal/#privacy-policy){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://github.com/mollyim/mollyim-android/wiki){ .card-link title=Documentation}
-    [:octicons-code-16:](https://github.com/mollyim/mollyim-android){ .card-link title="Source Code" }
-    [:octicons-heart-16:](https://opencollective.com/mollyim){ .card-link title=Contribute }
-
-    ??? downloads
-
-         - [:simple-github: GitHub](https://github.com/mollyim/mollyim-android/releases)
-
-Molly offers two variants of the app: **Molly** and **Molly-FOSS**.
-
-The former is identical to Signal with the addition of Molly's improvements and security features. The latter, Molly-FOSS, removes Google's proprietary code, which is used for some key features (e.g., [FCM](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging) and Google Maps integration), in an effort to make it fully open-source.
-
-A comparison of the two versions is available in the [project's repository](https://github.com/mollyim/mollyim-android#readme).
-
-Both versions of Molly support [reproducible builds](https://github.com/mollyim/mollyim-android/tree/main/reproducible-builds), meaning it's possible to confirm that the compiled APKs match the source code.
-
-#### Features
-
-Molly has implemented database encryption at rest, which means that you can encrypt the app's database with a passphrase to ensure that none of its data is accessible without it.
-
-!!! note
-
-    As long as Molly is locked, you will not receive notifications for any incoming messages or calls until you unlock it again.
-
-Once enabled, a configurable lock timer can be set, after which point Molly will lock itself if you haven't unlocked your device for that specific time period. Alternatively, you can manually lock the app whenever you want.
-
-For the database encryption feature to be useful, two conditions must be met:
-
-1. Molly has to be locked at the time an attacker gains access to the device. This can include a physical attack in which the attacker seizes your device and manages to unlock the device itself, or a remote attack, in which the device is compromised and manages to elevate privileges to root.
-1. If you become aware that your device has been compromised, you should not unlock Molly's database.
-
-If both of the above conditions are met, the data within Molly is safe as long as the passphrase is not accessible to the attacker.
-
-To supplement the database encryption feature, Molly securely wipes your device's RAM once the database is locked to defend against forensic analysis.
-
-While Molly is running, your data is kept in RAM. When any app closes, its data remains in RAM until another app takes the same physical memory pages. That can take seconds or days, depending on many factors. To prevent anyone from dumping the RAM to disk and extracting your data after Molly is locked, the app overrides all free RAM memory with random data when you lock the database.
-
-There is also the ability to configure a SOCKS proxy in Molly to route its traffic through the proxy or [Tor via Orbot](../tor.md#orbot). When enabled, all traffic is routed through the proxy and there are no known IP or DNS leaks. When using this feature, [call relaying](#call-relaying) will always be enabled, regardless of the setting.
-
-Signal adds everyone who you have communicated with to its database. Molly allows you to delete those contacts and stop sharing your profile with them.
-
-To supplement the feature above, as well as for additional security and to fight spam, Molly offers the ability to block unknown contacts that you've never been in contact with or those that are not in your contact list without you having to manually block them.
-
-You can find a full list of Molly's [features](https://github.com/mollyim/mollyim-android#features) on the project's repository.
-
-#### Caveats
-
-- Molly does not support SMS messages within the app, unlike the official Signal app.
-- Molly removes Signal's MobileCoin integration.
-- Molly is updated every two weeks to include the latest features and bug fixes from Signal. The exception is security issues, which are patched as soon as possible. That said, you should be aware that there might be a slight delay compared to upstream.
-- By using Molly, you are extending your trust to another party, as you now need to trust the Signal team, as well as the Molly team.

docs/tools.en.md

@@ -68,7 +68,7 @@ For more details about each project, why they were chosen, and additional tips o
 
 ## Operating Systems
 
-### Android
+### Mobile
 
 <div class="grid cards" markdown>
 
@@ -79,7 +79,7 @@ For more details about each project, why they were chosen, and additional tips o
 
 [Learn more :material-arrow-right-drop-circle:](android.md)
 
-### Android Apps
+#### Android Apps
 
 <div class="grid cards" markdown>
 
@@ -93,24 +93,22 @@ For more details about each project, why they were chosen, and additional tips o
 
 [Learn more :material-arrow-right-drop-circle:](android.md#general-apps)
 
-### Linux
+### Desktop/PC
 
-<div class="grid cards annotate" markdown>
+<div class="grid cards" markdown>
 
-- ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](linux-desktop.md#fedora-workstation)
-- ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](linux-desktop.md#opensuse-tumbleweed)
-- ![Arch logo](assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](linux-desktop.md#arch-linux)
-- ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](linux-desktop.md#fedora-silverblue)
-- ![nixOS logo](assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](linux-desktop.md#nixos)
-- ![Whonix logo](assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](linux-desktop.md#whonix)
-- ![Tails logo](assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](linux-desktop.md#tails)
-- ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)](qubes.md) (1)
+- ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)](desktop.md#qubes-os)
+- ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](desktop.md#fedora-workstation)
+- ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](desktop.md#opensuse-tumbleweed)
+- ![Arch logo](assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](desktop.md#arch-linux)
+- ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](desktop.md#fedora-silverblue)
+- ![nixOS logo](assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](desktop.md#nixos)
+- ![Whonix logo](assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](desktop.md#whonix)
+- ![Tails logo](assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](desktop.md#tails)
 
