Say OAuth instead of SSO (#2148)

Signed-off-by: Jonah Aragon <jonah@triplebit.net>

.github/workflows/release.yml

@@ -40,6 +40,10 @@ jobs:
           ssh-key: ${{ secrets.ACTIONS_SSH_KEY }}
           submodules: 'true'
       
+      - name: Push to production branch
+        run: |
+          git push origin HEAD:production
+      
       - name: Pages setup
         uses: actions/configure-pages@v3
 

Brewfile.preview.netlify

@@ -0,0 +1 @@
+brew "pngquant"

README.md

@@ -111,6 +111,8 @@ Translations downloaded from Crowdin are [.gitignore](/.gitignore)'d, so any loc
 
 ## Releasing
 
+It is required to create a GitHub release to publish the current site to privacyguides.org. The current `main` branch can be previewed at [https://main.staging.privacyguides.dev](https://main.staging.privacyguides.dev) prior to release.
+
 1. Create a new tag: `git tag -s v3.X.X -m 'Some message'`
     - [View existing tags](https://github.com/privacyguides/privacyguides.org/tags)
     - Tag [numbering](https://semver.org/): Increment the MINOR (2nd) number when making significant changes (adding/deleting pages, etc.), increment the PATCH (3rd) number when making minor changes (typos, bug fixes). Probably leave the MAJOR number at 3 until a massive revamp (v1 -> v2 was the Jekyll to MkDocs transition, v2 -> v3 was the introduction of translations).

_redirects

@@ -27,8 +27,8 @@
 
 /.well-known/matrix/* https://matrix.privacyguides.org/.well-known/matrix/:splat 200
 
-/kb /en/basics/threat-modeling/
-/:lang/kb /:lang/basics/threat-modeling/
+/kb /en/basics/why-privacy-matters/
+/:lang/kb /:lang/basics/why-privacy-matters/
 
 /coc /en/CODE_OF_CONDUCT/
 /license https://github.com/privacyguides/privacyguides.org/tree/main/README.md#license

config/mkdocs.en.yml

@@ -95,6 +95,7 @@ markdown_extensions:
 nav:
   - Home: 'index.md'
   - Knowledge Base:
+    - 'basics/why-privacy-matters.md'
     - 'basics/threat-modeling.md'
     - 'basics/common-threats.md'
     - 'basics/common-misconceptions.md'

config/mkdocs.es.yml

@@ -95,6 +95,7 @@ markdown_extensions:
 nav:
   - Inicio: 'index.md'
   - Base de conocimientos:
+    - 'basics/why-privacy-matters.md'
     - 'basics/threat-modeling.md'
     - 'basics/common-threats.md'
     - 'basics/common-misconceptions.md'

config/mkdocs.fr.yml

@@ -95,6 +95,7 @@ markdown_extensions:
 nav:
   - Accueil: 'index.md'
   - Base de connaissances:
+    - 'basics/why-privacy-matters.md'
     - 'basics/threat-modeling.md'
     - 'basics/common-threats.md'
     - 'basics/common-misconceptions.md'

config/mkdocs.he.yml

@@ -99,6 +99,7 @@ markdown_extensions:
 nav:
   - "דף הבית": 'index.md'
   - "ידע בסיסי":
+    - 'basics/why-privacy-matters.md'
     - 'basics/threat-modeling.md'
     - 'basics/common-threats.md'
     - 'basics/common-misconceptions.md'

config/mkdocs.nl.yml

@@ -95,6 +95,7 @@ markdown_extensions:
 nav:
   - Home: 'index.md'
   - Kennisbank:
+    - 'basics/why-privacy-matters.md'
     - 'basics/threat-modeling.md'
     - 'basics/common-threats.md'
     - 'basics/common-misconceptions.md'

config/mkdocs.offline.yml

@@ -84,6 +84,7 @@ markdown_extensions:
 nav:
   - Home: 'index.md'
   - Knowledge Base:
+    - 'basics/why-privacy-matters.md'
     - 'basics/threat-modeling.md'
     - 'basics/common-threats.md'
     - 'basics/common-misconceptions.md'

docs/about/index.md

@@ -58,6 +58,7 @@ So far in 2023 we've launched international translations of our website in [Fren
     - [:simple-discourse: Discourse](https://discuss.privacyguides.net/u/Niek-de-Wilde)
     - [:simple-github: GitHub](https://github.com/blacklight447 "@blacklight447")
     - [:simple-mastodon: Mastodon](https://mastodon.social/@blacklight447 "@blacklight447@mastodon.social"){rel=me}
+    - [:fontawesome-solid-envelope: Email](mailto:niekdewilde@privacyguides.org)
 
 ??? person "@dngray"
 

docs/android.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Android Recommendations: GrapheneOS and DivestOS - Privacy Guides"
 title: "Android"
 icon: 'simple/android'
 description: You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives.
+cover: android.png
 schema:
   - 
     "@context": http://schema.org
@@ -89,8 +91,6 @@ These are the Android operating systems, devices, and apps we recommend to maxim
 
 [General Android Overview :material-arrow-right-drop-circle:](os/android-overview.md){ .md-button }
 
-[Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/){ .md-button }
-
 ## AOSP Derivatives
 
 We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.
@@ -120,6 +120,8 @@ GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandbox
 
 Google Pixel phones are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#device-support).
 
+[Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/){ .md-button }
+
 ### DivestOS
 
 !!! recommendation
@@ -208,10 +210,6 @@ We recommend a wide variety of Android apps throughout this site. The apps liste
     [:octicons-code-16:](https://gitea.angry.im/PeterCxy/Shelter){ .card-link title="Source Code" }
     [:octicons-heart-16:](https://www.patreon.com/PeterCxy){ .card-link title=Contribute }
 
-    ??? downloads
-
-        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=net.typeblog.shelter)
-
 !!! warning
 
     Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular/) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
@@ -225,7 +223,7 @@ We recommend a wide variety of Android apps throughout this site. The apps liste
     ![Auditor logo](assets/img/android/auditor.svg#only-light){ align=right }
     ![Auditor logo](assets/img/android/auditor-dark.svg#only-dark){ align=right }
 
-    **Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). Currently, it only works with GrapheneOS and the device's stock operating system.
+    **Auditor** is an app which leverages hardware security features to provide device integrity monitoring by actively validating the identity of a device and the integrity of its operating system. Currently, it only works with GrapheneOS or the stock operating system for [supported devices](https://attestation.app/about#device-support).
 
