Privacy Practices Survey

Privacy Practices Survey

Assessment Overview

Your digital habits either protect you — or expose you.

This survey measures the behavioral dimension of your privacy: the day-to-day choices that either reduce or amplify your risk to data theft, tracking, and exploitation.

Unlike the Hostility Index (who's after you), this is the Privacy Practices Index — measuring how resilient your habits actually are.

⏱ Time required: 5–8 minutes

What you'll get

Privacy Practices Score (0–50) — Higher is better. Your behavioral privacy posture across 5 domains.
Domain-by-domain breakdown — See exactly where your habits are strong and where they need work.
Actionable recommendations — Specific steps to close the gaps in your privacy defenses.

5 domains assessed

Account & Identity Hygiene
Device Security & Hardening
Browsing & Online Behavior
Social & Exposure Management
Resilience & Response

Privacy model

Runs entirely in your browser
No data stored without your consent
Results calculated locally

Optional follow-up is opt-in after scoring.

Section 1 of 5

Account & Identity Hygiene

Strong authentication, unique secrets, smart aliasing

Which looks most like your passwords?

Select the option that most closely resembles your typical password

password123

Simple, common, easily guessable

Summer2020!

Word + number + symbol — still predictable

hG7!kP9#sL2q

Random character mix — good strength

CorrectHorseBatteryStaple7

Long passphrase — strong and memorable

w9#f7!xLq2m8@zH3vR4tYp1u

Long random string — maximum strength

Which type of password manager do you primarily use?

None, or browser-saved passwords only

e.g., Chrome, Edge, or Safari’s built-in password saver

Proprietary or OS-integrated manager

e.g., iCloud Keychain, Windows Hello, a security suite’s manager

Dedicated, audited password manager

e.g., 1Password, Bitwarden, LastPass, KeePass

For your critical accounts (email, banking, work), how consistently do you use your password manager?

Only a few non-critical accounts

Some critical accounts, but not all

All or almost all critical accounts

Which critical accounts have Multi-Factor Authentication (MFA) enabled?

Check all that apply — more is better

Primary Email

e.g., Gmail, Outlook, Proton

Banking / Financial

Online banking, investment, credit card portals

Work / Business

Slack, Office 365, Google Workspace

Social Media

Facebook, Instagram, Twitter/X, LinkedIn, TikTok

Cloud Storage / Productivity

Dropbox, iCloud, Google Drive, OneDrive

Other Critical Accounts

Crypto wallets, healthcare portals, government/tax sites

More accounts with MFA = higher score

How long have you had your primary email address?

10+ years

Long-established — widely known and harder to change

5–10 years

<5 years

Newer address with a smaller existing footprint

How long have you had your current phone number?

10+ years

5–10 years

<5 years

When you sign up for a new service, what do you usually do?

Same primary email and password everywhere

Credential reuse — highest risk

Use “Login with Google/Facebook/Apple”

Single sign-on — ties accounts together

Sometimes use an alternate email/alias

Partial compartmentalization

Routinely use masked email, burner accounts, or alias addresses

Best practice — separates services

Section 2 of 5

Device Security & Hardening

Hardened devices, least-privilege apps, secure connections

Do you have auto-updates enabled for your phone and desktop operating systems, and for your apps?

No — I update manually when I get around to it

Some updates are automatic, but not all

Yes — OS and apps update automatically on all my devices

In the past year, have you installed (or still have) any of these types of apps?

Check all that apply — fewer risky app types = higher score

Conference/event app

Gaming app

Work/company app

From employer or small vendor

Medical/health app

Not from a major hospital or insurer

Utility app for photos, video, or graphics

Utility app for faxing, scanning, or file conversion

Kids’ app

Other small/special-purpose apps

These app categories often request excessive permissions and may share your data with third parties

When an app asks for access to your location, camera, microphone, or contacts, what do you usually do?

I usually allow whatever it asks

I sometimes deny or limit permissions

I routinely review and deny unnecessary permissions

Do most of your apps have access to your location, or just a few?

Most or all apps that ask

Only apps I think genuinely need it

e.g., maps, rideshare

Very few or none — I disable or block location by default

What screen lock do you use?

Simple PIN or no lock

Biometrics + simple PIN

Biometrics + complex passcode

Strongest combination

Do you lock your devices when unattended?

Never

Sometimes

Always

How do you verify the legitimacy of a suspicious email or text message with a link or attachment?

I usually click/open it, or rely on my email filter

I check the sender’s address or look for red flags before acting

I always independently verify

e.g., log in via official site, call the institution

I delete it without acting

Safe default — if in doubt, throw it out

Do you change the default credentials on new network equipment (router, modem, access point) and smart home/IoT devices?

No — I leave the factory default passwords

Yes, I change some of them

e.g., just the Wi-Fi router password

Yes, I change all default credentials immediately

Section 3 of 5

Browsing & Online Behavior

Reduce tracking, fingerprinting, and data exhaust

What browser do you primarily use?

Chrome / Edge

Default settings send significant data to Google or Microsoft

Safari / Firefox

Better defaults; some tracking protection built in

Brave / LibreWolf / Tor / Mullvad

Privacy-first browsers with hardened defaults

Which search engine do you use most?