 </div>
 
-1. Qubes uses Xen to provide strong sandboxing between multiple Linux virtual machine installations, and can run most Linux applications. [Learn more about Qubes...](qubes.md)
-
-[Learn more :material-arrow-right-drop-circle:](linux-desktop.md)
+[Learn more :material-arrow-right-drop-circle:](desktop.md)
 
 ### Router Firmware
 
@@ -244,7 +242,6 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
 <div class="grid cards" markdown>
 
 - ![Tutanota logo](assets/img/calendar-contacts/tutanota.svg){ .twemoji } [Tutanota](calendar-contacts.md#tutanota)
-- ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ .twemoji } [EteSync](calendar-contacts.md#etesync)
 - ![Proton Calendar logo](assets/img/calendar-contacts/proton-calendar.svg){ .twemoji } [Proton Calendar](calendar-contacts.md#proton-calendar)
 
 </div>
@@ -379,7 +376,6 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
 
 <div class="grid cards" markdown>
 
-- ![EteSync Notes logo](assets/img/notebooks/etesync-notes.png){ .twemoji } [EteSync Notes](notebooks.md#etesync-notes)
 - ![Joplin logo](assets/img/notebooks/joplin.svg){ .twemoji } [Joplin](notebooks.md#joplin)
 - ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ .twemoji } [Standard Notes](notebooks.md#standard-notes)
 - ![Org-mode logo](assets/img/notebooks/org-mode.svg){ .twemoji } [Org-mode](notebooks.md#org-mode)
@@ -425,6 +421,7 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
 - ![Element logo](assets/img/messengers/element.svg){ .twemoji } [Element](real-time-communication.md#element)
 - ![Session logo](assets/img/messengers/session.svg){ .twemoji } [Session](real-time-communication.md#session)
 - ![Briar logo](assets/img/messengers/briar.svg){ .twemoji } [Briar (Android)](real-time-communication.md#briar-android)
+- ![SimpleX Chat logo](assets/img/messengers/simplex.svg){ .twemoji } [SimpleX Chat](real-time-communication.md#simplex-chat)
 
 </div>
 

docs/tor.en.md

@@ -21,11 +21,11 @@ Tor works by routing your internet traffic through those volunteer-operated serv
   <figcaption>Tor circuit pathway - Nodes in the path can only see the servers they are directly connected to, for example the "Entry" node shown can see your IP address, and the address of the "Middle" node, but has no way to see which website you are visiting.</figcaption>
 </figure>
 
-- [More information about how Tor works :material-arrow-right-drop-circle:](basics/tor-overview.md)
+- [More information about how Tor works :material-arrow-right-drop-circle:](advanced/tor-overview.md)
 
 ## Connecting to Tor
 
-There are a variety of ways to connect to the Tor network from your device, the most commonly used being the **Tor Browser**, a fork of Firefox designed for anonymous browsing for desktop computers and Android. In addition to the apps listed below, there are also operating systems designed specifically to connect to the Tor network such as [Whonix](linux-desktop.md/#whonix) on [Qubes OS](qubes.md), which provide even greater security and protections than the standard Tor Browser.
+There are a variety of ways to connect to the Tor network from your device, the most commonly used being the **Tor Browser**, a fork of Firefox designed for anonymous browsing for desktop computers and Android. In addition to the apps listed below, there are also operating systems designed specifically to connect to the Tor network such as [Whonix](desktop.md#whonix) on [Qubes OS](desktop.md#qubes-os), which provide even greater security and protections than the standard Tor Browser.
 
 ### Tor Browser
 
@@ -54,7 +54,7 @@ There are a variety of ways to connect to the Tor network from your device, the
 
 !!! danger
 
-    You should **never** install any additional extensions on Tor Browser, including the ones we suggest for Firefox. Nor should you manually enable HTTPS-only mode or edit `about:config` settings. Browser extensions and non-standard settings make you stand out from others on the Tor network, thus making your browser easier to [fingerprint](https://support.torproject.org/glossary/browser-fingerprinting).
+    You should **never** install any additional extensions on Tor Browser or edit `about:config` settings, including the ones we suggest for Firefox. Browser extensions and non-standard settings make you stand out from others on the Tor network, thus making your browser easier to [fingerprint](https://support.torproject.org/glossary/browser-fingerprinting).
 