     [:octicons-home-16: Homepage](https://attestation.app){ .md-button .md-button--primary }
     [:octicons-eye-16:](https://attestation.app/privacy-policy){ .card-link title="Privacy Policy" }

docs/basics/account-creation.md

@@ -1,4 +1,5 @@
 ---
+meta_title: "How to Create Internet Accounts Privately - Privacy Guides"
 title: "Account Creation"
 icon: 'material/account-plus'
 description: Creating accounts online is practically an internet necessity, take these steps to make sure you stay private.
@@ -44,15 +45,11 @@ Should a service get hacked, you might start receiving phishing or spam emails t
 
 [Recommended email aliasing services](../email.md#email-aliasing-services){ .md-button }
 
-### Single sign-on
+### "Sign in with..." (OAuth)
 
-!!! note
-  
-    We are discussing Single sign-on for personal use, not enterprise users.
+OAuth is an authentication protocol that allows you to register for a service without sharing much information with the service provider, if any, by using an existing account you have with another service instead. Whenever you see something along the lines of "Sign in with *provider name*" on a registration form, it's typically using OAuth.
 
-Single sign-on (SSO) is an authentication method that allows you to register for a service without sharing much information, if any. Whenever you see something along the lines of "Sign-in with *provider name*" on a registration form it's SSO.
-
-When you choose single sign-on in a website, it will prompt your SSO provider login page and after that your account will be connected. Your password won't be shared but some basic information will (you can review it during the login request). This process is needed every time you want to log in to the same account.
+When you sign in with OAuth, it will open a login page with the provider you choose, and your existing account and new account will be connected. Your password won't be shared, but some basic information typically will (you can review it during the login request). This process is needed every time you want to log in to the same account.
 
 The main advantages are:
 
@@ -61,12 +58,12 @@ The main advantages are:
 
 But there are disadvantages:
 
-- **Privacy**: a SSO provider will know the services you use.
-- **Centralization**: if your SSO account gets compromised or you aren't able to login to it, all other accounts connected to it are affected.
+- **Privacy**: the OAuth provider you log in with will know the services you use.
+- **Centralization**: if the account you use for OAuth is compromised or you aren't able to login to it, all other accounts connected to it are affected.
 
-SSO can be especially useful in those situations where you could benefit from deeper integration between services. For example, one of those services may offer SSO for the others. Our recommendation is to limit SSO to only where you need it and protect the main account with [MFA](multi-factor-authentication.md).
+OAuth authentication can be especially useful in those situations where you could benefit from deeper integration between services. Our recommendation is to limit using OAuth to only where you need it, and always protect the main account with [MFA](multi-factor-authentication.md).
 
-All services that use SSO will be as secure as your SSO account. For example, if you want to secure an account with a hardware key but that service doesn't support hardware keys, you can secure your SSO account with a hardware key and now you essentially have hardware MFA on all your accounts. It is worth noting though that weak authentication on your SSO account means that any account tied to that login will also be weak.
+All the services that use OAuth will be as secure as your underlying provider's account. For example, if you want to secure an account with a hardware key, but that service doesn't support hardware keys, you can secure the account you use with OAuth with a hardware key instead, and now you essentially have hardware MFA on all your accounts. It is worth noting though that weak authentication on your OAuth provider account means that any account tied to that login will also be weak.
 
 ### Phone number
 

docs/basics/email-security.md

@@ -1,4 +1,5 @@
 ---
+meta_title: "Why Email Isn't the Best Choice for Privacy and Security - Privacy Guides"
 title: Email Security
 icon: material/email
 description: Email is inherently insecure in many ways, and these are some of the reasons it isn't our top choice for secure communications.
@@ -22,7 +23,7 @@ Email providers which allow you to use standard access protocols like IMAP and S
 
 ### How Do I Protect My Private Keys?
 
-A smartcard (such as a [Yubikey](https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) or [Nitrokey](https://www.nitrokey.com)) works by receiving an encrypted email message from a device (phone, tablet, computer, etc.) running an email/webmail client. The message is then decrypted by the smartcard and the decrypted content is sent back to the device.
+A smartcard (such as a [YubiKey](https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) or [Nitrokey](https://www.nitrokey.com)) works by receiving an encrypted email message from a device (phone, tablet, computer, etc.) running an email/webmail client. The message is then decrypted by the smartcard and the decrypted content is sent back to the device.
 
 It is advantageous for the decryption to occur on the smartcard so as to avoid possibly exposing your private key to a compromised device.
 

docs/basics/threat-modeling.md

@@ -1,4 +1,5 @@
 ---
+meta_title: "Threat Modeling: The First Step on Your Privacy Journey - Privacy Guides"
 title: "Threat Modeling"
 icon: 'material/target-account'
 description: Balancing security, privacy, and usability is one of the first and most difficult tasks you'll face on your privacy journey.

docs/basics/vpn-overview.md

@@ -1,4 +1,5 @@
 ---
+meta_title: "How Do VPNs Protect Your Privacy? Our VPN Overview - Privacy Guides"
 title: VPN Overview
 icon: material/vpn
 description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind.

