Smartphone privacy checklist

Your safety is obviously important to you. Otherwise you wouldn't continue reading here. The first step towards greater security has been taken.

Not all the tasks in this list are relevant to you. Therefore, first think about your current threat situation and prioritize the tasks using the filter buttons above! This will give you a better overview and prevent you from being overwhelmed.

If we manage to increase the safety of all people, surveillance measures will be less worthwhile. This will also benefit your safety. Share this list in your channels or print out the flyer.

Just as technology and this list are constantly changing, your life, your habits and your devices will change in the future. So take time once a year to review this list.

You know the most important logins to websites or apps by heart. This mainly concerns logins to accounts with which you can quickly get help or with which you can reset passwords for other accounts. For example, the login for your email address or your most important social media accounts.

You know the most important numbers and names of your friends, family, acquaintances or lawyers by heart.

Non-smart key devices, so-called feature phones or dumb phones, are often carelessly classified as "secure". However, these often cannot be encrypted and do not offer secure communication.

The display on your device switches off automatically after a while. It is not possible to unlock your device by simply swiping it.

Only you can unlock your own device. Regardless of whether you use a swipe pattern, a password or a biometric feature: You alone should be the only person who can unlock your device.

To unlock the display of your device, use long and strong passwords such as a short sentence.

You should not use your fingerprint or face to unlock your phone. People with access to fingerprints or images may otherwise be able to unlock the device. Therefore, use complex patterns or alphanumeric passwords.

In your smartphone settings, you can specify what is displayed on the screen when your device is locked. Completely deactivate notifications for the lock screen so that no chat messages or other sensitive information are displayed.

You should encrypt your smartphone to prevent unwanted reading or manipulation of data.

You should never deactivate the PIN protection on your SIM card. If the PIN is deactivated, authorities or other people can use the card themselves to gain access to messengers, for example.

Memory cards cannot be reliably encrypted on all devices. It is also possible to restore data that was saved on them when they were previously used with other devices. Therefore, only use memory cards if you know what is stored on them or if you have previously overwritten them.

Consider whether it is safe for you to search for spyware on your phone. Especially in toxic relationships with expected violence, it may be better not to search for it.

Do not try to contact help centers for violence and stalking from your own device if you fear violence. Secretly organize a new device for research and contacts.

Only use power adapters and cables for charging that you trust. Mark the cable and power supply unit to prevent them from being replaced.

When you start your device, you will not see red or yellow warning messages such as "Your device is corrupted" or "Cannot be trusted". Take these messages seriously and do not continue booting your device if you are unsure.

Make regular backups of your most important data. Your backup doesn't have to be perfect. A bad backup is better than no backup!

Restoring your data is the most important part of a backup. Practice this situation! This way you can see if your backup is intact. Make sure that you can restore your backup without access to other backups, password managers and two-factor apps.

The police often ask for pins and passwords when confiscating a smartphone on a court order or when seizing a smartphone. Do not say anything. Do not unlock anything. Contact a lawyer.

Sharing your passwords or unlock codes with other people is not a sign of love. It is a sign of mutual respect not to do so.

You should only activate your Wi-Fi (WLAN) when you really need it. For example, when you want to connect to your home network. Switch it off when you're out and about.

Deactivate your Bluetooth connection if you are not currently dependent on it. In the past, it has repeatedly been possible to eavesdrop on connections via Bluetooth or even execute malicious code on nearby devices unnoticed.

If you want to be sure that you are not being eavesdropped on via Bluetooth, you should use a wired connection for your headphones.

You should always deactivate your positioning if you don't need it at the moment. You usually only need it for navigation apps. However, many other apps also want to have access to it.

An active NFC interface can theoretically be used to extract information such as bank details from your device if you have a malicious app installed.

Deactivate mobile data when you don't need it. An activated mobile internet connection leaves a continuous record of the cells you use in your provider's traffic data and also allows apps to track your location continuously.

You should refrain from taking photos and videos when you attend demonstrations. Video material on confiscated devices can incriminate other participants. There is also a risk that recordings that end up on the internet could be used to identify individuals.

You can suppress your phone number when you make a call. This means that the person you are calling cannot see your own number. You can set this for certain people or for all calls.

Sensitive information about you or your relationships could be left as voice messages on your voicemail at any time and without your knowledge. Therefore, deactivate your voicemail for security reasons.

You should definitely delete your "mobile advertising ID" (MAID), change it frequently (Android) or prohibit your apps from tracking (iOS) if you do not want the data from different apps to be merged and sold again by so-called data brokers.