 The Tor Browser is designed to prevent fingerprinting, or identifying you based on your browser configuration. Therefore, it is imperative that you do **not** modify the browser beyond the default [security levels](https://tb-manual.torproject.org/security-settings/).
 

docs/vpn.en.md

@@ -13,7 +13,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
     If you're looking for added **security**, you should always ensure you're connecting to websites using HTTPS. A VPN is not a replacement for good security practices.
 
-    [Download Tor](https://www.torproject.org/){ .md-button .md-button--primary } [Tor Myths & FAQ](basics/tor-overview.md){ .md-button }
+    [Download Tor](https://www.torproject.org/){ .md-button .md-button--primary } [Tor Myths & FAQ](advanced/tor-overview.md){ .md-button }
 
 ??? question "When are VPNs useful?"
 
@@ -48,9 +48,9 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
         - [:simple-windows11: Windows](https://protonvpn.com/download-windows)
         - [:simple-linux: Linux](https://protonvpn.com/support/linux-vpn-setup/)
 
-??? check annotate "64 Countries"
+??? check annotate "67 Countries"
 
-    Proton VPN has [servers in 64 countries](https://protonvpn.com/vpn-servers) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
+    Proton VPN has [servers in 67 countries](https://protonvpn.com/vpn-servers) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
 
     We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
 
@@ -80,12 +80,16 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 ??? check "Mobile Clients"
 
-    In addition to providing standard OpenVPN configuration files, Proton VPN has mobile clients for [App Store](https://apps.apple.com/us/app/protonvpn-fast-secure-vpn/id1437005085) and [Google Play](https://play.google.com/store/apps/details?id=ch.protonvpn.android&hl=en_US) allowing for easy connections to their servers. The mobile client on Android is also available in [F-Droid](https://f-droid.org/en/packages/ch.protonvpn.android), which ensures that it is compiled with [reproducible builds](https://www.f-droid.org/en/2019/05/05/trust-privacy-and-free-software.html).
+    In addition to providing standard OpenVPN configuration files, Proton VPN has mobile clients for [App Store](https://apps.apple.com/us/app/protonvpn-fast-secure-vpn/id1437005085), [Google Play](https://play.google.com/store/apps/details?id=ch.protonvpn.android&hl=en_US), and [GitHub](https://github.com/ProtonVPN/android-app/releases) allowing for easy connections to their servers.
 
 ??? info "Additional Functionality"
 
     Proton VPN clients support two factor authentication on all platforms except Linux at the moment. Proton VPN has their own servers and datacenters in Switzerland, Iceland and Sweden. They offer adblocking and known malware domains blocking with their DNS service. Additionally, Proton VPN also offers "Tor" servers allowing you to easily connect to onion sites, but we still strongly recommend using [the official Tor Browser](https://www.torproject.org/) for this purpose.
 
+!!! danger "Killswitch feature is broken on Intel-based Macs"
+
+    System crashes [may occur](https://protonvpn.com/support/macos-t2-chip-kill-switch/) on Intel-based Macs when using the VPN killswitch. If you require this feature, and you are using a Mac with Intel chipset, you should consider using another VPN service.
+
 ### IVPN
 
 !!! recommendation
@@ -101,16 +105,15 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
     ??? downloads
     
-        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=net.ivpn.client)
-        - [:simple-appstore: App Store](https://apps.apple.com/us/app/ivpn-serious-privacy-protection/id1193122683)
-        - [:simple-github: GitHub](https://github.com/ivpn/android-app/releases)
+        - [:simple-android: Android](https://www.ivpn.net/apps-android/)
+        - [:simple-appstore: App Store](https://apps.apple.com/app/ivpn-serious-privacy-protection/id1193122683)
         - [:simple-windows11: Windows](https://www.ivpn.net/apps-windows/)
         - [:simple-apple: macOS](https://www.ivpn.net/apps-macos/)
         - [:simple-linux: Linux](https://www.ivpn.net/apps-linux/)
 
-??? check annotate "34 Countries"
+??? check annotate "35 Countries"
 
-    IVPN has [servers in 34 countries](https://www.ivpn.net/server-locations) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
+    IVPN has [servers in 35 countries](https://www.ivpn.net/server-locations) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
 
     We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
 
@@ -140,7 +143,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 ??? check "Mobile Clients"
 
-    In addition to providing standard OpenVPN configuration files, IVPN has mobile clients for [App Store](https://apps.apple.com/us/app/ivpn-serious-privacy-protection/id1193122683) and [Google Play](https://play.google.com/store/apps/details?id=net.ivpn.client) allowing for easy connections to their servers. The mobile client on Android is also available in [F-Droid](https://f-droid.org/en/packages/net.ivpn.client), which ensures that it is compiled with [reproducible builds](https://www.f-droid.org/en/2019/05/05/trust-privacy-and-free-software.html).
+    In addition to providing standard OpenVPN configuration files, IVPN has mobile clients for [App Store](https://apps.apple.com/us/app/ivpn-serious-privacy-protection/id1193122683), [Google Play](https://play.google.com/store/apps/details?id=net.ivpn.client), and [GitHub](https://github.com/ivpn/android-app/releases) allowing for easy connections to their servers.
 
