Swap aggregator with private routing options.
Privacy research
Private finance, communications, infrastructure, and surveillance.
Latest
- India’s 2026 Biometric SIM Rules, ExplainedWhat India’s final user-identification rules require for SIM enrolment, account changes, disconnection and reverification, and why draft BIVS is not the separate DIP system.~10 min read
- A ClarityCheck Database Exposed 9 Million Face ImagesA ClarityCheck database held 9,042,977 image files and was reachable without a password. What was exposed, what remains unknown, and what affected people can do.~8 min read
- BTCPay Server 2.4.2: The Lightning Credential IncidentBTCPay Server versions before 2.4.2 let attackers steal the credentials that control a store's Lightning funds. What happened, which versions are affected, and what operators should do now.~7 min read
- Qwen3.8-27B OBLITERATED: Why the Same Model Gives Different AnswersWhat Qwen is, what the unofficial OBLITERATED version changed, why local AI apps can produce different answers, and the developer's 23 August 2026 GGUF redownload notice.~6 min read
- FreeSocks, Tor Bridges, and Messaging Proxies ComparedChoose between FreeSocks v2, Tor bridges and Snowflake, Signal proxies, and Telegram proxies by blocking problem, metadata exposure, and privacy limits.~9 min read
- Authoritative DNS Hosting Is Not Private DNS ResolutionAuthoritative hosting, recursive resolution, DNSSEC, registrar records, and account metadata expose different facts. A source-led DNS privacy worksheet using deSEC as a limited example.~8 min read
Crypto-funded virtual cards, email-only signup.
Swiss end-to-end encrypted email.
Swiss public DNS with malware blocking.
U.S.-operated, end-to-end encrypted notes owned by Proton.
Numbered-account VPN with no activity logs.
- 01Cellebrite in Australia: NSW and Victoria Phone-Access Powers ExplainedCellebrite Australia, reported NSW Police use, Victoria Police phone extraction powers, and the law governing post-seizure phone access.~14 min read
- 02Tor Browser Hardening SetupVerify and configure Tor Browser 15.0.19, preserve its shared fingerprint, test Tor routing and New Identity, and control downloads and account crossover.~12 min read
- 03Briar Is in Maintenance Mode, Not Shut DownBriar says the project remains active but now limits work to essential security updates and bug fixes. Its repositories show a narrow maintenance cadence, not ordinary feature development.~4 min read
- 04GrapheneOS Duress Claim: What the Court Record SupportsFederal filings in United States v. Tunick allege deletion of Pixel data after a password was entered. They do not name GrapheneOS or confirm that a duress credential was used.~5 min read
- 05Apple Advanced Data Protection and the UK Technical Capability NoticeAdvanced Data Protection has been unavailable to new UK users since February 2025 after a Home Office notice under Investigatory Powers Act section 253. Apple filed a fresh tribunal claim in August 2026 and the lawfulness question is undecided.~7 min read
- 06A VPN Provider Built a Tool to Strip Windows' Hidden Device IDWindscribe published research into GDID, a Microsoft-issued Windows device identifier, and released deGDID to remove it. GDID surfaced in an unsealed federal complaint and operates outside VPN-tunneled traffic.~6 min read
- 07Guinea Blocked Three Platforms After a Cabinet Reshuffle. VPN Demand Rose Over 3,000%.Guinea blocked Facebook, YouTube, and TikTok nationwide on July 28, 2026 with no official explanation. VPN Observatory telemetry shows demand rising over 3,000% within three days.~6 min read
- 08The SCREEN Act Cleared a Committee Vote, Then Stalled on QuorumS.737 (SCREEN Act) requires age verification for VPN and proxy traffic on any site with adult content. On Aug 5, 2026 the Senate Commerce Committee voted 15-13 in favor but the bill did not advance for lack of quorum.~6 min read
Frequently Asked Questions
What is Cunicula?
Cunicula compares 177 privacy services by signup requirements, logging, ownership and jurisdiction, with source links for every claim. It also publishes research on surveillance, private communications, infrastructure and financial privacy. A listing is not an endorsement.
How are services evaluated?
By documented behavior, not marketing. For each service we check what it asks for at signup, what it can log, who runs it, which jurisdiction it answers to, and whether those claims have current sources.
What does "no-KYC" mean?
The service does not require identity documents to use. Some services are fully no-KYC, some ask for ID only above certain limits, and some always require it. Each service page states which applies.
What should I check before using a privacy tool?
The service page and its sources. Look at what the tool requires, what it logs, who owns it, where it is based, and whether it actually addresses the risk you care about.