Swap aggregator with private routing options.
Privacy research
Private finance, communications, infrastructure, and surveillance.
Latest
- BTCPay Server 2.4.2: The Lightning Credential IncidentBTCPay Server versions before 2.4.2 let attackers steal the credentials that control a store's Lightning funds. What happened, which versions are affected, and what operators should do now.~7 min read
- Qwen3.8-27B OBLITERATED: Why the Same Model Gives Different AnswersWhat Qwen is, what the unofficial OBLITERATED version changed, why local AI apps can produce different answers, and the developer's 23 August 2026 GGUF redownload notice.~6 min read
- FreeSocks, Tor Bridges, and Messaging Proxies ComparedChoose between FreeSocks v2, Tor bridges and Snowflake, Signal proxies, and Telegram proxies by blocking problem, metadata exposure, and privacy limits.~9 min read
- Authoritative DNS Hosting Is Not Private DNS ResolutionAuthoritative hosting, recursive resolution, DNSSEC, registrar records, and account metadata expose different facts. A source-led DNS privacy worksheet using deSEC as a limited example.~8 min read
- Cellebrite in Australia: NSW and Victoria Phone-Access Powers ExplainedCellebrite Australia, reported NSW Police use, Victoria Police phone extraction powers, and the law governing post-seizure phone access.~14 min read
- Tor Browser Hardening SetupVerify and configure Tor Browser 15.0.19, preserve its shared fingerprint, test Tor routing and New Identity, and control downloads and account crossover.~12 min read
Crypto-funded virtual cards, email-only signup.
Password manager with encrypted vault items.
Swiss public DNS with malware blocking.
Multi-coin hardware signer, crypto checkout.
Numbered-account VPN with no activity logs.
- 01Briar Is in Maintenance Mode, Not Shut DownBriar says the project remains active but now limits work to essential security updates and bug fixes. Its repositories show a narrow maintenance cadence, not ordinary feature development.~4 min read
- 02GrapheneOS Duress Claim: What the Court Record SupportsFederal filings in United States v. Tunick allege deletion of Pixel data after a password was entered. They do not name GrapheneOS or confirm that a duress credential was used.~5 min read
- 03Apple Advanced Data Protection and the UK Technical Capability NoticeAdvanced Data Protection has been unavailable to new UK users since February 2025 after a Home Office notice under Investigatory Powers Act section 253. Apple filed a fresh tribunal claim in August 2026 and the lawfulness question is undecided.~7 min read
- 04A VPN Provider Built a Tool to Strip Windows' Hidden Device IDWindscribe published research into GDID, a Microsoft-issued Windows device identifier, and released deGDID to remove it. GDID surfaced in an unsealed federal complaint and operates outside VPN-tunneled traffic.~6 min read
- 05Guinea Blocked Three Platforms After a Cabinet Reshuffle. VPN Demand Rose Over 3,000%.Guinea blocked Facebook, YouTube, and TikTok nationwide on July 28, 2026 with no official explanation. VPN Observatory telemetry shows demand rising over 3,000% within three days.~6 min read
- 06The SCREEN Act Cleared a Committee Vote, Then Stalled on QuorumS.737 (SCREEN Act) requires age verification for VPN and proxy traffic on any site with adult content. On Aug 5, 2026 the Senate Commerce Committee voted 15-13 in favor but the bill did not advance for lack of quorum.~6 min read
- 07Minneapolis Rejects Skydio Drones While Whittier Expands Axon's DFR ProgramMinneapolis councilmembers rejected a Skydio drone pilot 6-6 over the vendor's ICE and Israeli military sales, while Whittier, California approved a $3.44M Axon DFR expansion 4-1 the same week. Both council records compared.~6 min read
- 08Manifest V3 and the Limits of Chrome Content Blocking in 2026Chrome disabled Manifest V2 extensions in July 2025, ending the full uBlock Origin on Chrome. What declarativeNetRequest can and cannot filter, and why Firefox kept the blocking webRequest API.~5 min read
Frequently Asked Questions
What is Cunicula?
Cunicula compares 176 privacy services by signup requirements, logging, ownership and jurisdiction, with source links for every claim. It also publishes research on surveillance, private communications, infrastructure and financial privacy. A listing is not an endorsement.
How are services evaluated?
By documented behavior, not marketing. For each service we check what it asks for at signup, what it can log, who runs it, which jurisdiction it answers to, and whether those claims have current sources.
What does "no-KYC" mean?
The service does not require identity documents to use. Some services are fully no-KYC, some ask for ID only above certain limits, and some always require it. Each service page states which applies.
What should I check before using a privacy tool?
The service page and its sources. Look at what the tool requires, what it logs, who owns it, where it is based, and whether it actually addresses the risk you care about.