 ??? info "Additional Functionality"
 
@@ -169,9 +172,9 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
         - [:simple-apple: macOS](https://mullvad.net/en/download/macos/)
         - [:simple-linux: Linux](https://mullvad.net/en/download/linux/)
 
-??? check annotate "39 Countries"
+??? check annotate "40 Countries"
 
-    Mullvad has [servers in 39 countries](https://mullvad.net/servers/) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
+    Mullvad has [servers in 40 countries](https://mullvad.net/servers/) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
 
     We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
 
@@ -213,7 +216,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 ??? check "Mobile Clients"
 
-    Mullvad has published [App Store](https://apps.apple.com/app/mullvad-vpn/id1488466513) and [Google Play](https://play.google.com/store/apps/details?id=net.mullvad.mullvadvpn) clients, both supporting an easy-to-use interface as opposed to requiring you to manually configure your WireGuard connection. The mobile client on Android is also available in [F-Droid](https://f-droid.org/packages/net.mullvad.mullvadvpn), which ensures that it is compiled with [reproducible builds](https://www.f-droid.org/en/2019/05/05/trust-privacy-and-free-software.html).
+    Mullvad has published [App Store](https://apps.apple.com/app/mullvad-vpn/id1488466513) and [Google Play](https://play.google.com/store/apps/details?id=net.mullvad.mullvadvpn) clients, both supporting an easy-to-use interface as opposed to requiring you to manually configure your WireGuard connection. The Android client is also available on [GitHub](https://github.com/mullvad/mullvadvpn-app/releases).
 
 ??? info "Additional Functionality"
 

includes/abbreviations.en.md

@@ -3,10 +3,13 @@
 *[ADB]: Android Debug Bridge
 *[AOSP]: Android Open Source Project
 *[ATA]: Advanced Technology Attachment
+*[attack surface]: The total number of possible entry points for unauthorized access to a system
 *[AVB]: Android Verified Boot
+*[cgroups]: Control Groups
 *[CLI]: Command Line Interface
 *[CSV]: Comma-Separated Values
 *[CVE]: Common Vulnerabilities and Exposures
+*[Digital Legacy]: Digital Legacy refers to features that allow you to give other people access to your data when you die
 *[DNSSEC]: Domain Name System Security Extensions
 *[DNS]: Domain Name System
 *[DoH]: DNS over HTTPS
@@ -16,11 +19,13 @@
 *[E2EE]: End-to-End Encryption/Encrypted
 *[ECS]: EDNS Client Subnet
 *[EEA]: European Economic Area
+*[entropy]: A measurement of how unpredictable something is
 *[EOL]: End-of-Life
 *[Exif]: Exchangeable image file format
 *[FCM]: Firebase Cloud Messaging
 *[FDE]: Full Disk Encryption
 *[FIDO]: Fast IDentity Online
+*[fork]: A new software project created by copying an existing project and adding to it independently
 *[GDPR]: General Data Protection Regulation
 *[GPG]: GNU Privacy Guard (PGP implementation)
 *[GPS]: Global Positioning System
@@ -30,6 +35,7 @@
 *[HOTP]: HMAC (Hash-based Message Authentication Code) based One-Time Password
 *[HTTPS]: Hypertext Transfer Protocol Secure
 *[HTTP]: Hypertext Transfer Protocol
+*[hypervisor]: Computer software, firmware, or hardware that splits the resources of a CPU among multiple operating systems
 *[ICCID]: Integrated Circuit Card Identifier
 *[IMAP]: Internet Message Access Protocol
 *[IMEI]: International Mobile Equipment Identity
@@ -60,6 +66,7 @@
 *[PGP]: Pretty Good Privacy (see OpenPGP)
 *[PII]: Personally Identifiable Information
 *[QNAME]: Qualified Name
+*[rolling release]: Updates which are released frequently rather than set intervals
 *[RSS]: Really Simple Syndication
 *[SELinux]: Security-Enhanced Linux
 *[SIM]: Subscriber Identity Module
@@ -71,9 +78,11 @@
 *[SUID]: Set Owner User ID
 *[SaaS]: Software as a Service (cloud software)
 *[SoC]: System on Chip
+*[SSO]: Single sign-on
 *[TCP]: Transmission Control Protocol
 *[TEE]: Trusted Execution Environment
 *[TLS]: Transport Layer Security
+*[ToS]: Terms of Service
 *[TOTP]: Time-based One-Time Password
 *[TPM]: Trusted Platform Module
 *[U2F]: Universal 2nd Factor
@@ -83,11 +92,4 @@
 *[VoIP]: Voice over IP (Internet Protocol)
 *[W3C]: World Wide Web Consortium
 *[XMPP]: Extensible Messaging and Presence Protocol
-*[attack surface]: The attack surface of software or hardware is the sum of the different places an attacker can try to enter data to or extract data from.
-*[cgroups]: Control Groups
-*[fork]: In software development, a fork is created when developers take a copy of source code from one software package and start independent development on it, creating a distinct and separate piece of software.
-*[hypervisor]: A hypervisor is computer software, firmware, or hardware that allows partitioning the resource of a CPU among multiple operating systems or independent programs.
-*[rolling release]: An update release cycle in which updates are released very frequently, instead of at set intervals.
-*[walled garden]: A walled garden (or closed platform) is one in which the service provider has control over applications, content, and/or media, and restricts convenient access to non-approved applicants or content.
-*[entropy]: Password entropy is a measurement of how unpredictable a password is.
-*[PWA]: Progressive Web App
+*[PWA]: Progressive Web App

