The Privacy Toolkit: 62 Apps to Take Back Your Data (2026)

Every few months, someone shares a screenshot of a privacy checklist and the replies split into the same two camps. One says this is all paranoid nonsense, they have nothing to hide, and anyway the convenience is worth it. The other says the checklist doesn’t go nearly far enough, and if you’re still carrying a smartphone at all you’ve already lost.

Both of these are wrong in the same way. They treat privacy as a single switch that’s either on or off, a binary state you either achieve or fail to achieve. And because “fully private” looks impossible, most people conclude there’s no point trying, and leave every default exactly where the biggest companies in the world set it for them.

That’s the real problem here, and it’s worth being clear about it before we get to any apps. The interesting thing about digital privacy in 2026 isn’t that surveillance is dramatic and cinematic. It’s that it’s boring, ambient, and mostly automatic. Nobody is reading your messages by hand. A system is quietly logging which sites you visit, which is then matched against a profile that was assembled from your purchases, your location history, and a data broker’s file on you, and the whole thing runs at a scale where no human is ever involved. You’re not being watched. You’re being processed.

Once you see it that way, the goal changes. You’re not trying to become invisible to a determined government. You’re trying to opt out of routine, industrial data collection, the same way you might put a lock on a diary without believing the lock would stop a burglar with a crowbar. It’s a reasonable default, not a fortress.

This guide is a tour of the tools that let you do that, sorted by what you’re actually protecting. There are 62 of them, which sounds like a lot, so here’s the most important thing up front: you do not need all 62, and you should not try to install them all this weekend. Most people get the large majority of the benefit from about five. The rest are here so that when you decide you care about a specific thing — your photos, your notes, your location — you know where to look. Think of it as a directory, not a to-do list.

We’ll explain the handful of concepts you need first, in plain English, because most privacy writing fails by assuming you already know what “end-to-end encrypted” means. Then we’ll go category by category. And near the end we’ll be honest about what these tools can’t do, because a guide that only tells you the good parts isn’t much of a guide.

Privacy is a dial, not a switch

The single most useful idea in this whole area is that privacy sits on a spectrum, and where you want to be on that spectrum is a personal decision that depends on who you’re actually worried about.

Security people have a term for this: your threat model. It sounds technical, but it just means answering one question honestly — who or what are you protecting yourself against? The answer for most people is not a spy agency. It’s advertisers building a profile to sell you things. It’s data brokers packaging up your life and selling it to whoever pays. It’s the very ordinary risk that a company you gave your password to gets hacked, and now that password unlocks your bank because you reused it. It’s an ex, a stalker, a nosy employer, a leaked database.

These are the everyday threats, and the good news is they’re the ones that ordinary tools handle well. You don’t need to defeat a nation-state to make yourself a bad target for automated data collection. You just need to stop leaving the doors open.

So as you read the rest of this, keep asking yourself: does this protect me from something I actually care about? If the answer is no, skip it without guilt. A private maps app matters enormously to someone who’s being followed and barely at all to someone who just wants fewer ads. Both answers are correct. The mistake is thinking there’s a single right level of paranoia and you have to reach it.

There’s also a cost side to the dial, and it’s worth naming now rather than pretending it doesn’t exist. More privacy usually means slightly less convenience, at least at first. A private search engine occasionally sends you back to Google for a stubborn local query. An encrypted messenger only works if the other person installs it too. Moving off a big platform means giving up some feature you’d quietly gotten used to. None of this is a dealbreaker, but it’s real, and the trick is to spend your patience where it buys you the most protection rather than trying to do everything at once and burning out by Tuesday.

A 90-second glossary, in plain English

You’ll see the same words over and over in this space, and they’re mostly simpler than they sound. Here’s what they actually mean.

End-to-end encryption. Imagine sending a letter. A postcard can be read by everyone who handles it — the postal workers, anyone it passes. A sealed envelope can only be opened by the person you sent it to. Most online services encrypt the postcard while it’s in transit, which stops a stranger on the same wifi from reading it, but the company itself can still open it whenever it likes. End-to-end encryption means the letter is sealed in a way that even the company carrying it can’t open. Only you and the person you’re talking to hold the key. When you see “E2EE,” that’s what it means.

Zero-access encryption. A close cousin, usually used for email and cloud storage. It means the company holds your data in a safe it doesn’t have the combination to. Your files are on their servers, but scrambled with a key only you control, so if the company is hacked, or subpoenaed, or simply curious, there’s nothing readable for anyone to hand over.

Metadata. This is the sneaky one, and it’s where most “private” services quietly fall down. Metadata is the outside of the envelope: not what you said, but who you said it to, when, how often, and from where. Even if nobody can read your messages, a record showing that you called a divorce lawyer, then a doctor, then your bank, three times in one evening, tells a story. Good privacy tools protect the contents. Great ones try to protect the pattern too. Whenever you evaluate an app, ask not just “can they read my messages” but “what can they see about my behavior.”

