Which best describes your work situation?

Student, retired, or not currently employed

Standard job, no particular confidentiality requirements

My work involves confidential information (legal, medical, financial, HR, engineering, etc.)

I'm publicly visible in my field (executive, public-facing role, media presence)

My work involves advocacy, journalism, activism, or organizing

Do you have people you're responsible for protecting digitally?

A partner or spouse whose accounts overlap with mine

Parents or relatives I help manage tech for

Sources, clients, or community members who could face consequences

How visible is your real name or face online?

I have minimal or no digital presence

Personal social media presence without public visibility

Personal social media presence accessible to the public

My name or work is searchable and associated with my profession

I have a large public following for my work or interests

My work puts me in adversarial situations with specific groups or governments

Has anyone ever tried to harm you through digital means?

Minor things like spam, scam attempts, nothing targeted

Someone has tried to find personal details about me specifically

I've been doxxed, harassed, or targeted by a coordinated group

I've faced legal pressure, surveillance, or threats tied to my work

What privacy concerns matter most to you?

Surveillance capitalism, corporations profiling me

Government overreach and mass surveillance

Personal safety from someone specific

Protecting my family or people I care about

Professional confidentiality and client/source protection

Identity theft, fraud, and financial security

General principle, privacy is a value I hold

Avoiding doxxing, harassment, or unwanted attention

Are there specific people or groups whose knowledge of your activities concerns you?

An ex-partner or estranged family member

Online strangers who've taken issue with me

State actors, law enforcement, or organized adversaries

People I'm protecting (so my activity doesn't expose them)

Who lives in your household?

Just me, or me and a trusted partner

Children whose devices I help manage

Family I'm tech support for (parents, grandparents, extended)

My living situation isn't fully safe or stable

If your phone or laptop were stolen today, what would worry you most?

Cost of replacement, inconvenience

Photos and personal stuff being seen

Someone accessing my family's accounts or my kids' info

Work files, client data, or professional correspondence

Sources, communications, or data that could get someone hurt

Which feeling about your privacy is closest to yours?

No specific threat, I just want reasonable digital safety

I'm protecting people who depend on me

I've been targeted before and need to stay ahead of it

The stakes are high and immediate

In the last year, have any of these happened to you?

Received a data breach notification

Had private information shared without consent

Been subject to a legal demand, court order, or investigation

Noticed someone monitoring my device or accounts

How comfortable are you with technology?

I struggle with most tech beyond the basics

I can follow clear instructions but can't troubleshoot

I'm comfortable installing apps, changing settings, picking tools

I'm comfortable with command line, self-hosting, or development

I work in tech or security professionally

Which tradeoff describes you?

Convenience matters, I want reasonable defaults that don't get in my way

I'll add friction where it protects my family

I'll restructure my workflows when my job requires it

I'll accept significant friction to stay safe

I already live with serious constraints on how I work and communicate

Which browser(s) are you using regularly?

Chrome, Edge, Opera, or Other Mainstream Browser

Firefox or Brave (default settings)

Browser with hardening (custom settings, user.js, profile tweaks)

A privacy-hardened fork (Mullvad Browser, LibreWolf, Waterfox, etc.)

Tor Browser as a regular part of my workflow

What do you use to search the web?

Mainstream (Google, Bing, Yahoo)

Better-than-mainstream but ad-supported/tracking-adjacent (Ecosia, etc.)

Strictly privacy-focused (DuckDuckGo, Brave Search, Startpage, Kagi, Mojeek, etc.)

Self-hosted or instance-based metasearch (SearXNG, Whoogle, etc.)

What's your VPN/proxy strategy?

None, I use my ISP/router default

Reputable VPN occasionally (Sometimes using Mullvad, IVPN, Proton, etc.)

Browser-based proxy/VPN (iCloud Private Relay, browser VPN extension, etc.)

Reputable VPN as default (Always using Mullvad, IVPN, Proton, etc.)

Do you impelement either of these additional practices?

I use encrypted DNS for my devices (built into my VPN, set up on my router, configured in my browser, or via a service like NextDNS/Quad9/Mullvad DNS)

I use network-level ad/tracker blocking (Pi-hole, AdGuard Home, NextDNS filtering, etc.)

Do you use browser extensions?

I like to keep extensions to a minimum, no more than a few. Mainly limited to the extensions below if any.

Ad/tracker blocker (uBlock Origin, Brave Shields, AdGuard, Ghostery, etc.)

I use Firefox Containers to compartmentalize my web traffic.

I use other privacy-focused extensions for anti-fingerprinting, cookie management or something else. (User agent switcher, Canvas Defender, etc.)