docs/basics/why-privacy-matters.md

@@ -0,0 +1,53 @@
+---
+title: "Why Privacy Matters"
+icon: 'material/shield-account'
+---
+In the modern age of digital data exploitation, your privacy has never been more critical, and yet many believe it is already a lost cause. It is not. ==Your privacy is up for grabs==, and you need to care about it. Privacy is about power, and it is so important that this power ends up in the right hands.
+
+Privacy is ultimately about human information, and this is important because we know that human information confers power over human beings. If we care about our ability to be authentic, fulfilled, and free humans, we have to care about the rules that apply to information about us. So much of our modern society is structured around **information**. When you shop online, read the news, look something up, vote, seek directions, or really anything else, you are relying on information. If we live in an information society, our information matters, and therefore privacy matters.
+
+## What is Privacy?
+
+Many people get the concepts of **privacy**, **security**, and **anonymity** confused. You'll see people criticize various products as "not private" when really they mean it doesn't provide anonymity, for example. On this website, we cover all three of these topics, but it is important you understand the difference between them, and when each one comes into play.
+
+**Privacy**
+
+:   ==Privacy is the assurance that your data is only seen by the parties you intend to view it.== In the context of an instant messenger, for example, end-to-end encryption provides privacy by keeping your message visible only to yourself and the recipient.
+
+**Security**
+
+:   Security is the ability to trust the applications you use—that the parties involved are who they say they are—and keep those applications safe. In the context of browsing the web, for example, security can be provided by HTTPS certificates.
+
+    Certificates prove you are talking directly to the website you're visiting, and keep attackers on your network from reading or modifying the data sent to or from the website.
+
+**Anonymity**
+
+:   Anonymity is the ability to act without a persistent identifier. You might achieve this online with [Tor](../tor.md), which allows you to browse the internet with a random IP address and network connection instead of your own.
+
+    **Pseudonymity** is a similar concept, but it allows you to have a persistent identifier without it being tied to your real identity. If everybody knows you as `@GamerGuy12` online, but nobody knows your real name, that is your pseudonym.
+
+All of these concepts overlap, but it is possible to have any combination of these. The sweet spot for most people is when all three of these concepts overlap. However, it's tricker to achieve than many initially believe. Sometimes, you have to compromise on some of these, and that's okay too. This is where **threat modeling** comes into play, allowing you to make informed decisions about the [software and services](../tools.md) you use.
+
+[:material-book-outline: Learn More About Threat Modeling](basics/threat-modeling.md){ .md-button }
+
+## Privacy vs. Secrecy
+
+A common counter-argument to pro-privacy movements is the notion that one doesn't need privacy if they have **"nothing to hide."** This is a dangerous misconception, because it creates a sense that people who demand privacy must be deviant, criminal, or wrong.
+
+==You shouldn't confuse privacy with secrecy.== We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. There are always certain facts about us—say, personal health information, or sexual behavior—that we wouldn't want the whole world to know, and that's okay. The need for privacy is legitimate, and that's what makes us human. Privacy is about empowering your rights over your own information, not about hiding secrets.
+
+## Is Privacy About Control?
+
+A common definition of privacy is that it is the ability to *control* who has access to your data. This is an easy trap to fall into, in fact it is the definition of privacy we operated this website on for a long time. It sounds nice, and it appeals to many people, but in practice it just doesn't work.
+
+Take cookie consent forms, for example. You may encounter these dozens of times per day on the various websites you visit, with a nice array of checkboxes and sliders which allow you to "curate" your preferences to exactly fit your needs. In the end, we just hit the "I Agree" button, because we just want to read the article or make a purchase. Nobody wants to complete a personal privacy audit on every single website they visit. This is an exercise in [choice architecture](https://en.wikipedia.org/wiki/Choice_architecture), designed to make you take the easy route out instead of delving into a maze of configuration options that don't need to exist in the first place.
+
+==Control over your privacy inside most apps is an illusion.== It's a shiny dashboard with all sorts of choices you can make about your data, but rarely the choices you're looking for, like "only use my data to help me." This type of control is meant to make you feel guilty about your choices, that you "had the choice" to make the apps you use more private, and you chose not to.
+
+Privacy is something we need to have baked into the [software and services](../tools.md) we use by default, you can't bend most apps into being private on your own.
+
+## Sources
+
+- [Why Privacy Matters](https://www.amazon.com/Why-Privacy-Matters-Neil-Richards/dp/0190939044) (2021) by Neil Richards
+- [The New Oil: Why Privacy & Security Matter](https://thenewoil.org/en/guides/prologue/why/)
+- [@Thorin-Oakenpants on GitHub](https://github.com/privacytools/privacytools.io/issues/1760#issuecomment-597497298)

docs/calendar.md

@@ -2,6 +2,7 @@
 title: "Calendar Sync"
 icon: material/calendar
 description: Calendars contain some of your most sensitive data; use products that implement encryption at rest.
+cover: calendar.png
 ---
 Calendars contain some of your most sensitive data; use products that implement E2EE at rest to prevent a provider from reading them.
 

docs/cloud.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "The Best Private and Secure Cloud Storage Providers - Privacy Guides"
 title: "Cloud Storage"
 icon: material/file-cloud
 description: Many cloud storage providers require your trust that they will not look at your files. These are private alternatives!
+cover: cloud.png
 ---
 Many cloud storage providers require your full trust that they will not look at your files. The alternatives listed below eliminate the need for trust by implementing secure E2EE.
 

docs/cryptocurrency.md

@@ -1,6 +1,8 @@
 ---
+meta_title: "Private Cryptocurrency Blockchains - Privacy Guides"
 title: Cryptocurrency
 icon: material/bank-circle
+cover: cryptocurrency.png
 ---
 
 Making payments online is one of the biggest challenges to privacy. These cryptocurrencies provide transaction privacy by default (something which is **not** guaranteed by the majority of cryptocurrencies), provided you have a strong understanding of how to make private payments effectively. We strongly encourage you first read our payments overview article before making any purchases:

docs/data-redaction.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Remove PII with Metadata Scrubbers and Data Redaction Tools - Privacy Guides"
 title: "Data and Metadata Redaction"
 icon: material/tag-remove
 description: Use these tools to remove metadata like GPS location and other identifying information from photos and files you share.
+cover: data-redaction.png
 ---
 When sharing files, be sure to remove associated metadata. Image files commonly include [Exif](https://en.wikipedia.org/wiki/Exif) data. Photos sometimes even include GPS coordinates in the file metadata.
 

docs/desktop-browsers.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Privacy Respecting Web Browsers for PC and Mac - Privacy Guides"
 title: "Desktop Browsers"
 icon: material/laptop
 description: These web browsers provide stronger privacy protections than Google Chrome.
+cover: desktop-browsers.png
 schema:
   - 
     "@context": http://schema.org
@@ -282,7 +284,7 @@ Brave's Web3 features can potentially add to your browser fingerprint and attack
 