Open-source and audited. Open-source means the recipe is posted on the wall: the actual code that runs the app is published for anyone to read. That matters because it turns a promise into something checkable. Any company can say it doesn’t snoop on you. Only an open one lets outside experts verify it. “Audited” goes a step further — it means independent security researchers have gone through that code (and often the servers) looking for holes, like health inspectors going through a restaurant kitchen rather than reading the menu. When a tool is open-source and has passed a public audit, you’re trusting evidence instead of advertising.

Data brokers. Companies you’ve never heard of and never signed up with, whose entire business is assembling a dossier on you — your address history, your age, your income bracket, your health interests, your shopping — from public records and purchased app data, then selling that file to advertisers, insurers, and anyone else who pays. You are the product being traded, and you were never in the room.

VPN. A virtual private network reroutes your internet traffic through an encrypted tunnel, so your internet provider and the coffee-shop wifi can’t see which sites you’re visiting. The catch, and it’s a big one: the VPN company can now see that traffic instead. A VPN doesn’t remove trust, it moves it — from your internet provider to the VPN provider. That’s only an upgrade if the VPN provider is genuinely more trustworthy, which is why the specific company matters enormously.

DNS. Think of DNS as the internet’s phone book. Every time you visit a website, your device quietly looks up its number, and by default your internet provider handles that lookup — which means it sees, and often logs, every single site you go to. Changing your DNS provider is like switching to a phone book that doesn’t keep a record of what you looked up, and can also block ads and trackers before they ever load.

That’s the whole vocabulary. Keep the envelope, the safe, the outside of the envelope, the recipe on the wall, and the phone book in your head, and the rest of this will make sense.

Start here: the three foundations

If you do nothing else, do these three. They’re the highest return for the least effort, and they protect against the threats that actually get ordinary people.

Messaging

This is the easiest call in the entire guide. Install Signal. It’s end-to-end encrypted, it’s run by a nonprofit rather than an advertising company, it collects almost nothing about you, and it’s the messenger that security professionals actually use themselves. The one real obstacle is social: it only works if the people you talk to install it too. That’s not a technical problem, it’s a herding-cats problem, and the honest advice is to just start using it with the two or three people who’ll humor you and let it grow from there.

The others in this category are for specific needs rather than everyday use. Molly is a hardened version of Signal for Android that adds extra security features for people who want them. SimpleX Chat is the interesting one for the metadata-conscious: it’s built so there are no user accounts or identifiers at all, which makes it very hard to even map who’s talking to whom. Session routes messages through a decentralized network and needs no phone number. Briar is the tool for genuine emergencies — it can pass messages phone-to-phone with no internet at all, which matters during protests or outages. Most people need only the first one. It’s good to know the rest exist.

Passwords

Here’s the uncomfortable truth about how people actually get hacked: it’s almost never a movie-style break-in. It’s that you used the same password on a dozen sites, one of those sites got breached, and now someone has that password and is quietly trying it everywhere else. A password manager kills this entire problem. It generates a different, long, random password for every account and remembers them all, so you only have to remember one strong master password.

Bitwarden is the one to start with — open-source, free for the features most people need, and it works on every device. If you’d rather your passwords never touch anyone’s servers at all, KeePassXC keeps everything in a file you control on your own machine, which is more private but more fiddly to sync. Proton Pass is a strong option if you’re already in the Proton ecosystem. Pick one today. This is the single highest-value thing in this guide.

Email

Email is harder to move than the other two, because your address is tied to years of accounts and contacts, so treat this as a slow migration rather than a switch you flip. The mainstream providers scan your mail to build a profile of you; the private ones don’t, because they literally can’t read it.

Proton Mail is the best-known, with zero-access encryption and a genuinely usable free tier. Tuta is its closest rival and encrypts even more of the mailbox, including the subject lines and your contacts. If you want something that behaves more like a traditional, full-featured mail host while still respecting you, the underrated pick is Mailbox.org, a German provider that’s been quietly doing this well for years. Mailfence rounds out the group. The realistic move is to open a private account, start using it for anything new, and migrate the important stuff over months. You don’t have to do it all at once.

How you browse, search, and connect

This is the layer where most ambient tracking actually happens — the quiet accumulation of everywhere you go. Fixing it is mostly about swapping four defaults.

Your browser

Your browser is the room you spend most of your online life in, and by default it leaks a surprising amount about you through something called fingerprinting: the unique combination of your screen size, fonts, settings, and dozens of other details that together identify you even without cookies.

The standout, and it’s a genuinely underrated one, is Mullvad Browser. It was built by the Tor Project together with Mullvad specifically to make everyone’s browser look identical, so you blend into the crowd. It’s the Tor Browser’s privacy without the slow Tor network. LibreWolf is a version of Firefox with the tracking and telemetry stripped out and privacy turned up, and it’s a strong everyday recommendation for most people. Brave is the most convenient option, with ad and tracker blocking built in, though it’s a commercial product with its own ad business, so it sits slightly lower on the trust ladder. And Tor Browser remains the tool for when you need to be genuinely hard to trace, at the cost of speed.