Which messenger(s) are you using regularly?

Default carrier messaging (SMS, RCS, MMS)

Mainstream non-E2EE messenger (Telegram, Discord DMs, etc.)

Mainstream proprietary E2EE (iMessage, WhatsApp, Messenger)

Open-source E2EE with phone identifiers (Signal, etc.)

Open-source E2EE with anonymous identifiers (Session, SimpleX, Briar, Matrix)

Which email provider(s) are you using regularly?

Mainstream provider (Gmail, Outlook, Yahoo, AOL, iCloud Mail, etc.)

Non-mainstream with stronger privacy policies but no E2EE (Fastmail, HEY, etc.)

E2EE provider (Proton Mail, Tuta, Mailbox.org, etc.)

Which communication platform(s) are you using regularly?

Regular phone calls through your carrier

Mainstream non-E2EE (Zoom, Teams, Meet)

Mainstream proprietary E2EE (FaceTime, WhatsApp, etc.)

E2EE through private messenger (Signal, etc.)

Self-hosted or open-source video conferencing (Jitsi, Proton Meet, etc.)

Which password generation approaches are you using regularly?

I memorize a few passwords and reuse them

I use unique passwords that follow a pattern I can guess

I use strong, unique passwords for important accounts, and reuse for unimportant ones

I use strong, unique passwords for everything

I primarily use passkeys when available (replaces a password entirely)

How do you primarily store your passwords?

Written down physically (notebook, paper)

Saved in my browser or operating system

A dedicated password manager (Bitwarden, Proton Pass, Apple Passwords, etc.)

A local/offline password manager (KeePassXC, Passbolt, etc.)

Which 2FA methods are you using regularly?

I don't use 2FA, or only when forced

I use SMS-based codes or email-based codes

I use an authenticator app/TOTP

I use hardware security keys (Yubikey, etc.)

Do you utilize any aliasing tools to protect your real identifiers?

No, I use my real email and phone number for everything

Email aliases (SimpleLogin, AnonAddy, Apple Hide My Email, Proton aliases, etc.)

Phone number aliases or VoIP for sign-ups (MySudo, Google Voice, Hushed, etc.)

Virtual or masked credit cards (Privacy.com, Revolut, Wise, MySudo, etc.)

I also use dedicated pseudonyms or separate identities for some online activity

Have you done any of these management strategies for your digital footprint?

Deleted old accounts I no longer use

Removed myself from data broker sites—companies that aggregate and sell personal info (Optery, EasyOptOuts, Manual opt out, GDPR right-to-erasure requests, etc.)

Pursued removal of personal info from official public records (varies by country: court records, registries, voter rolls, property records, professional licensing, etc.)

Which desktop operating system(s) are you using regularly?

Windows with telemetry stripped or hardened

macOS with Lockdown Mode enabled

General Linux distribution/BSD (Fedora, Ubuntu, Mint, etc.)

Privacy/security-focused OS (Qubes, Tails, Whonix, atomic distros, etc.)

Which mobile operating system(s) are you using regularly?

Stock Android (Samsung, default Pixel, etc.)

Minimal feature phone (LightOS, Flip Phone, AphyOS, etc.)

Standard De-Googled ROM (CalyxOS, /e/OS, LineageOS, etc.)

Hardened ROM (GrapheneOS, etc.)

Which of the following represent how you regularly install software on your computer?

Default app store (Microsoft Store, Mac App Store, etc.)

From official websites on the web

Official/curated packages in package managers, Flatpak, or Homebrew

Community packages (AUR, untrusted Flatpak repos, etc.)

Wherever I find them online (random download sites, etc.)

Which of the following represent how you regularly install software on your phone?

Default app store (Google Play Store, App Store, etc.)

F-Droid, Aurora or Accrescent for open-source apps

Obtainium or sideloading from project repositories I trust

Wherever I find them online (APK download sites, etc.)

Do you utilize any of the following strategies to improve the privacy or security of your devices?

I review and limit app permissions regularly

I use automatic updates for my operating system and apps

I use full disk encryption (FileVault, BitLocker, Veracrypt, LUKS, etc.)

I use a firewall to filter traffic (Little Snitch, LuLu, Portmaster, RethinkDNS, etc.)

I use separate user accounts/profiles to compartmentalize data

Which of these do you normally use to store data in the cloud?

Mainstream cloud provider without E2EE (iCloud, Google Drive, OneDrive, Dropbox, etc.)

iCloud with Advanced Data Protection enabled (Apple's E2EE)

Mainstream cloud provider with DIY client-side encryption (Cryptomator, etc.)

Native end-to-end encrypted cloud provider (Proton Drive, Ente, Filen, etc.)