Keep apps and your operating system up to date. Malware and state Trojans often exploit vulnerabilities in software. Up-to-date apps and an up-to-date operating system are therefore important.

Certain malicious apps secretly scour your screenshots for credentials, recovery data or personal information.

If other people use the same Google or Apple account on another device, you can be partially monitored.

Root rights allow you to install many unique apps. However, these rights may also apply to malicious apps, which is why you should generally avoid root.

You should definitely use open-source, encrypted messengers such as Briar, Signal, Threema or SimpleX. Avoid insecure commercial messengers such as WhatsApp, Telegram and Co.

You should restart your phone more often. For example, once a week or before critical conversations. Some state trojans do not survive reboots as they are often not persistent.

You should reset your phone to factory settings if you no longer trust it. This method is effective against common spy apps from the app store that may be hiding on your device.

Some smart TVs take screenshots and audio recordings and upload them automatically and unintentionally to the internet. Protect yourself by not pairing your smartphone with a smart TV.

When scanning QR codes, pay attention to the authenticity of the target page and check exactly where the code takes you. Be skeptical if you are asked to enter personal data or bank information after scanning.

You should not carry or store your bank card right next to your smartphone. Malware could read and send the data via NFC. Alternatively, use RFID protective covers for your cards or deactivate NFC.

Do not share photos of your face or use them in your status or profile pictures. Instead, use avatars or cover your face.

You know Twitter, Facebook, YouTube and Instagram? Have you ever heard of Fediverse, Mastodon, Pixelfed, Friendica or Peertube? No? Then sign up now!

If you have the option, you should definitely avoid logins with one-time codes that are sent to you via SMS. These can easily be intercepted and also reveal which services you use.

Advertising and tracking are often closely linked. Tracking across multiple websites and apps first determines your preferences. Advertising networks then show you suitable content and also track your habits.

You can improve your security by using a different name and different email addresses or mobile numbers for registration on all platforms. This way, your accounts cannot be merged through data leaks.

Work with a time delay if you want to share the same message in different channels or groups with different pseudonyms. Otherwise it will be obvious that one person is behind the various pseudonyms.

Your internet access providers can see which websites you visit and determine your location based on your IP. Websites and platforms can also see your IP address. Tor (The Onion Router) can help you greatly improve your anonymity on the Internet and conceals your true IP.

Google, Apple and other manufacturers pass on data to investigating authorities without hesitation. Therefore, use alternative search engines such as duckduckgo.com or stract.com

You don't have to unlock your device if you want to take photos or videos. Keep it locked. This minimizes the risk of access after theft or confiscation.

On many websites, you will be asked to consent to cookies, analyses and tracking. Consistently refuse your consent. Even if this is often more complicated.

Do not use logins from third-party providers such as Google, Microsoft or Apple in apps and websites. If possible, create a separate login for the respective website or app.

It is important to delete accounts that are no longer needed. Take the time to do this once a year. Regardless of whether you needed them for a website or an app. If you haven't used them for a while, you should close them. This minimizes the risk of data leaks.

Personal data is leaked from websites, portals and online stores every day. Those affected are rarely informed. The data is sold, traded or is often freely accessible.

You should check the authenticity of emails, chat messages and text messages, especially if they ask or request you to take an action. For example, if you are asked to enter your personal details or password.

If you reply to spam in the form of messages, emails or text messages, you are likely to receive even more spam. Your contact details become more valuable the more often you reply.

Increasingly, publicly available information about relatives is being used in conjunction with AI-generated calls to fake emergency situations in order to obtain money or access data. Protect yourself and your family by agreeing on a shared password for such emergencies.

You help me to continue this project with a one-time or regular donation. The research and further development require a lot of time and perseverance. You can find a link to the donation page in the footer or here in the further information.

You can apply a special film to your display that prevents bystanders or cameras from being able to read it. These films are available for many models. They use optical effects that mean your display is only visible from a certain angle.

Always deactivate USB debugging on your Android device. This function is normally deactivated by default on all smartphones and must be consciously activated by you.

You bought all your devices yourself, unpacked them yourself and set them up yourself.

In your phone's settings, you will find unique, unchangeable hardware numbers such as the serial number, Wi-Fi Mac address, Bluetooth Mac address and IMEI. Make a note of these numbers. This way, you can always be sure that your device has not been secretly replaced.

You should definitely store your backups decentrally and outside your home so that you can access them quickly in the event of theft or confiscation.

