My Core Principles
Privacy is not a product you buy once — it is a discipline you practise continuously. These are the principles that govern every decision I make about my digital life.
I never sign up for services with my real name, address, or phone number unless legally required. Aliases, forwarding addresses, and disposable credentials are the default.
If it's private, it's encrypted — no exceptions. Messages, files, backups, and passwords are all encrypted before they leave my devices. I never rely on a provider's promise to encrypt for me.
I assume every network, device, or server could be compromised. I never enter sensitive credentials on a public network without a VPN. I treat every email link as potentially malicious until verified.
Passwords, API keys, and access tokens are rotated regularly. VPN providers are evaluated continuously — if a better solution emerges, I switch. Loyalty to convenience is not a principle I hold.
Logs and temporary files auto-purge after six months. Browsing history is cleared on exit. Where possible, I use ephemeral sessions or Tails OS for sensitive operations that leave no trace.
Privacy measures should be proportional to actual risk. I identify who my likely adversaries are — data brokers, ad networks, surveillance capitalism, hostile state actors — and calibrate my defences accordingly. Perfect privacy does not exist; risk reduction does.
Different identities for different purposes. Work, personal, and sensitive activities are kept strictly separated — different browsers, different email addresses, different devices where warranted. A breach in one compartment does not cascade into others.
VPN & Network Privacy
Obscura VPN — Two-Hop Split-Trust Architecture
A provably private VPN built by Bitcoiners. Unlike traditional VPNs where you must trust their no-logs promises, Obscura makes logging architecturally impossible. Your traffic is split across two independent hops — Obscura sees your IP but never your traffic; Mullvad exit servers see your traffic but never your IP. No single entity can ever link your identity to your activity.
Additional Network Privacy Measures
Browser & Search Privacy
The browser is the largest attack surface in daily computing. Default browsers from major platforms harvest extensive behavioural data. I treat browser choice and configuration as a first-order privacy decision.
about:config settings: WebRTC disabled, fingerprinting resistance enabled, all telemetry off, and strict tracking protection. Used with Firefox Multi-Account Containers for identity separation.Email & Communications Privacy
Email is structurally insecure — it was designed in an era when privacy was not a consideration. I treat every email as potentially intercepted unless end-to-end encrypted, and I minimise real email exposure through aliases and encrypted providers.
Passwords & Authentication
Device & OS Hardening
The operating system is the foundation of all digital security. A secure browser and VPN mean nothing if the OS underneath is phoning home or contains unpatched vulnerabilities.
Phone Privacy
Smartphones are the most invasive surveillance devices most people carry voluntarily. They contain GPS, microphone, camera, and a continuous record of your location, contacts, and communications — all transmitted to servers you don't control. Mitigation requires deliberate choices.
Physical Security & OpSec
Digital security means nothing if physical security is ignored. Shoulder surfing, camera access, and document theft are real attack vectors. These physical habits reinforce the digital ones.
Data Broker Opt-Outs & Account Minimalism
Data brokers — companies like Spokeo, Whitepages, Acxiom, and hundreds of others — compile dossiers on individuals from public records, loyalty card data, app telemetry, and purchased datasets. They sell this information to anyone who pays. Opting out is tedious but worth doing.
Banking & Financial Document Security
Digital security and physical security are inseparable when it comes to financial information. Most identity theft and financial fraud begins not with a sophisticated hack, but with a stolen wallet, an unshredded statement, an unguarded bank card, or a piece of mail left in the box too long. These practices address the physical side of the equation.
Credit & Account Monitoring
Physical Document Discipline
Bank Card Physical Security
Quick Reference — Do & Don't
- Review your credit report annually (both Equifax and TransUnion)
- Review bank and credit card statements every month
- Go paperless and set real-time transaction alerts
- Shred all documents containing personal or financial information
- Store SIN card, passport, and birth certificate in a locked safe
- Report lost or stolen cards to your bank immediately
- Collect mail daily — don't let it accumulate
- Sign new bank cards immediately on receipt
- Keep your card in sight during every transaction
- Educate family members — especially children and seniors
- Ask why your information is needed before providing it
- Carry your SIN card, passport, or birth certificate in your wallet
- Write your PIN anywhere — not on your card, not in your wallet
- Let your bank card out of your sight during transactions
- Email account numbers, SINs, or passwords in any form
- Leave bank statements or tax returns unattended or in plain view
- Throw out documents before shredding them
- Respond to unsolicited calls, emails, or texts requesting financial details
- Give out personal information unless you initiated the contact
- Leave mail sitting in an unattended mailbox
- Discard expired bank cards without cutting through the chip and strip
Bitcoin & Financial Privacy
Traditional banking provides zero financial privacy — every transaction is logged, reported to government agencies above certain thresholds, and potentially shared with data analytics firms. Bitcoin, used carefully, can restore a degree of financial autonomy.