mkdocs.production.yml

@@ -1,24 +1,21 @@
 INHERIT: mkdocs.yml
 plugins:
+  meta: {}
   privacy:
-    externals_exclude:
+    external_assets_exclude:
       - cdn.jsdelivr.net/npm/mathjax@3/*
       - api.privacyguides.net/*
       - giscus.app/*
   git-committers:
+    enabled: !ENV [PRODUCTION, false]
     repository: privacyguides/privacyguides.org
     branch: main
   git-revision-date-localized:
-      exclude:
-        - index.en.md
-  rss:
-    match_path: "blog/.*"
-    pretty_print: true
-    date_from_meta:
-      as_creation: "created"
-      datetime_format: "%Y-%m-%d"
+    enabled: !ENV [PRODUCTION, false]
+    exclude:
+      - index.en.md
   social:
-    cards: !ENV [CARDS, false]
+    cards: !ENV [PRODUCTION, false]
     cards_color:
       fill: "#FFD06F"
       text: "#2d2d2d"
@@ -47,7 +44,9 @@ theme:
     - navigation.tracking
     - navigation.tabs
     - navigation.sections
+    - navigation.expand
     - content.tooltips
+    - search.highlight
   palette:
     - media: "(prefers-color-scheme)"
       scheme: default
@@ -72,4 +71,3 @@ watch:
   - theme
   - includes
   - mkdocs.yml
-  - data

mkdocs.yml

@@ -12,18 +12,15 @@ copyright: |
 
 extra:
   social:
+    - icon: simple/mastodon
+      link: https://mastodon.neat.computer/@privacyguides
+      name: Mastodon
     - icon: simple/matrix
       link: https://matrix.to/#/#privacyguides:matrix.org
       name: Matrix
     - icon: simple/discourse
       link: https://discuss.privacyguides.org/
       name: Forum
-    - icon: simple/mastodon
-      link: https://mastodon.social/@privacyguides
-      name: Mastodon
-    - icon: simple/twitter
-      link: https://twitter.com/privacy_guides
-      name: Twitter
     - icon: simple/github
       link: https://github.com/privacyguides
       name: GitHub
@@ -62,6 +59,7 @@ watch:
 plugins:
   i18n:
     default_language: en
+    default_language_only: true
     material_alternate: true
     languages:
       en:
@@ -69,10 +67,7 @@ plugins:
         build: false
   tags: {}
   search: {}
-  macros:
-    on_error_fail: true
-    include_yaml:
-      - data/articles.yml
+  macros: {}
 