 - [ ] Set **Default Ethereum Wallet** to **None**
 - [ ] Set **Default Solana Wallet** to **None**
-- [ ] Set **Method to resolve IPFS resources** to **Disabled
+- [ ] Set **Method to resolve IPFS resources** to **Disabled**
 
 ##### System
 

docs/desktop.md

@@ -2,6 +2,7 @@
 title: "Desktop/PC"
 icon: simple/linux
 description: Linux distributions are commonly recommended for privacy protection and software freedom.
+cover: desktop.png
 ---
 Linux distributions are commonly recommended for privacy protection and software freedom. If you don't already use Linux, below are some distributions we suggest trying out, as well as some general privacy and security improvement tips that are applicable to many Linux distributions.
 

docs/dns.md

@@ -2,6 +2,7 @@
 title: "DNS Resolvers"
 icon: material/dns
 description: These are some encrypted DNS providers we recommend switching to, to replace your ISP's default configuration.
+cover: dns.png
 ---
 
 Encrypted DNS with third-party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
@@ -12,12 +13,12 @@ Encrypted DNS with third-party servers should only be used to get around basic [
 
 | DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
 | ------------ | -------------- | --------- | ------- | --- | --------- |
-| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DNSCrypt | Some[^1] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS)
-| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on server choice.|
-| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ| Optional[^3] | No | Based on server choice. |
-| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy/) | DoH <br> DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
-| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT | Optional[^5] | Optional | Based on server choice. |
-| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy/) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional |  Based on server choice, Malware blocking by default. |
+| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DNSCrypt | Some[^1] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS)
+| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration.|
+| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ| Optional[^3] | No | Based on personal configuration. |
+| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy/) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
+| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT | Optional[^5] | Optional | Based on personal configuration. |
+| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy/) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional |  Based on personal configuration, Malware blocking by default. |
 
 [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
 [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/)
@@ -26,7 +27,7 @@ Encrypted DNS with third-party servers should only be used to get around basic [
 [^5]: NextDNS can provide insights and logging features on an opt-in basis. You can choose retention times and log storage locations for any logs you choose to keep. If it's not specifically requested, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
 [^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://www.quad9.net/privacy/policy/](https://www.quad9.net/privacy/policy/)
 
-## Criteria
+### Criteria
 
 **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
 

docs/email-clients.md

@@ -2,6 +2,7 @@
 title: "Email Clients"
 icon: material/email-open
 description: These email clients are privacy-respecting and support OpenPGP email encryption.
+cover: email-clients.png
 ---
 Our recommendation list contains email clients that support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](basics/multi-factor-authentication.md) and prevent account theft.
 
@@ -66,7 +67,9 @@ These options can be found in :material-menu: → **Settings** → **Privacy & S
 
     [:octicons-home-16: Homepage](https://support.apple.com/guide/mail/welcome/mac){ .md-button .md-button--primary }
     [:octicons-eye-16:](https://www.apple.com/legal/privacy/en-ww/){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://support.apple.com/guide/mail/toc){ .card-link title=Documentation}
+    [:octicons-info-16:](https://support.apple.com/mail){ .card-link title=Documentation}
+
+Apple Mail has the ability to load remote content in the background or block it entirely and hide your IP address from senders on [macOS](https://support.apple.com/guide/mail/mlhl03be2866/mac) and [iOS](https://support.apple.com/guide/iphone/iphf084865c7/ios).
 
 ### Canary Mail (iOS)
 

docs/email.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Encrypted Private Email Recommendations - Privacy Guides"
 title: "Email Services"
 icon: material/email
 description: These email providers offer a great place to store your emails securely, and many offer interoperable OpenPGP encryption with other providers.
+cover: email.png
 ---
 Email is practically a necessity for using any online service, however we do not recommend it for person-to-person conversations. Rather than using email to contact other people, consider using an instant messaging medium that supports forward secrecy.
 
@@ -122,7 +124,7 @@ Mailbox.org doesn't accept any cryptocurrencies as a result of their payment pro
 
 #### :material-check:{ .pg-green } Account Security
 
-Mailbox.org supports [two factor authentication](https://kb.mailbox.org/display/MBOKBEN/How+to+use+two-factor+authentication+-+2FA) for their webmail only. You can use either TOTP or a [Yubikey](https://en.wikipedia.org/wiki/YubiKey) via the [Yubicloud](https://www.yubico.com/products/services-software/yubicloud). Web standards such as [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) are not yet supported.
+Mailbox.org supports [two factor authentication](https://kb.mailbox.org/display/MBOKBEN/How+to+use+two-factor+authentication+-+2FA) for their webmail only. You can use either TOTP or a [YubiKey](https://en.wikipedia.org/wiki/YubiKey) via the [YubiCloud](https://www.yubico.com/products/services-software/yubicloud). Web standards such as [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) are not yet supported.
 
 #### :material-information-outline:{ .pg-blue } Data Security
 

docs/encryption.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Recommended Encryption Software: VeraCrypt, Cryptomator, PicoCrypt, and OpenPGP - Privacy Guides"
 title: "Encryption Software"
 icon: material/file-lock
 description: Encryption of data is the only way to control who can access it. These tools allow you to encrypt your emails and any other files.
+cover: encryption.png
 ---
 Encryption of data is the only way to control who can access it. If you are currently not using encryption software for your hard disk, emails or files, you should pick an option here.
 

docs/file-sharing.md

@@ -2,6 +2,7 @@
 title: "File Sharing and Sync"
 icon: material/share-variant
 description: Discover how to privately share your files between your devices, with your friends and family, or anonymously online.
+cover: file-sharing.png
 ---
 Discover how to privately share your files between your devices, with your friends and family, or anonymously online.
 

docs/financial-services.md

@@ -1,6 +1,7 @@
 ---
 title: Financial Services
 icon: material/bank
+cover: financial-services.png
 ---
 
 Making payments online is one of the biggest challenges to privacy. These services can assist you in protecting your privacy from merchants and other trackers, provided you have a strong understanding of how to make private payments effectively. We strongly encourage you first read our payments overview article before making any purchases:
@@ -74,9 +75,9 @@ These services allow you to purchase gift cards for a variety of merchants onlin
 
 !!! recommendation
 
-    ![CakePay logo](assets/img/financial-services/coincards.svg){ align=right }
+    ![CoinCards logo](assets/img/financial-services/coincards.svg){ align=right }
 
-    **CoinCards** (available in the US, Canada, and UK) allows you to purchase gift cards for a large variety of merchants.
+    **CoinCards** (available in the US and Canada) allows you to purchase gift cards for a large variety of merchants.
 