My Data Practices — This Site
This table covers how data is handled across the tedlee.ca site ecosystem specifically.
| Category | Practice | Protection |
|---|---|---|
| Contact Email | Minimal — used only for newsletters & encrypted support requests | ✔ Encrypted |
| Session Logs | Stored for 6 months, then auto-anonymised | ✔ Auto-purge |
| Cookies | First-party only — theme and layout preferences | ✔ No trackers |
| At-Rest Storage | AES-256 encrypted on servers I control — XA Net Services | ✔ AES-256 |
| Access Control | MFA + hardware tokens for all admin & database access | ✔ FIDO2 + MFA |
| Analytics | No third-party analytics. No Google Analytics. No Facebook Pixel. | ✔ None |
| Advertising | No advertising of any kind on any tedlee.ca page | ✔ Ad-free |
| Audits | Logs reviewed quarterly; encryption keys rotated annually | ✔ Quarterly |
| Retention | Contact messages purged on request or after 2 years | ✔ Auto-delete |
| Data Sales | Personal data is never sold, rented, or shared with third parties | ✔ Never sold |
PGP Public Key
Encrypt messages to me using this key. Verify the fingerprint out-of-band before sending sensitive content. Valid until: Apr 3, 2031, 5:59:30 PM
Key fingerprint: BCB0 DF0D 2C42 49AA 87E2 01F1 C8B1 1DD4 C9A3 6A0D
-----BEGIN PGP PUBLIC KEY BLOCK----- mQENBGnQAAIBCADCvKWxy/CKopsJM7jakceqE2v7+s9in/5oVap0Dx/ebNlu8o0F wpYCh9SynlXmbwameUH8XS111aX3ipwgJXa4d9x4vMVOhWOzlhHpA6G1I7VpKbP6 vB0cyVWNuZNHux3VJZMeagR9Y42mcKKeejSTGLcpRfVGb8pVxXv/0U/fGSNFX9ph HkAhT6wFFcGhtjQAEr1+hQjtyhuU98+tmhy3pEUOTprNLQ5Vsn3pQwdGrpkmM8bq QlN4sSdCnu2HoT04LsR5ZK0Utn8Q3MALx8i2AL6pG2EpFKgDTgAvEI9DnwQVN5Di mi9mqsamRwCXmjfbXQHA5oUAjVk5iA5I9R/DABEBAAG0IVRlZCBMZWUgKFZFN0xF RSkgPGluZm9AdGVkbGVlLmNhPokBVAQTAQgAPhYhBLyw3w0sQkmqh+IB8cixHdTJ o2oNBQJp0AACAhsvBQkJZ1MABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEMix HdTJo2oNj5QH/3t+iTT67wSlLIVv/eRV/sReFDXkwxm3XkJfTAr1er97IIn6u/eA v9pjLVd1ZzEKvKGVQOmd2Toj7gcc7xOnXxIk6Sec6pTqRWb2jD8hvjou5znjMIBy AJrrqnmpBloivR9DZqcHmUEVvpGzCsa7Glb6cEEgGIUf7v3ninkcm7CoPKKmF8ts Um6ZOEDtg533ILxh/srPpr/r1fjGzskrseTdAVmlxf8UFvrZIiobU7F0t7AmcNQ+ eBXiahHkizFUFVWosY2HMA5+hFAuhTT6pw0LS1rLQ85BoxH8PvT77/u27Yy9n/Tw Esb1OHna4FW/dRSTjFaNIcQZHg396B588GC5AQ0EadAAAgEIAKQA9AgH6b4jm7NW 9JTcKgW8kd9sSXaeVa3Z32RgGjP4xyEoxfdipzc/kXMGBN7bnBo7m3TqbqwIJKzI URkL8rhB2KRUJUQj3IE70ajkfIw5V6EkAOMVFZnOBJcQVFqU1QAKJtG3+taafcCW RSo+aZBpFGIdRoSgKotdoJpKB8InhzXTVM4gW7TObOJEVfaXSjzke6gY/Wkm+pSs tFFAbBcZZ2DgKYPk9JgWqVAqNsP+VsCBPRE5FJJ6UrDISHkFfsWEVqj2+FGPyRJf VIFHXuLvgEwijVXF6hX0EUuy33PslZ9OoS3FsRgj+wiCB+u8mjMnjx2MqfClMXTG xr+qF8UAEQEAAYkCcgQYAQgAJhYhBLyw3w0sQkmqh+IB8cixHdTJo2oNBQJp0AAC AhsuBQkJZ1MAAUAJEMixHdTJo2oNwHQgBBkBCAAdFiEEZ/RYOWSkkqwpQZQTyxe4 jVTIBI0FAmnQAAIACgkQyxe4jVTIBI2nQwf/bDU9d+G/9hAvhvRjvNdXpcVpH9Ji ZEPgLKeYJ4x0bRpYX8skjQDH1oPAGmAoK0vR7KjygA03KMnTdzOhYYXqVF9YfBcW WeEjkdDGfe6zdF2f76vOQDlyj6kbwRpLmp9WkZd3jJ3+Cmdo35xuz/6pJNXytu5B HOtPLEifzPERsq/br5GpQTbKvG6VMdhIPOe9H2klvviNeVCZJf2Ug/jjE77jGpA1 YO6Tfx+5VSvSxEpEzq2zECIW+PUHGUhBrXVk/aEp85+UsfYt6bA1f2QBYQg1ofy0 74ycNRclHuDJ6Sx42GdW7lHDAWzg0KPfR3qpWaB07BM7HDDO6blTX8iKJIVFCACl kvdV1Djgma1cuUp4pFa0Mb+hSFWWZRUOp1IeBqx+I6ahQnCXvpKuGHvckz21zJ1P cxPLBLjdUpfBvDXN6O38cuq8Mn2zrYppJu5QE/WRJFte/gt5F1sXw8LGXvBUlw2y sBcjXwSDvkFfyD4pKA4I7ywoSizkO8QJgHGFnHpNnQ2U4o9FovgU2e9kbre6iNqd tXxfwUR9elFOrjtECtNeho6mvChBJFntAxeqIoKqVTQuGbPj58dxEYRZ3rUTX9UE f74HPlWDG6BI5CdYkHhMaeyx+8Mg2kEBChniIaHtajhsz9gGkqEG1BwSMMGCYR0P w1odgl3mCs2vNf3qFbY1 =1vyG -----END PGP PUBLIC KEY BLOCK-----