 markdown_extensions:
   admonition: {}
@@ -122,29 +117,25 @@ extra_javascript:
 nav:
   - Home: 'index.md'
   - 'Knowledge Base':
-    - 'The Basics':
-      - 'basics/threat-modeling.md'
-      - 'basics/common-threats.md'
+    - 'basics/threat-modeling.md'
+    - 'basics/common-threats.md'
+    - 'basics/common-misconceptions.md'
+    - 'basics/account-creation.md'
+    - 'basics/account-deletion.md'
+    - 'Technology Essentials':
       - 'basics/passwords-overview.md'
       - 'basics/multi-factor-authentication.md'
-      - 'basics/account-deletion.md'
       - 'basics/email-security.md'
       - 'basics/vpn-overview.md'
-      - 'basics/tor-overview.md'
-      - 'basics/dns-overview.md'
-    - 'Android':
-      - 'android/overview.md'
-      - 'android/grapheneos-vs-calyxos.md'
-    - 'Linux':
-      - 'linux-desktop/overview.md'
-      - 'linux-desktop/hardening.md'
-      - 'linux-desktop/sandboxing.md'
-    - 'Real-Time Communication':
-      - 'real-time-communication/communication-network-types.md'
-      - 'real-time-communication/signal-configuration-hardening.md'
-    - 'Advanced':
-      - 'advanced/integrating-metadata-removal.md'
-      - 'advanced/erasing-data.md'
+    - 'Operating Systems':
+      - 'os/android-overview.md'
+      - 'os/linux-overview.md'
+      - 'os/qubes-overview.md'
+    - 'Advanced Topics':
+      - 'advanced/dns-overview.md'
+      - 'advanced/tor-overview.md'
+      - 'advanced/communication-network-types.md'
+    - kb-archive.md
   - 'Recommendations':
     - 'tools.md'
     - 'Internet Browsing':
@@ -153,8 +144,7 @@ nav:
       - 'mobile-browsers.md'
     - 'Operating Systems':
       - 'android.md'
-      - 'linux-desktop.md'
-      - 'qubes.md'
+      - 'desktop.md'
       - 'router.md'
     - 'Providers':
       - 'cloud.md'
@@ -177,14 +167,23 @@ nav:
       - 'real-time-communication.md'
       - 'video-streaming.md'
   - 'About':
-    - 'about.md'
-    - 'coc.md'
-    - 'about/donate.md'
-    - 'Online Services': 'https://privacyguides.net'
-    - 'about/privacytools.md'
-    - 'Website Statistics': 'https://stats.privacyguides.net/privacyguides.org'
+    - 'about/index.md'
+    - 'about/criteria.md'
+    - 'about/statistics.md'
     - 'about/notices.md'
     - 'about/privacy-policy.md'
-  - 'Donate': '/about/donate/'
+    - 'Community':
+      - 'about/donate.md'
+      - 'Online Services': 'about/services.md'
+      - 'Code of Conduct': 'CODE_OF_CONDUCT.md'
+      - 'about/privacytools.md'
+    - 'Contributing':
+      - 'Writing Guides':
+        - 'meta/writing-style.md'
+        - 'meta/brand.md'
+      - 'Technical Guides':
+        - 'meta/uploading-images.md'
+        - 'meta/git-recommendations.md'
+  - 'Changelog': 'https://github.com/privacyguides/privacyguides.org/releases'
   - 'Forum': 'https://discuss.privacyguides.org/'
-  - 'Blog': 'https://discuss.privacyguides.org/c/blog/10'
+  - 'Blog': 'https://blog.privacyguides.org/'

