Privacy claims should be tested, not trusted. Product behaviour tested against privacy claims. Expert-reviewed evidence.
Joined October 2026
- Tweets29
- Following9
- Followers63
- Likes23
Pinned Tweet
Most apps say they respect your privacy. Few get tested on it.
@Prynoid checks what products actually do vs what they promise. AI, apps, browsers, SDKs, consent flows. Expert-reviewed evidence.
Building something? Get it tested before someone else does: prynoid.com
An iris scan takes seconds. Undoing one took a court case.
Before you hand over a body part as a password, ask: can this ever be taken back?
On 5 May 2025, Kenya's High Court ordered Worldcoin entities to permanently erase biometric data collected from Kenyans. It also barred further collection without a data protection impact assessment and lawful consent. That is one ruling, under Kenyan law, about one operation.
Users: ask who keeps the template, and for how long. Builders: finish the impact assessment before the first scan, not after it.
#Privacy #Biometrics #Kenya
One like seems small. Together, your likes can hint at what you believe and who you love.
So ask: when does an "interest" become a sensitive trait?
In November 2024, Korea's Personal Information Protection Commission fined Meta KRW 21.6 billion. It found Meta had collected sensitive information, such as religious and political views and sexual orientation, from Korean Facebook users and used it for advertising without a lawful basis. The decision applies Korean law to Meta's past practices.
Users: review your ad-interest settings. Builders: check whether your audience segments are proxies for sensitive data.
See how Prynoid checks what your data really says.
prynoid.com/services/
Source: pipc.go.kr/eng/user/ltn/new/…
#Privacy #AdTech #SensitiveData
1 June 2022: Canada's privacy commissioners publish findings on the Tim Hortons app.
You order one coffee. For months afterwards, the app may log where you sleep and where you work.
The commissioners found the app tracked location as often as every few minutes, including when it was not open, and could infer home and work. Tim Hortons said it used the data only in aggregate and agreed to delete it. PIPEDA did not allow a fine.
Users: check which apps have "Always" location. Builders: prove background collection stops when the app closes.
How we test privacy claims: prynoid.com/services/
Source: priv.gc.ca/en/opc-actions-an…
#Privacy #Location
Some apps read your clipboard when they come to the foreground — not only when you tap Paste. That can include one-time codes, addresses, or a password you just copied. On iPhone, recent iOS versions show a banner when an app reads the clipboard; treat that as a signal, not noise. Prefer Share sheets over copy-paste for sensitive text, and clear the clipboard after OTPs. On Android, check which apps have notification access and “draw over other apps” — listeners can read OTPs that appear in notifications, and overlays are a known path for stealing passwords and taps.
At Prynoid we test claims against behaviour, including what an app touches when you are not looking.
prynoid.com/services/
Source: mysk.blog/2020/03/10/popular…
#privacy #clipboard #mobile
On 22 October 2026, France's CNIL fined two Fnac companies €7 million. It found the Fnac app sent a user identifier and viewed-product activity to a third-party domain without consent, and failed to recognise users' choice not to consent. The companies can still appeal.
Users: check which apps you have told no. Builders: test the network after "reject", not just the banner.
You said no. Did anything still leave the phone?
Explore how Prynoid tests whether a "no" is respected.
prynoid.com/services/
Source: cnil.fr/en/sanction-app-cook…
#Privacy #CNIL #GDPR
google updated its privacy policy on october 16.
your gmail, drive, and photos can now inform ad targeting, if you’ve connected those apps to google search or gemini.
Many people have.
How to disconnect:
Google Account → Data & privacy → Connected Content apps → turn off
Note: data already collected may still be in your Search history after you disconnect. Google hasn’t clarified what that clears.