Legal Disclaimer
⚖️ Legal Disclaimer — Please Read
The information on this page is provided for educational and informational purposes only. It describes the personal privacy practices of Ted Lee and should not be construed as professional security advice, legal advice, technical consultation, or a recommendation that any specific individual adopt any specific practice.
Not professional advice. Ted Lee is not a cybersecurity professional, licensed lawyer, privacy consultant, or certified security auditor. The techniques, tools, and practices described here represent personal choices based on personal research and personal threat modelling. Your situation, threat model, and legal obligations may differ significantly from Ted Lee's.
No guarantee of effectiveness. No privacy or security measure is foolproof. The tools and techniques described here reduce risk — they do not eliminate it. Technology changes rapidly. A tool that is effective and trustworthy today may become compromised, discontinued, or legally restricted in the future. Ted Lee makes no warranty, express or implied, that any tool or practice described here will protect you from any specific threat.
Third-party tools. Links to third-party tools and services (VPNs, password managers, browsers, etc.) are provided for informational purposes. Ted Lee does not endorse, warrant, or guarantee the security, reliability, or continued operation of any third-party service. You use third-party services at your own risk and subject to their own terms and privacy policies. Ted Lee receives no compensation for most tool recommendations on this page; where referral relationships exist they are disclosed.
Legal compliance is your responsibility. Some privacy tools — including VPNs, encryption software, and certain communication applications — may be restricted or illegal in some jurisdictions. It is your sole responsibility to understand and comply with all laws and regulations applicable to you in your jurisdiction before using any tool or technique described here. Ted Lee accepts no liability for any legal consequences arising from your use of tools described on this page.
No liability. To the maximum extent permitted by applicable law, Ted Lee accepts no liability whatsoever for any loss, damage, security breach, legal consequence, or other harm arising from your use of or reliance on the information on this page — including any harm arising from your adoption of any privacy technique, your use of any linked tool or service, or any failure of any security measure to prevent an attack or data breach.
This page outlines Ted Lee's personal measures — no marketing, no services to sell, just the steps he takes. It is shared in the spirit of public education only.