In the event of a house search, burglary, flooding or other emergencies, sometimes all devices are stolen or destroyed. Prepare for this by storing unused devices with your friends. That way you'll have a quick replacement.

A flat rate generally generates less data than a tariff with minute-based billing or itemized bills. This is because these have to be recorded and stored. Flat rates generate less data. Prepaid tariffs generally do not even generate billing data and are therefore very data-efficient.

Many network operators sell your movement data on to various advertising companies. You can object to this forwarding in some countries.

Apps that can potentially detect IMSI catchers or silent text messages will not help you in the vast majority of cases. You should avoid these apps and instead learn why they don't do much and what the alternative is.

With a third-party block, you can prevent apps, websites or scammers from charging costs for subscriptions or other purchases to your phone bill.

Free Android-based operating systems such as grapheneOS, CalyxOS, /e/OS or LineageOS can help you protect your privacy and are less or not at all tied to Google, Apple or Microsoft.

GrapheneOS is an Android operating system with a particularly high level of protection and numerous security features and is therefore listed here as a separate task.

Your security is increased enormously if you use a different complex password for all services on the Internet. You should save these passwords in a password manager such as KeepassXC or Bitwarden.

If possible, only obtain apps from trustworthy stores that support security updates and integrity checks. These are, for example, the Google Play Store, the GrapheneOS App Store or the Accrescent project.

Your flashlight app wants to access your device's memory or microphone? Not a good idea! Always ask yourself why an app needs permissions and only grant them gradually or when necessary.

Accessibility services are a permission that allows other apps to access their text and media content. This permission is therefore often used by spy apps to read content.

If you want to remain as independent as possible from Google, you can obtain apps via alternative channels. E.g. via Accrescent or the GrapheneOS App store.

Many popular apps track your habits and preferences. Find out about privacy-friendly alternatives and check the apps for trackers before you install them!

The two-step confirmation (two-factor authentication) prevents your SIM card or copies of it from being used to access your messages.

Some messengers such as Signal or Threema offer you the option to automatically delete old messages. Use this function to prevent messages from being read in the future, e.g. due to confiscation.

Avoid voice messages if possible. Modern AI systems can recognize voices very effectively and assign them to people in a similar way to automatic facial recognition. This is comparable to a fingerprint, which is unique and unmistakable.

You should make sure that there are only known accounts in your chat group before you share sensitive information there. Bear in mind that despite strong encryption, all participants can read along. Therefore, think about which groups you should check.

Lockdown mode (blocking mode) can be used on the iPhone to prevent malware infections. Some features are severely restricted in order to protect the system.

Links that you have copied directly from online stores, Google, social platforms or other sites often contain tracking information that you should always delete before sharing.

Whether online or at the checkout: use payment functions that collect as little data as possible about you and your shopping behavior.

Are you easy to find via search engines or social media based on your name or place of residence? If so, you should use pseudonyms or try to delete your data.

Alternative front-ends for web services such as YouTube, Twitter, TikTok and other websites can help you protect your data.

Passkeys can replace passwords in some applications and apps and make them completely superfluous. Unlike passwords, they cannot be stolen through phishing or data leaks. Use them when they are offered!

Many services and platforms on the internet offer to secure logins with a second factor. Use this option whenever possible.

VPNs can be useful in some cases. However, they are unsuitable for certain applications. Remember that you have to trust VPN providers. You pay them, so they know your identity. Many VPN services cooperate fully with investigative authorities.

Do you take the time to read the privacy policies of new apps and services you register with? Are you interested in who your data is shared with and what happens to it?

Do you use emails? Then you should definitely consider encryption such as GPG/OpenPGP.

Remove or deactivate smart household devices such as alarm systems, robot vacuums, smart light bulbs, smart sockets or cameras from your household if you are exposed to digital violence after a break-up.

Verified Boot prevents tampering with your operating system and shows you warning messages at startup if something is wrong. You should make sure that your device is secured with it. If you have installed your own system, you should activate verified boot.

A locked bootloader prevents new or manipulated operating systems from being installed on your device.

If you have the option, you should definitely encrypt your backups to protect them from unauthorized access.

Smartphone manufacturers receive millions or even billions from Google or Apple for placing their software on your phone. You should definitely remove these apps.

Google Play services and Apple services provide centralized infrastructures for some apps. For example, push messages are sent via these services. Government agencies use this fact to monitor iPhone and Android devices.

You should not use iMessage and keep your Apple ID secret. iMessage has repeatedly been the target of so-called zero-click attacks in recent years.

