This is not a company story.
It's yours.
Every chapter below happened to someone real. The names change. The shape of the vulnerability doesn't. Read it as a campfire story — the kind that gets quieter as it goes, because the truth doesn't need to shout.
The day I found out how much of me had already been sold.
I was a journalist covering a story about data brokers — the kind of companies most people have never heard of. To research, I ran my own name through three of them. What came back stopped me cold: my home address, the names of my family members, my income bracket, my political leanings inferred from purchase history, the approximate times I was home each day based on device pings. All of it, packaged and priced at $0.003 per record.
I hadn't consented to any of it. I hadn't even known it was possible. And in that moment, something shifted — the way you feel when you realize the room you thought was private had a window you never noticed.
A colleague's source was burned. The leak was a metadata trail we'd left without thinking.
We were careful. We used Signal. We met in person. But we'd made one small mistake: a single email thread, months earlier, where the source had asked a question using a work account. That thread sat dormant in a corporate server. When the company was subpoenaed, the thread surfaced. The source lost their job. We lost something harder to name — the confidence that being careful was enough.
That was when I stopped writing about privacy and started building for it.
The first tool was built on a $400 laptop and ran on stubbornness.
The initial version of what became Cipher was a set of Python scripts and a checklist printed on index cards. It helped journalists audit their own digital footprints before beginning sensitive investigations. I gave it away free to anyone who asked — which turned out to be more people than I expected. A human rights lawyer in Istanbul. A freelance photographer in Hong Kong. A parent in Ohio who'd discovered their daughter's school app was selling her location data to seventeen different companies.
The need was everywhere. The tools were nowhere.
A journalist in a country with no press freedom asked for help. We said yes.
She was reporting on corruption in local government. Her sources were frightened. She needed a way to communicate that left no trace, store documents that couldn't be seized, and verify her own security posture without exposing herself to more risk by searching for answers online. We worked with her for three weeks. Her story ran. Her sources remained safe.
That was the moment Cipher became an organization rather than a project.
If any of this sounds familiar — you're already part of this story.
Reclaim Your Privacy