A securely self-hosted solution or NAS (Nextcloud, Syncthing, Synology/QNAP NAS, etc.)

I don't use the cloud—only Local data with local backups

What's your backup strategy?

I use automatic cloud backup with default settings

I do local unencrypted backups to external drives

I use encrypted cloud backups with a service that can't access my data

I do local encrypted backups to external drives

I use the 3-2-1 strategy or a similarly reliable method with encryption

Which notes provider(s) are you using regularly?

Default notes apps with default settings (Apple Notes, Google Keep, OneNote, etc.)

Apple Notes with locked notes, or Apple Notes with ADP enabled

I use a notes service locally (Obsidian, etc.)

E2EE or self-hosted notes (Cryptee, Notesnook, Nextcloud, Joplin, etc.)

Manual encryption of sensitive files before storing

Sensitive material kept offline only

Which file sharing method(s) are you using regularly?

Unencrypted email or text attachments

Mainstream cloud sharing links (Google Drive, Dropbox, etc.)

E2EE messenger file sharing (Signal, iMessage, etc.)

Shared E2EE cloud folder or securely self-hosted instance (Proton Drive, Nextcloud, MEGA, etc,)

Self-encrypted files (Veracrypt, Cryptomator, encrypted zip) sent through any channel

Encrypted file transfer tools (OnionShare, Magic Wormhole, etc.)

Do you utilize any of the following strategies to improve the protection of your devices?

Privacy screens on devices used in public

Webcam covers on laptops/desktops

Lock devices immediately when stepping away

Practice situational awareness in public (vary routines, know exits, stay aware of surroundings)

Faraday bag or pouch for travel or sensitive contexts

Hardware killswitch (BusKill or similar) for emergency lockdown

What's your relationship with smart-home/IoT devices

I use many smart devices on my main network (speakers, cameras, doorbells, appliances)

I put some or all of my smart devices on limited network access, offline entirely, or separate VLAN

I utilize E2EE when possible (E2EE cameras, encrypted assistants, etc.)

Do you utilize any of the following strategies to take control of shared data?

I review what I post for personal info that could identify or locate me

I remove metadata/EXIF from photos before uploading them online

I avoid posting in real-time about my location or schedule

I think about consent before posting photos of others

I don't have public accounts under my real name

Do you utilize any of the following strategies to keep your living situation safe?

I use solid locks on doors and windows

I use security cameras that are either offline or end-to-end encrypted

I don't list my real address publicly (resumes, LinkedIn, social profiles, etc.)

I use a virtual address service instead of my real one (PMB, registered agent, virtual office, mail forwarding service, etc.)

Do you utilize any of the following strategies to keep your information safer?

I have identity-verification protection at the credit bureaus or national equivalent (US: credit freeze with Experian/Equifax/TransUnion; UK: Cifas Protective Registration; CA/AU: equivalent freeze; etc.)

I migrated to eSIM or use a SIM PIN with my carrier

I have additional protections on my phone number like number-porting protection or a carrier-account PIN

I monitor for breaches involving my accounts (HaveIBeenPwned, Password manager monitoring, etc.)

I put utilities, vehicles, or property into entities (trusts, LLCs, Ltd, GmbH, etc.) where possible

Techlore SPA Quiz Find your threat model. Measure your habits. Close the gaps.

Always Free Private. No Accounts. Since 2020

In privacy and security circles, you'll often hear "it depends on your threat model." The SPA Quiz helps you find yours. It infers your situation, scores your habits against it, and shows where the gaps are. Take the quiz, save your private URL, and revisit it over time as your tech stack and life evolve.

Your archetype A threat-model profile inferred from your situation, so you know what needs protecting

Your SPA score Habits measured against your archetype's ideal, with a gap breakdown for optimal protection

Track over time Save a private link with no account, we don't see your results. Retake to track your progress

Use SPA Tools for curated tool picks, or compare VPNs side by side with the VPN Finder. Want to understand the concepts behind each recommendation? Read the SPA Wiki.

How is this scored?

Work & Visibility

These questions help us understand your situation so we can calculate your archetype(s).

Threats & Concerns

Home & Motivation

Experience & Tradeoffs

Last section of Phase A. Phase B covers your current tools and habits.

Web Browsing

Browsers, search, VPNs, DNS, and extensions.

Communication

Messaging, email, and voice/video calls.

Account Management

Passwords, 2FA, aliasing, and footprint reduction.

Devices & Apps

OS choices, app installation, and system hardening.

Data & Storage

File storage, backups, notes, and file sharing.

Physical & Habits

Device security, smart home, sharing habits, and identity protection.