Apple devices such as iPads or iPhones can become a problem for some people if they do not want to be found. In addition, Apple determines how you are allowed to use the system, not you.

Your two-factor app is installed on a separate device. This means that your second factor cannot be used to log into your accounts if your device is compromised.

Many cloud providers cooperate fully with investigative authorities and will not hesitate to hand over your data. Only store encrypted data there.

Cryptoparties are events where you learn how to protect your devices and your communication. They often take place in larger cities. Technology is most fun in the company of other people! If you can, you should definitely attend one of these parties.

Switch off your phone before sensitive meetings or store it away to protect confidential content. If you can, remove the battery.

Encryption is only effective when the smartphone is switched off. Therefore, practise how to switch off your phone quickly in stressful situations.

You should simply cover unused cameras with stickers. For example, if you don't use the selfie camera or only use it rarely.

There are two main dangers at demonstrations: Confiscation and the possibility of being tracked. You should be aware of both. This way you can decide for yourself whether you want to take your cell phone with you or not.

Advanced Mobile Location (AML) has been used in Germany and many other countries since 2019 and is gradually being expanded to locate people in emergency situations. If you don't want this, you should prepare yourself for it.

You should not use your name to accept a call. Use generic phrases like 'hello' instead.

Sealing can help you determine whether hardware has been tampered with after your device has been returned. You can also quickly seal connections such as USB ports with a special sticker before you have to hand in your device.

In some countries (currently only India), messengers will soon only be usable if there is an active, government-registered SIM card in the device. This has a significant impact on privacy, anonymity and protection against tracking. Therefore, check whether your messengers also work without a SIM card.

In many apps or websites, you can enter data such as your name, address, telephone numbers and much more. Even if this data is obviously not required. Leave fields blank or use made-up data.

Your smartphone invisibly attaches metadata such as coordinates, camera type, resolution, smartphone model or operating system to your pictures. Some camera apps allow you to deactivate this partially or completely.

If shadows caused by sunlight are visible on images, the exact time and date can be used to determine your approximate position on the planet. It is then possible to pinpoint where the photo was taken.

Anyone who knows your phone number can easily attack you. Keep your number secret if possible. To still be reachable, you can switch to messengers with a call function that do not require a number or where the number can be hidden.

On the back of your physical SIM card is a globally unique number, the ICCID. Remove it with some sandpaper so that you cannot be identified by it and your provider in the event of confiscation.

Since 2015, immigration authorities in Germany, for example, have been allowed to search the devices of people who are required to leave the country in order to establish their identity and country of origin. This often happens during official visits. Therefore, leave your device at home or get a burner phone.

If you are forced to cross fortified border installations such as walls or fences at national borders, you should switch off your smartphone and all electronic devices completely. Remove the battery to make detection less likely.

Anonymous SIM cards make it considerably more difficult for state actors and other professional attackers to select their targets. They provide such good protection because they make it difficult to identify the person to whom they belong from a telephone number or vice versa.

If you are traveling with friends, acquaintances, family or comrades, you should not use your SIM card if you do not want your relationships to be traced.

A burner phone is a simple, often inexpensive cell phone that you do not link to personal data or accounts and that you can leave behind or dispose of without losing anything.

Only use your anonymous SIM card on one specific phone. Never use the same phone for a different SIM card. This is because the unique number of the SIM card and the unique number of your phone are always stored together in the provider's traffic data.

To further increase security, you can often change your anonymous SIM cards. Each time you switch, you should also change the phone used for this purpose.

An anonymous and a non-anonymous SIM card are not inserted in your phone at the same time. You also do not have a second smartphone with a non-anonymous card inserted in it if you also use an anonymous SIM card.

Sim cards are also installed in modern cars. If your anonymous or non-anonymous SIM card moves through radio cells together with the SIM card of a vehicle, they leave a trace through the traffic data of the providers involved. This may make it possible to identify who you are or who you are traveling with.

Do not use your anonymous SIM card or your anonymous phone for regular phone calls or text messages. The provider's traffic data shows who the target contacts are if they do not also use an anonymous card.

You should never order SIM cards and phones directly to your address or pay for them from your accounts. To leave no trace, you can ask friends to order or collect them for you. Pay in cash.

You should obtain the credit for your SIM card anonymously or via intermediaries. Therefore, use SIM cards for which you can buy credit in cash at cash registers or ask friends to send you a credit code.

Especially if you cross borders to repressive or authoritarian countries such as the USA, China or Russia, you can use unsuspicious new accounts to prevent your data from being read at the border.