netlify.toml

@@ -0,0 +1,228 @@
+[build]
+    publish = "site/"
+    command = "mkdocs build --config-file mkdocs.production.yml"
+
+[context.production.environment]
+    PRODUCTION = "true"
+
+[[redirects]]
+    from = "/.well-known/matrix/*"
+    to = "https://matrix.privacyguides.org/.well-known/matrix/:splat"
+    status = 200
+    force = true
+
+[[redirects]]
+    from = "/kb"
+    to = "/basics/threat-modeling/"
+
+[[redirects]]
+    from = "/coc"
+    to = "/CODE_OF_CONDUCT/"
+
+[[redirects]]
+    from = "/team"
+    to = "/about/"
+
+[[redirects]]
+    from = "/browsers"
+    to = "/desktop-browsers/"
+
+[[redirects]]
+    from = "/blog"
+    to = "https://blog.privacyguides.org"
+
+[[redirects]]
+    from = "/blog/2021/12/01/firefox-privacy-2021-update"
+    to = "https://blog.privacyguides.org/2021/12/01/firefox-privacy-2021-update/"
+
+[[redirects]]
+    from = "/blog/2021/09/14/welcome-to-privacy-guides"
+    to = "https://blog.privacyguides.org/2021/09/14/welcome-to-privacy-guides/"
+
+[[redirects]]
+    from = "/blog/2022/06/09/hide-nothing"
+    to = "https://blog.privacyguides.org/2022/06/09/hide-nothing/"
+
+[[redirects]]
+    from = "/blog/2022/04/04/move-fast-and-break-things"
+    to = "https://blog.privacyguides.org/2022/04/04/move-fast-and-break-things/"
+
+[[redirects]]
+    from = "/blog/2021/11/01/virtual-insanity"
+    to = "https://blog.privacyguides.org/2021/11/01/virtual-insanity"
+
+[[redirects]]
+    from = "/basics/dns-overview"
+    to = "/advanced/dns-overview/"
+
+[[redirects]]
+    from = "/basics/tor-overview"
+    to = "/advanced/tor-overview/"
+
+[[redirects]]
+    from = "/real-time-communication/communication-network-types"
+    to = "/advanced/communication-network-types"
+
+[[redirects]]
+    from = "/advanced/real-time-communication"
+    to = "/advanced/communication-network-types"
+
+[[redirects]]
+    from = "/android/overview"
+    to = "/os/android-overview/"
+
+[[redirects]]
+    from = "/linux-desktop/overview"
+    to = "/os/linux-overview/"
+
+[[redirects]]
+    from = "/android/grapheneos-vs-calyxos"
+    to = "https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/"
+
+[[redirects]]
+    from = "/ios/configuration"
+    to = "https://blog.privacyguides.org/2022/10/22/ios-configuration-guide/"
+
+[[redirects]]
+    from = "/linux-desktop/hardening"
+    to = "https://blog.privacyguides.org/2022/04/22/linux-system-hardening/"
+
+[[redirects]]
+    from = "/linux-desktop/sandboxing"
+    to = "https://blog.privacyguides.org/2022/04/22/linux-application-sandboxing/"
+
+[[redirects]]
+    from = "/advanced/signal-configuration-hardening"
+    to = "https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening/"
+
+[[redirects]]
+    from = "/real-time-communication/signal-configuration-hardening"
+    to = "https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening/"
+
+[[redirects]]
+    from = "/advanced/integrating-metadata-removal"
+    to = "https://blog.privacyguides.org/2022/04/09/integrating-metadata-removal/"
+
+[[redirects]]
+    from = "/advanced/erasing-data"
+    to = "https://blog.privacyguides.org/2022/05/25/secure-data-erasure/"
+
+[[redirects]]
+    from = "/providers/dns"
+    to = "/dns/"
+
+[[redirects]]
+    from = "/software/video-streaming"
+    to = "/video-streaming/"
+
+[[redirects]]
+    from = "/providers/vpn"
+    to = "/vpn/"
+
+[[redirects]]
+    from = "/operating-systems"
+    to = "/desktop/"
+
+[[redirects]]
+    from = "/providers/email"
+    to = "/email/"
+
+[[redirects]]
+    from = "/threat-modeling"
+    to = "/basics/threat-modeling/"
+
+[[redirects]]
+    from = "/software/passwords"
+    to = "/passwords/"
+
+[[redirects]]
+    from = "/self-contained-networks"
+    to = "/tor/"
+
+[[redirects]]
+    from = "/privacy-policy"
+    to = "/about/privacy-policy/"
+
+[[redirects]]
+    from = "/metadata-removal-tools"
+    to = "/data-redaction/"
+
+[[redirects]]
+    from = "/basics"
+    to = "/kb"
+
+[[redirects]]
+    from = "/software/file-encryption"
+    to = "/encryption/"
+
+[[redirects]]
+    from = "/providers"
+    to = "/tools/#service-providers"
+
+[[redirects]]
+    from = "/software/notebooks"
+    to = "/notebooks/"
+
+[[redirects]]
+    from = "/software/calendar-contacts"
+    to = "/calendar-contacts/"
+
+[[redirects]]
+    from = "/software/metadata-removal-tools"
+    to = "/data-redaction/"
+
+[[redirects]]
+    from = "/contact"
+    to = "/about/"
+
+[[redirects]]
+    from = "/welcome-to-privacy-guides"
+    to = "https://blog.privacyguides.org/2021/09/14/welcome-to-privacy-guides/"
+
+[[redirects]]
+    from = "/software/email"
+    to = "/email-clients/"
+
+[[redirects]]
+    from = "/providers/paste"
+    to = "/tools/"
+
+[[redirects]]
+    from = "/providers/search-engines"
+    to = "/search-engines/"
+
+[[redirects]]
+    from = "/software/productivity"
+    to = "/productivity/"
+
+[[redirects]]
+    from = "/software/real-time-communication"
+    to = "/real-time-communication/"
+
+[[redirects]]
+    from = "/blog/2019/10/05/understanding-vpns"
+    to = "https://www.jonaharagon.com/posts/understanding-vpns/"
+
+[[redirects]]
+    from = "/terms-and-notices"
+    to = "/about/notices/"
+
+[[redirects]]
+    from = "/software/file-sharing"
+    to = "/file-sharing/"
+
+[[redirects]]
+    from = "/software/networks"
+    to = "/tor/"
+
+[[redirects]]
+    from = "/social-news-aggregator"
+    to = "/news-aggregators/"
+
+[[redirects]]
+    from = "/basics/erasing-data"
+    to = "https://blog.privacyguides.org/2022/05/25/secure-data-erasure/"
+
+[[redirects]]
+    from = "/linux-desktop"
+    to = "/desktop/"