     [:octicons-home-16: Homepage](https://coincards.com/){ .md-button .md-button--primary }
     [:octicons-eye-16:](https://coincards.com/privacy-policy/){ .card-link title="Privacy Policy" }

docs/frontends.md

@@ -2,10 +2,15 @@
 title: "Frontends"
 icon: material/flip-to-front
 description: These open-source frontends for various internet services allow you to access content without JavaScript or other annoyances.
+cover: frontends.png
 ---
 
 Sometimes services will try to force you to sign up for an account by blocking access to content with annoying popups. They might also break without JavaScript enabled. These frontends can allow you to get around these restrictions.
 
+If you choose to self-host these frontends, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting, as other peoples' usage will be linked to your hosting.
+
+When you are using an instance run by someone else, make sure to read the privacy policy of that specific instance. They can be modified by their owners and therefore may not reflect the default policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
+
 ## LBRY
 
 ### Librarian
@@ -32,10 +37,6 @@ Sometimes services will try to force you to sign up for an account by blocking a
 
     Librarian is useful if you want watch LBRY content on mobile without mandatory telemetry and if you want to disable JavaScript in your browser, as is the case with [Tor Browser](https://www.torproject.org/) on the Safest security level.
 
-When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Librarian, as other peoples' usage will be linked to your hosting.
-
-When you are using a Librarian instance, make sure to read the privacy policy of that specific instance. Librarian instances can be modified by their owners and therefore may not reflect the default policy. Librarian instances feature a "privacy nutrition label" to provide an overview of their policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
-
 ## Twitter
 
 ### Nitter
@@ -58,10 +59,6 @@ When you are using a Librarian instance, make sure to read the privacy policy of
 
     Nitter is useful if you want to browse Twitter content without having to log in and if you want to disable JavaScript in your browser, as is the case with [Tor Browser](https://www.torproject.org/) on the Safest security level. It also allows you to [create RSS feeds for Twitter](news-aggregators.md#twitter).
 
-When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Nitter, as other peoples' usage will be linked to your hosting.
-
-When you are using a Nitter instance, make sure to read the privacy policy of that specific instance. Nitter instances can be modified by their owners and therefore may not reflect the default policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
-
 ## TikTok
 
 ### ProxiTok
@@ -83,10 +80,6 @@ When you are using a Nitter instance, make sure to read the privacy policy of th
 
     ProxiTok is useful if you want to disable JavaScript in your browser, such as [Tor Browser](https://www.torproject.org/) on the Safest security level.
 
-When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting ProxiTok, as other peoples' usage will be linked to your hosting.
-
-When you are using a ProxiTok instance, make sure to read the privacy policy of that specific instance. ProxiTok instances can be modified by their owners and therefore may not reflect their associated privacy policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
-
 ## YouTube
 
 ### FreeTube
@@ -191,7 +184,7 @@ By default, LibreTube blocks all YouTube advertisements. Additionally, Libretube
 
 1. The default instance is [FramaTube](https://framatube.org/), however more can be added via **Settings** → **Content** → **PeerTube instances**
 
-!!! Warning
+!!! warning
 
     When using NewPipe, your IP address will be visible to the video providers used. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
 
@@ -220,10 +213,6 @@ By default, LibreTube blocks all YouTube advertisements. Additionally, Libretube
 
     Invidious is useful if you want to disable JavaScript in your browser, such as [Tor Browser](https://www.torproject.org/) on the Safest security level. It does not provide privacy by itself, and we don’t recommend logging into any accounts.
 
-When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Invidious, as other peoples' usage will be linked to your hosting.
-
-When you are using an Invidious instance, make sure to read the privacy policy of that specific instance. Invidious instances can be modified by their owners and therefore may not reflect their associated privacy policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don't contain PII.
-
 ### Piped
 
 !!! recommendation
@@ -244,10 +233,6 @@ When you are using an Invidious instance, make sure to read the privacy policy o
 
     Piped is useful if you want to use [SponsorBlock](https://sponsor.ajay.app) without installing an extension or to access age-restricted content without an account. It does not provide privacy by itself, and we don’t recommend logging into any accounts.
 
-When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Piped, as other peoples' usage will be linked to your hosting.
-
-When you are using a Piped instance, make sure to read the privacy policy of that specific instance. Piped instances can be modified by their owners and therefore may not reflect their associated privacy policy.
-
 ## Criteria
 
 **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.

docs/index.md

@@ -1,4 +1,5 @@
 ---
+meta_title: "Privacy Guides: Your Independent Privacy and Security Resource"
 template: overrides/home.en.html
 hide:
   - navigation
@@ -42,7 +43,7 @@ Much like the right to interracial marriage, woman's suffrage, freedom of speech
 
 You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. **Everyone** has something to protect. Privacy is something that makes us human.
 
-[:material-target-account: Common Internet Threats](basics/common-threats.md){ class="md-button md-button--primary" }
+[:material-book-outline: Why Privacy Matters](basics/why-privacy-matters.md){ class="md-button md-button--primary" }
 
 ## What should I do?
 

docs/mobile-browsers.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Privacy Respecting Mobile Web Browsers for Android and iOS - Privacy Guides"
 title: "Mobile Browsers"
 icon: material/cellphone-information
 description: These browsers are what we currently recommend for standard/non-anonymous internet browsing on your phone.
+cover: mobile-browsers.png
 schema:
   - 
     "@context": http://schema.org

docs/multi-factor-authentication.md

@@ -2,6 +2,7 @@
 title: "Multi-Factor Authenticators"
 icon: 'material/two-factor-authentication'
 description: These tools assist you with securing your internet accounts with Multi-Factor Authentication without sending your secrets to a third-party.
+cover: multi-factor-authentication.png
 ---
 ## Hardware Security Keys
 
@@ -48,7 +49,7 @@ For the models which support HOTP and TOTP, there are 3 slots for HOTP and 15 fo
 
 !!! warning
 
-    While Nitrokeys do not release the HOTP/TOTP secrets to the device they are plugged into, the HOTP and TOTP storage is **not** encrypted and is vulnerable to physical attacks. If you are looking to store HOTP or TOTP these secrets, we highly recommend that you use a Yubikey instead.
+    While Nitrokeys do not release the HOTP/TOTP secrets to the device they are plugged into, the HOTP and TOTP storage is **not** encrypted and is vulnerable to physical attacks. If you are looking to store HOTP or TOTP these secrets, we highly recommend that you use a YubiKey instead.
 