A privacy promise with a new condition attached is a different promise.
on october 16, google quietly updated its privacy policy to create a new exception to one of its oldest promises.
the old rule: gmail, drive, and google photos content would never be used to target ads. google held that line for years. the logic was that your inbox, your documents, your personal photos are too private to touch.
the new rule: same thing, unless you’ve connected those apps to other google services.
and here’s where it gets interesting. google has spent the last two years aggressively pushing you to do exactly that. Connect your gmail to AI Mode in Search. connect your drive to Gemini the pitch was “more useful answers.” you can find a hotel reservation in your inbox from search.
what changed october 16 is that the same connection that makes AI features smarter now also opens that data pool to ad personalization. the email about your upcoming surgery, the shared document about your salary, the photos from your kid’s school once you’ve connected those apps, google search can now process that content to “personalize content, including ads.”
Is Your Privacy Being Manipulated?
One Click to Accept. Millions in Fines for Making Refusal Difficult.
Ever wondered why accepting cookies takes one click, but rejecting them requires navigating several settings?
In 2022, France fined Google €150 million and Facebook €60 million for making cookie rejection unnecessarily difficult.
These are not harmless pop-ups. Advertising cookies can track your browsing behaviour, build profiles of your interests and influence the adverts you see, sometimes involving sensitive personal activities. In 2025, Google received another €325 million fine in France, partly for obtaining invalid consent for advertising cookies.
The problem is simple: privacy should be a choice, not an obstacle course.
At Prynoid, we believe privacy claims should be tested, not trusted.
#Prynoid #DataPrivacy #GDPR #CookieConsent #PrivacyMatters #DataProtection #DigitalPrivacy #PrivacyRights #PrivacyTesting #CyberSecurity #PrivacyCompliance #OnlineTracking #UserConsent #PrivacyByDesign #DigitalRights #PrivacyAwareness
When you reject tracking while shopping online, you expect that decision to shape what happens next. France’s CNIL identified a gap between choice and behaviour in its September 2025 SHEIN decision, which described cookies placed before consent and problems with refusal and withdrawal. The regulator imposed a €150 million fine over those practices.
The case gives product teams a reason to examine the journey after a choice, including later pages and connected features. A clearly labelled button is only useful when the behaviour behind it respects the decision it offers. Explore how Prynoid tests privacy claims against application behaviour, with findings reviewed by experts and their limits explained.
prynoid.com/services/privacy…
Source: cnil.fr/en/cookies-placed-wi…
Privacy and security go hand in hand.
Prynoid tests whether products keep their privacy promises. @PhishCore tests the human side of security.
Together, we’re helping organizations test what happens beyond the policies and promises.
PhishCore is partnering with @Prynoid, and the idea behind this partnership is simple: don’t just trust what the policy says. Test what actually happens.
At PhishCore, we test how people respond when a phishing email lands in their inbox.
At Prynoid, they test whether products handle people’s data the way they claim to.
Different sides of the same problem.
A security policy can say employees know how to spot phishing. A privacy policy can promise that people’s data is handled responsibly. But having a policy is one thing. Knowing what happens in practice is another.
That’s why we’re starting with Prynoid putting PhishCore to the test.
We work with behavioural data from phishing simulations, and we believe our own privacy claims should be held to the same standard as everyone else’s. If we ask organizations to take security and privacy seriously, we have to be willing to prove that we do too.
From there, we’ll explore a joint people-and-product assessment for organizations that handle sensitive information.
Because protecting an organization isn’t just about the people or the technology. It’s about both.
People and products. Tested, not assumed.
Prynoid retweeted
PhishCore is partnering with @Prynoid, and the idea behind this partnership is simple: don’t just trust what the policy says. Test what actually happens.
At PhishCore, we test how people respond when a phishing email lands in their inbox.
At Prynoid, they test whether products handle people’s data the way they claim to.
Different sides of the same problem.
A security policy can say employees know how to spot phishing. A privacy policy can promise that people’s data is handled responsibly. But having a policy is one thing. Knowing what happens in practice is another.
That’s why we’re starting with Prynoid putting PhishCore to the test.
We work with behavioural data from phishing simulations, and we believe our own privacy claims should be held to the same standard as everyone else’s. If we ask organizations to take security and privacy seriously, we have to be willing to prove that we do too.
From there, we’ll explore a joint people-and-product assessment for organizations that handle sensitive information.
Because protecting an organization isn’t just about the people or the technology. It’s about both.
People and products. Tested, not assumed.