theme/overrides/blog.en.html

@@ -1,88 +0,0 @@
-{% extends "base.html" %}
-{% block extrahead %}
-  <link rel="preload" href="{{ 'assets/brand/WOFF/bagnard/Bagnard.woff' | url }}" as="font" type="font/woff" crossorigin>
-  <link rel="stylesheet" href="{{ 'assets/stylesheets/blog.css' | url }}">
-  <meta property="og:title" content='{{ page.meta.title }}' />
-  <meta property="og:type" content='article' />
-  <meta property="og:url" content='{{ page.canonical_url }}' />
-  <meta property="og:image" content='https://www.privacyguides.org/{{ page.meta.image }}' />
-  <meta property="og:site_name" content='Privacy Guides' />
-  <meta name="twitter:creator" content='@privacy_guides' />
-  <meta name="twitter:site" content='@privacy_guides' />
-{% endblock %}
-{% block tabs %}
-  {{ super() }}
-  <style>.md-content > .md-typeset h1{visibility:hidden;font-size:0;}</style>
-  <section class="mdx-container">
-    <div class="md-grid md-typeset">
-      <div class="mdx-hero">
-        <div class="mdx-hero__content">
-          <h1>{{ page.meta.title }}</h1>
-          <p>{{ page.meta.created }} | {{ page.meta.author }}</p>
-        </div>
-      </div>
-    </div>
-  </section>
-{% endblock %}
-{% block content %}
-  {% if page.meta.image %}
-    <img src="{{ page.meta.image | url }}"> 
-  {% endif %}
-  <a href="{{ '/feed_rss_created.xml' | url }}" title="Open RSS Feed" class="md-content__button md-icon">
-    {% include ".icons/material/rss.svg" %}
-  </a>
-  {% if "tags" in config.plugins %}
-    {% include "partials/tags.html" %}
-  {% endif %}
-  {% if not "\x3ch1" in page.content %}
-    <h1>{{ page.title | d(config.site_name, true)}}</h1>
-  {% endif %}
-  {{ page.content }}
-
-  <!-- Giscus -->
-  <h2 id="__comments">{{ lang.t("meta.comments") }}</h2>
-  <script src="https://giscus.app/client.js"
-        data-repo="privacyguides/privacyguides.org"
-        data-repo-id="MDEwOlJlcG9zaXRvcnkzMTg0MDE5MDY="
-        data-category="Announcements"
-        data-category-id="DIC_kwDOEvptcs4COX5p"
-        data-mapping="og:title"
-        data-reactions-enabled="1"
-        data-emit-metadata="0"
-        data-input-position="top"
-        data-theme="light"
-        data-lang="en"
-        crossorigin="anonymous"
-        async>
-  </script>
-
-  <!-- Reload on palette change -->
-  <script>
-    var palette = __md_get("__palette")
-    if (palette && typeof palette.color === "object")
-      if (palette.color.scheme === "slate") {
-        var giscus = document.querySelector("script[src*=giscus]")
-        giscus.setAttribute("data-theme", "transparent_dark") 
-
-
-      }
-
-    /* Register event handlers after documented loaded */
-    document.addEventListener("DOMContentLoaded", function() {
-      var ref = document.querySelector("[data-md-component=palette]")
-      ref.addEventListener("change", function() {
-        var palette = __md_get("__palette")
-        if (palette && typeof palette.color === "object") {
-          var theme = palette.color.scheme === "slate" ? "transparent_dark" : "light"
-
-          /* Instruct Giscus to change theme */
-          var frame = document.querySelector(".giscus-frame")
-          frame.contentWindow.postMessage(
-            { giscus: { setConfig: { theme } } },
-            "https://giscus.app"
-          )
-        }
-      })
-    })
-  </script>
-{% endblock %}

theme/overrides/home.en.html

@@ -2,11 +2,6 @@
 {% block extrahead %}
   <link rel="preload" href="{{ 'assets/brand/WOFF/bagnard/Bagnard.woff' | url }}" as="font" type="font/woff" crossorigin>
   <link rel="stylesheet" href="{{ 'assets/stylesheets/home.css?v=2.10.0' | url }}">
-  <link rel="me" href="https://aragon.sh/@jonah">
-  <link rel="me" href="https://fosstodon.org/@freddy">
-  <link rel="me" href="https://mastodon.social/@dngray">
-  <link rel="me" href="https://mastodon.social/@blacklight447">
-  <link rel="me" href="https://fosstodon.org/@hook54321">
 {% endblock %}
 {% block tabs %}
   {{ super() }}
@@ -17,7 +12,7 @@
         <div class="mdx-hero__content">
           <h1>The guide to restoring your online privacy.</h1>
           <p>Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.</p>
-          <a href="basics/threat-modeling/" title="The first step of your privacy journey" class="md-button md-button--primary">
+          <a href="kb/" title="The first step of your privacy journey" class="md-button md-button--primary">
             Start Your Privacy Journey
           </a>
           <a href="tools/" title="Recommended privacy tools, services, and knowledge" class="md-button">

theme/partials/header.html

@@ -33,7 +33,7 @@
             {% include "partials/source.html" %}
         </div>
         {% endif %}
-        {% if "search" in config["plugins"] %}
+        {% if "material/search" in config.plugins %}
         <label class="md-header__button md-icon" for="__search">
             {% include ".icons/material/magnify.svg" %}
         </label>