 !!! warning
 

docs/news-aggregators.md

@@ -2,6 +2,7 @@
 title: "News Aggregators"
 icon: material/rss
 description: These news aggregator clients let you keep up with your favorite blogs and news sites using internet standards like RSS.
+cover: news-aggregators.png
 ---
 
 A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to keep up with your favorite blogs and news sites.
@@ -98,7 +99,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
     ![NetNewsWire logo](assets/img/news-aggregators/netnewswire.png){ align=right }
 
-    **NetNewsWire** a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set. It supports the typical feed formats alongside built-in support for Twitter and Reddit feeds.
+    **NetNewsWire** a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set. It supports the typical feed formats alongside built-in support for Reddit feeds.
 
     [:octicons-home-16: Homepage](https://netnewswire.com/){ .md-button .md-button--primary }
     [:octicons-eye-16:](https://netnewswire.com/privacypolicy){ .card-link title="Privacy Policy" }

docs/notebooks.md

@@ -2,6 +2,7 @@
 title: "Notebooks"
 icon: material/notebook-edit-outline
 description: These encrypted note-taking apps let you keep track of your notes without giving them to a third-party.
+cover: notebooks.png
 ---
 
 Keep track of your notes and journalings without giving them to a third-party.
@@ -90,7 +91,7 @@ Cryptee offers 100MB of storage for free, with paid options if you need more. Si
 
     ![Org-mode logo](assets/img/notebooks/org-mode.svg){ align=right }
 
-    **Org-mode** is a [major mode](https://www.gnu.org/software/emacs/manual/html_node/elisp/Major-Modes.html) for GNU Emacs. Org-mode is for keeping notes, maintaining TODO lists, planning projects, and authoring documents with a fast and effective plain-text system. Synchronization is possible with [file synchronization](file-sharing.md#file-sync) tools.
+    **Org-mode** is a [major mode](https://www.gnu.org/software/emacs/manual/html_node/elisp/Major-Modes.html) for GNU Emacs. Org-mode is for keeping notes, maintaining to-do lists, planning projects, and authoring documents with a fast and effective plain-text system. Synchronization is possible with [file synchronization](file-sharing.md#file-sync) tools.
 
     [:octicons-home-16: Homepage](https://orgmode.org){ .md-button .md-button--primary }
     [:octicons-info-16:](https://orgmode.org/manuals.html){ .card-link title=Documentation}

docs/passwords.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "The Best Password Managers to Protect Your Privacy and Security - Privacy Guides"
 title: "Password Managers"
 icon: material/form-textbox-password
 description: Password managers allow you to securely store and manage passwords and other credentials.
+cover: passwords.png
 schema:
   - 
     "@context": http://schema.org
@@ -176,7 +178,7 @@ Bitwarden's server-side code is [open-source](https://github.com/bitwarden/serve
     **1Password** is a password manager with a strong focus on security and ease-of-use, which allows you to store passwords, credit cards, software licenses, and any other sensitive information in a secure digital vault. Your vault is hosted on 1Password's servers for a [monthly fee](https://1password.com/sign-up/). 1Password is [audited](https://support.1password.com/security-assessments/) on a regular basis and provides exceptional customer support. 1Password is closed source; however, the security of the product is thoroughly documented in their [security white paper](https://1passwordstatic.com/files/security/1password-white-paper.pdf).
 
     [:octicons-home-16: Homepage](https://1password.com/){ .md-button .md-button--primary }
-    [:octicons-eye-16:](https://support.1password.com/1password-privacy/){ .card-link title="Privacy Policy" }
+    [:octicons-eye-16:](https://1password.com/legal/privacy/){ .card-link title="Privacy Policy" }
     [:octicons-info-16:](https://support.1password.com/){ .card-link title=Documentation}
 
     ??? downloads

docs/productivity.md

@@ -2,6 +2,7 @@
 title: "Productivity Tools"
 icon: material/file-sign
 description: Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do.
+cover: productivity.png
 ---
 Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do. The privacy policy may legally protect your rights, but it does not provide technical access constraints.
 

docs/real-time-communication.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "The Best Private Instant Messengers - Privacy Guides"
 title: "Real-Time Communication"
 icon: material/chat-processing
 description: Other instant messengers make all of your private conversations available to the company that runs them.
+cover: real-time-communication.png
 ---
 
 These are our recommendations for encrypted real-time communication.

docs/router.md

@@ -2,6 +2,7 @@
 title: "Router Firmware"
 icon: material/router-wireless
 description: These alternative operating systems can be used to secure your router or Wi-Fi access point.
+cover: router.png
 ---
 Below are a few alternative operating systems, that can be used on routers, Wi-Fi access points, etc.
 

docs/search-engines.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Recommended Search Engines: Anonymous Google Alternatives - Privacy Guides"
 title: "Search Engines"
 icon: material/search-web
 description: These privacy-respecting search engines don't build an advertising profile based on your searches.
+cover: search-engines.png
 ---
 Use a search engine that doesn't build an advertising profile based on your searches.
 

docs/tools.md

@@ -1,4 +1,5 @@
 ---
+meta_title: "The Best Privacy Tools, Services, and Ad-Free Recommendations - Privacy Guides"
 title: "Privacy Tools"
 icon: material/tools
 hide:

docs/tor.md

@@ -1,7 +1,26 @@
 ---
+meta_title: "Tor Browser and Network: Anonymous Web Browsing - Privacy Guides"
 title: "Tor Network"
 icon: simple/torproject
 description: Protect your internet browsing from prying eyes by using the Tor network, a secure network which circumvents censorship.
+cover: tor.png
+schema:
+  - 
+    "@context": http://schema.org
+    "@type": SoftwareApplication
+    name: Tor Browser
+    image: /assets/img/browsers/tor.svg
+    url: https://www.torproject.org
+    sameAs: https://en.wikipedia.org/wiki/Tor_(network)
+    applicationCategory: Web Browser
+    operatingSystem:
+      - Windows
+      - macOS
+      - Linux
+      - Android
+    subjectOf:
+      "@type": WebPage
+      url: "./"
 ---
 