Google / Bing

Builds a detailed profile of your queries

A mixture

DuckDuckGo / Kagi / Startpage

Privacy-respecting, no personal profiling

Do you use AI/chatbots (e.g., ChatGPT, Perplexity, Copilot, Gemini) to search, summarize, or research?

Yes, while signed in with history saved (training allowed)

Your prompts may be used to train models

Yes, but with privacy controls

History off, private/anon mode, alias account, minimal personal data

Rarely/never, or only on-device/local assistants

No cloud logging of queries

Do you use ad/tracker blockers?

None

Trackers follow you across most sites you visit

Some blockers

Partial protection

Full blockers

e.g., uBlock Origin, Brave Shields — strong tracker defense

Do you use burner/alias emails or phone numbers for sign-ups?

Never

Sometimes

Always for new services

e.g., SimpleLogin, Apple Hide My Email, Google Voice

Do you block or clear third-party cookies?

No — third-party cookies are allowed

Sometimes

Yes — blocked or cleared regularly

Which VPN do you primarily use for browsing?

None, or a free/unverified VPN

e.g., Hola, a random browser extension VPN

Major but less-audited VPN

e.g., NordVPN, ExpressVPN

Highly audited, open-source, or privacy-focused VPN

e.g., Mullvad, ProtonVPN

Do you use a private or encrypted DNS service, or just your internet provider’s default?

My ISP’s default DNS

Your ISP can see every domain you visit

Third-party DNS, but not encrypted

e.g., Google 8.8.8.8 — better but still visible

Encrypted DNS (DoH/DoT)

e.g., Cloudflare 1.1.1.1, NextDNS, Quad9 — queries are private

Section 4 of 5

Social & Exposure Management

Limit what adversaries can learn, link, or time-sync about you

How private are your social media profiles?

Mostly public

Posts, photos, and connections visible to anyone

Mixed — some public, some locked down

Locked down / private

Controlled audience only

I use alternate or anonymous accounts

Sock puppet accounts for anonymity

Do you review what you’re posting before you post — checking for location data, identifying details, or sensitive context?

Never — I post freely without reviewing

Sometimes

Regularly — I actively check before posting

Do you use Google or Facebook logins for third-party sites and apps?

Always — it’s convenient

Ties your accounts together and shares data with both parties

Sometimes

Rarely / Never

I create separate accounts to avoid cross-platform tracking

Do you separate your professional and personal online identities?

No — I use the same accounts and handles for everything

Somewhat — some separation but not complete

Yes — clearly separated identities across contexts

Do you give real personal information when filling out online forms that don’t strictly require it?

Always — I fill in all fields accurately

Sometimes

Rarely / Never — I provide minimal or fictional data where optional

Section 5 of 5

Resilience & Response

Detect issues early, limit damage, recover fast

How often do you review your bank and credit card statements?

Never — I don’t check them proactively

Occasionally — monthly or less

Weekly or bi-weekly — I review them regularly

Do you use virtual or one-time credit cards for online purchases?

Never

Sometimes

Always for online purchases

e.g., Privacy.com, bank virtual cards

When you learn one of your accounts or data has been involved in a breach, what do you do?

Do nothing — it’s probably fine

Change the password for that account

Change password, monitor activity, and freeze credit if financial data was exposed

What data do you back up?

None — I don’t maintain backups

Some — photos and documents only

All critical data — systematic and complete backups

Are your backups encrypted?

No — or I don’t know

Cloud provider encryption only

Provider holds the key

All backups encrypted — locally and in cloud

I control the keys

Do you have a habit of cleaning out old emails, documents, or photos you no longer need?

No / Rarely — data accumulates indefinitely

Sometimes — when prompted by a storage alert or spring cleaning

Yes — I have a system for routine data review and deletion

Date: - Privacy Practices Index (PPI)

0

/50

🔴 HIGH RISK

PRIVACY PRACTICES SCORE

Higher score = stronger privacy habits

Score Bands

🔴 0–15 — High Risk: Weak practices, actively leaking or ignoring risk

🟡 16–30 — Moderate Risk: Some protections, but major gaps remain

🔵 31–40 — Low Risk: Strong practices, minor refinements needed

🟢 41–50 — Excellent: Privacy-first mindset, minimal exposure

Domain Breakdown

🔴 Account & Identity Hygiene 0/10

🔴 Device Security & Hardening 0/10

🔴 Browsing & Online Behavior 0/10

🔴 Social & Exposure Management 0/10

🔴 Resilience & Response 0/10

Priority Improvements

Advanced Analysis

For a full remediation plan tailored to your profile, contact ObscureIQ. We build custom privacy defense strategies for high-risk individuals.

Privacy Recovery • Threat Intel • Digital Executive Protection

📞Improve Your Privacy with ObscureIQ

Request Advanced Analysis

Provide your contact information to receive a deeper analysis and tailored remediation plan.

Name or alias

Email address

📧

Email Verification Required

We've sent a 6-digit code to:

Verification code

Expires in 10 minutes

✅

Submitted Successfully!

Your advanced analysis request has been received. Our team will contact you shortly.

Share Results

Copy this link to share your results:

Processing Your Assessment

Analyzing your responses...

...