Online Privacy and Metadata

Metadata is data about an activity, message or file. It may not include the full content, but it can still expose patterns: who communicated, when something happened, which service was used, which device connected and where traffic appeared to come from.

• Email: sender, recipient, subject, timestamps, routing details and IP information.
• Phone records: call time, duration, numbers and network routing information.
• Social networks: friend graphs, login events, likes, shares and tracking pixels.
• Web browsing: IP address, pages visited, referrers, cookies and browser fingerprint signals.
• Files: author, creation time, location tags, document history and media details.

Service providers need some metadata to deliver email, route traffic, show webpages, bill accounts and prevent abuse. The privacy problem begins when metadata is retained too long, combined across services or used to profile people beyond their expectations.

• Advertisers use metadata to infer interests and target campaigns.
• Platforms use tracking scripts and cookies to connect activity across websites.
• Attackers use leaked metadata to plan phishing, identity theft or account takeover.
• Network observers may use traffic records to infer behavior even when message content is encrypted.

• Use HTTPS: prefer encrypted websites and avoid entering sensitive data on plain HTTP pages.
• Use a trusted VPN or Tor when appropriate: reduce direct exposure of your home or office IP address.
• Block trackers: use browser privacy settings and reputable tracker-blocking extensions.
• Limit social sign-ins: avoid giving apps broad access to profile, contact or friend metadata.
• Review app permissions: remove access to location, contacts, files and camera where it is not needed.
• Strip file metadata: remove document author, edit history and image location tags before sharing.
• Keep sensitive files encrypted: protect content before uploading it to cloud storage or sending it elsewhere.

Cipher Nota focuses on the part of privacy that matters most for stored files: keeping content encrypted and access-controlled before it reaches storage providers. Encryption cannot erase every network trace, but it can keep private documents unreadable to ordinary storage infrastructure.

• Encrypt files before storage.
• Keep access tied to user-controlled credentials and recovery material.
• Use explicit grants for sharing and AI access instead of broad account-wide exposure.
• Pair encrypted storage with good browsing hygiene for stronger overall privacy.

Source inspiration: IPBurger metadata privacy guide.