 ![Tor logo](assets/img/self-contained-networks/tor.svg){ align=right }

docs/video-streaming.md

@@ -2,6 +2,7 @@
 title: "Video Streaming"
 icon: material/video-wireless
 description: These networks allow you to stream internet content without building an advertising profile based on your interests.
+cover: video-streaming.png
 ---
 The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](vpn.md) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
 

docs/vpn.md

@@ -1,7 +1,9 @@
 ---
+meta_title: "Private VPN Service Recommendations and Comparison, No Sponsors or Ads - Privacy Guides"
 title: "VPN Services"
 icon: material/vpn
 description: These are the best VPN services for protecting your privacy and security online. Find a provider here that isn’t out to spy on you.
+cover: vpn.png
 ---
 
 If you're looking for additional **privacy** from your ISP, on a public Wi-Fi network, or while torrenting files, a VPN may be the solution for you as long as you understand the risks involved. We think these providers are a cut above the rest:
@@ -45,7 +47,8 @@ Our recommended providers use encryption, accept Monero, support WireGuard & Ope
 
     ??? downloads
     
-        - [:simple-android: Android](https://www.ivpn.net/apps-android/)
+        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=net.ivpn.client)
+        - [:octicons-moon-16: Accrescent](https://accrescent.app/app/net.ivpn.client)
         - [:simple-appstore: App Store](https://apps.apple.com/app/ivpn-serious-privacy-protection/id1193122683)
         - [:simple-windows11: Windows](https://www.ivpn.net/apps-windows/)
         - [:simple-apple: macOS](https://www.ivpn.net/apps-macos/)

includes/strings.en.yml

@@ -43,3 +43,7 @@ nav:
   Changelog: Changelog
   Forum: Forum
   Blog: Blog
+
+site:
+  translation: |
+    You're viewing the English copy of Privacy Guides, translated by our fantastic language team on Crowdin. If you notice an error, or see any untranslated sections on this page, please consider helping out!

netlify.toml

@@ -22,6 +22,9 @@
     publish = "site/"
     command = "crowdin download && mkdocs build --config-file config/mkdocs.en.yml && mkdocs build --config-file config/mkdocs.es.yml && mkdocs build --config-file config/mkdocs.he.yml && mkdocs build --config-file config/mkdocs.fr.yml && mkdocs build --config-file config/mkdocs.nl.yml && mv _redirects site/"
 
+    [context.deploy-preview]
+        command = "mkdocs build --config-file config/mkdocs.en.yml && mv _redirects site/"
+
 [[headers]]
   for = "/*"
   [headers.values]

theme/assets/img/cover/README.md

@@ -0,0 +1,7 @@
+# Cover images
+
+The cover images in this folder were obtained from Unsplash.
+
+## License
+
+See the [Unsplash License](https://unsplash.com/license) for details.

theme/assets/stylesheets/extra.css

@@ -454,3 +454,31 @@ div[class="md-source__icon md-icon"], div[class="md-source__repository md-source
 path[d="M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25Z"] {
     d: path('M16.937 3.722a2.363 2.363 0 1 1 3.341 3.341L19.342 8 16 4.658l.937-.936ZM13.467 7 3 17.467V21h3.532L17 10.533 13.465 7h.001Z')
 }
+
+/* Cover images */
+.center-cropped {
+    width: 100%;
+    height: 200px;
+    background-position: center center;
+    background-size: cover;
+    background-repeat: no-repeat;
+    overflow: hidden;
+    position: relative;
+    text-align: center;
+    border-radius: 0.5em;
+}
+  
+/* Set the image to fill its parent and make transparent */
+.center-cropped img {
+    min-height: 100%;
+    min-width: 100%;
+    opacity: 0;
+}
+
+.center-cropped h1 {
+    position: absolute;
+    top: 50%;
+    left: 50%;
+    transform: translate(-50%, -50%);
+    color: white;
+}

theme/main.html

@@ -55,6 +55,17 @@
     <link rel="icon" href="{{ config.theme.favicon | url }}">
     <meta name="generator" content="mkdocs-{{ mkdocs_version }}, mkdocs-material-9.1.0+insiders-4.32.2">
 {% endblock %}
+{% block htmltitle %}
+    {% if page.meta and page.meta.meta_title and config.theme.language == "en" %}
+    <title>{{ page.meta.meta_title }}</title>
+    {% elif page.meta and page.meta.title %}
+    <title>{{ page.meta.title }} - {{ config.site_name }}</title>
+    {% elif page.title and not page.is_homepage %}
+    <title>{{ page.title | striptags }} - {{ config.site_name }}</title>
+    {% else %}
+    <title>{{ config.site_name }}</title>
+    {% endif %}
+{% endblock %}
 {% block announce %}{% if config.extra.offline %}
     You're viewing an offline copy of Privacy Guides built on {{ build_date_utc }}.
     <a href="https://www.privacyguides.org/"> 
@@ -66,9 +77,57 @@
     <a href="https://www.privacyguides.org/"> 
     <strong>Visit privacyguides.org for current advice.</strong>
     </a>
+{% elif config.extra.context == "branch-deploy" %}
+    You're viewing a <strong>staging branch</strong> of Privacy Guides built on {{ build_date_utc }}.
+    The information on this page may be incomplete or otherwise not yet meet our editorial release standards.
+    <a href="https://www.privacyguides.org/"> 
+    <strong>Visit privacyguides.org for current advice.</strong>
+    </a>
 {% else %}{% endif %}{% endblock %}
-{% block extrahead %}{% if page and page.meta and page.meta.schema %}
+{% block extrahead %}
+<meta name="robots" content="max-snippet:-1, max-image-preview:large">
+{% if page and page.meta and page.meta.schema %}
 <script type="application/ld+json">
 {{ page.meta.schema|tojson }}
 </script>
 {% endif %}{% endblock %}
+{% block content %}
+    {% if page and page.meta and page.meta.cover %}
+    <div class="center-cropped" style="background-image:linear-gradient(rgba(0, 0, 0, 0.6), rgba(0, 0, 0, 0.6)), url('/en/assets/img/cover/{{ page.meta.cover }}');">
+        <h1>{{ page.title | d(config.site_name, true)}}</h1>
+        <img src="/en/assets/img/cover/{{ page.meta.cover }}" alt="{{ page.title | d(config.site_name, true)}} cover image" title="{{ page.title | d(config.site_name, true)}}">
+    </div>
+    {% endif %}
+    {% if "material/tags" in config.plugins %}
+    {% include "partials/tags.html" %}
+    {% endif %}
+    {% include "partials/actions.html" %}
+    {% if "\x3ch1" not in page.content and not page.meta.cover %}
+    <h1>{{ page.title | d(config.site_name, true)}}</h1>
+    {% endif %}
+    {{ page.content }}
+    {% include "partials/source-file.html" %}
+    {% include "partials/feedback.html" %}
+    {% include "partials/comments.html" %}
+    {% if config.theme.language == "es" %}
+    <div class="admonition info">
+    <p>Está viendo la copia en español de Privacy Guides, traducidas por nuestro fantástico equipo lingüístico en <a href="https://crowdin.com/project/privacyguides">Crowdin</a>. Si nota un error o ve alguna sección sin traducir en esta página, ¡<a href="https://matrix.to/#/#pg-i18n:aragon.sh">considere ayudar</a>!</p>
+    <p>You're viewing the Spanish copy of Privacy Guides, translated by our fantastic language team on <a href="https://crowdin.com/project/privacyguides">Crowdin</a>. If you notice an error, or see any untranslated sections on this page, please consider <a href="https://matrix.to/#/#pg-i18n:aragon.sh">helping out</a>!</p>
+    </div>
+    {% elif config.theme.language == "fr" %}
+    <div class="admonition info">
+    <p>Vous êtes en train de consulter la copie française de Privacy Guides, traduite par notre fantastique équipe de traducteurs sur <a href="https://crowdin.com/project/privacyguides">Crowdin</a>. Si vous remarquez une erreur, ou si vous voyez des sections non traduites sur cette page, <a href="https://matrix.to/#/#pg-i18n:aragon.sh">n'hésitez pas à nous aider</a> !</p>
+    <p>You're viewing the French copy of Privacy Guides, translated by our fantastic language team on <a href="https://crowdin.com/project/privacyguides">Crowdin</a>. If you notice an error, or see any untranslated sections on this page, please consider <a href="https://matrix.to/#/#pg-i18n:aragon.sh">helping out</a>!</p>
+    </div>
+    {% elif config.theme.language == "he" %}
+    <div class="admonition info">
+    <p>אתה צופה בעותק העברי של Privacy Guides, שתורגם על ידי צוות השפה הפנטסטי שלנו ב-<a href="https://crowdin.com/project/privacyguides">Crowdin</a>. אם אתה מבחין בשגיאה, או רואה קטעים לא מתורגמים בדף זה, <a href="https://matrix.to/#/#pg-i18n:aragon.sh">אנא שקול לעזור!</a></p>
+    <p>You're viewing the Hebrew copy of Privacy Guides, translated by our fantastic language team on <a href="https://crowdin.com/project/privacyguides">Crowdin</a>. If you notice an error, or see any untranslated sections on this page, please consider <a href="https://matrix.to/#/#pg-i18n:aragon.sh">helping out</a></p>
+    </div>
+    {% elif config.theme.language == "nl" %}
+    <div class="admonition info">
+    <p>Je bekijkt de Nederlandse versie van Privacy Guides, vertaald door ons fantastische taalteam op <a href="https://crowdin.com/project/privacyguides">Crowdin</a>. Als u een fout opmerkt of onvertaalde gedeelten op deze pagina ziet, <a href="https://matrix.to/#/#pg-i18n:aragon.sh">overweeg dan om te helpen</a>!</p>
+    <p>You're viewing the Dutch copy of Privacy Guides, translated by our fantastic language team on <a href="https://crowdin.com/project/privacyguides">Crowdin</a>. If you notice an error, or see any untranslated sections on this page, please consider <a href="https://matrix.to/#/#pg-i18n:aragon.sh">helping out</a></p>
+    </div>
+    {% endif %}
+{% endblock %}

theme/overrides/home.en.html

@@ -23,6 +23,10 @@
 {% extends "main.html" %}
 {% block extrahead %}
   <link rel="stylesheet" href="{{ 'assets/stylesheets/home.css?v=3.3.0' | url }}">
+  <link rel="alternate" type="application/rss+xml" title="Privacy Guides Release Changelog" href="https://discuss.privacyguides.net/c/site-development/changelog/9.rss">
+  <link rel="alternate" type="application/rss+xml" title="Privacy Guides Blog Feed" href="https://blog.privacyguides.org/feed_rss_created.xml">
+  <link rel="alternate" type="application/rss+xml" title="Privacy Guides Web Stories Feed" href="https://share.privacyguides.org/web-stories/feed/">
+  <link rel="alternate" type="application/rss+xml" title="Latest Privacy Guides Forum Topics" href="https://discuss.privacyguides.net/latest.rss" />
   {{ super() }}
 {% endblock %}
 {% block tabs %}
@@ -34,7 +38,7 @@
         <div class="mdx-hero__content">
           <h1>The guide to restoring your online privacy.</h1>
           <p>Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.</p>
-          <a href="{% if config.extra.offline %}basics/threat-modeling.html{% else %}kb/{% endif %}" title="The first step of your privacy journey" class="md-button md-button--primary">
+          <a href="{% if config.extra.offline %}basics/why-privacy-matters.html{% else %}kb/{% endif %}" title="The first step of your privacy journey" class="md-button md-button--primary">
             Start Your Privacy Journey
           </a>
           <a href="{% if config.extra.offline %}tools.html{% else %}tools/{% endif %}" title="Recommended privacy tools, services, and knowledge" class="md-button">