Your search engine

Switching your default search engine is one of the smallest changes with one of the most visible payoffs, because you stop feeding your curiosity, worries, and plans into an advertising machine. DuckDuckGo is the easy, familiar default that doesn’t track your searches. Brave Search runs on its own independent index rather than quietly relying on Google’s, which is rarer than you’d think. Startpage gives you Google’s actual results without Google seeing that it was you who searched. And SearXNG is the option for tinkerers — an open-source metasearch tool you can even run yourself, pulling from many engines while keeping you anonymous.

A VPN, used correctly

Remember the trade from the glossary: a VPN moves your trust from your internet provider to the VPN company, so the only VPNs worth using are the ones that have proven they’re worthy of that trust. Ignore the loud, cheap, heavily advertised ones. Mullvad is the gold standard — it doesn’t even ask for your email, you can pay anonymously, and it’s been audited repeatedly. Proton VPN is the other strong pick and, unusually, has a genuinely trustworthy free tier. IVPN is a smaller, equally principled alternative. A VPN is useful on untrusted wifi and for keeping your provider from logging your every move. It is not a magic cloak, and we’ll come back to that.

DNS and ad-blocking

This is the invisible upgrade almost nobody makes, and it quietly improves everything. By changing your DNS, you can block ads, trackers, and malware for every app on your device at once, before they even load. NextDNS is the easiest way in — you set it once and it protects your whole device, with a free tier that covers most people. AdGuard does similar work as an app or system-wide filter. Pi-hole is the enthusiast’s choice, a small server for your whole home network. And the classic uBlock Origin browser extension remains the single best ad-blocker there is, and it’s free. If you install nothing else from this section, install that.

Locking down your accounts

Your data is only as private as the accounts holding it, and two cheap habits make those accounts dramatically harder to break into.

Two-factor authentication

Two-factor authentication (2FA) adds a second lock to your accounts: even if someone steals your password, they still need a code that only your device can generate. Most people use a text message for this, which is better than nothing but can be hijacked. An authenticator app is safer, and there are excellent free ones.

Aegis is the pick on Android — open-source, encrypted, and it lets you back up your codes so you’re not locked out if you lose your phone. Ente Auth works everywhere and syncs your codes across devices with end-to-end encryption, which solves the classic nightmare of a lost phone taking your accounts with it. 2FAS is another clean, friendly option. And Proton Authenticator is a newer entry that works across phones and desktops. Any of these beats getting your codes by text.

Email aliases

This one feels like a small trick and turns out to be one of the most satisfying tools on the list. An alias is a disposable, forwarding email address you hand out instead of your real one — a different one for each service. When a company leaks your data or starts selling it, you can see exactly who did it, because the spam arrives at the address you only ever gave to them, and you can switch that single alias off without touching your real inbox.

SimpleLogin (now part of Proton) and addy.io are the two underrated stars here — both let you generate unlimited aliases on the fly. Firefox Relay does the same from Mozilla, and DuckDuckGo Email Protection throws in tracker-stripping, quietly removing the spy pixels from your mail as it forwards. Once you start using aliases you won’t want to stop.

Your files, photos, and notes

This is the category people underrate until the day they think about what’s actually sitting in their cloud storage — years of documents, photos of their kids, half-formed private thoughts in a notes app — all readable by the company hosting it. Encryption fixes that.

Encrypted cloud storage

The mainstream cloud drives can read your files. The private ones can’t. Proton Drive is the straightforward end-to-end encrypted option. Filen is a strong, underrated alternative with generous storage. If you’d rather keep using a service you already have, Cryptomator is a clever tool that encrypts your files before they go up, so you can put a locked vault inside an ordinary cloud drive and the provider only ever sees scrambled data. And Syncthing skips the cloud entirely, syncing files directly between your own devices with no company in the middle at all.

Photos

Your photo library is probably the most personal archive you own, which is exactly why the private option here is worth the switch. Ente Photos is the standout — a genuinely polished, end-to-end encrypted alternative to the big photo services, open-source, independently audited, and pleasant enough to use that it doesn’t feel like a sacrifice. Cryptee handles encrypted photos and documents together, and Stingle is another open-source, encrypted gallery. If you move one thing off a mainstream platform this year, consider making it your photos.

Notes

Notes apps quietly become diaries — passwords, plans, worries, ideas you’d never say out loud. Standard Notes is end-to-end encrypted by default and deliberately simple. Joplin is the open-source workhorse, with encryption and the ability to sync however you like. Obsidian keeps everything in plain files on your own machine, which is a quiet kind of privacy, and it’s beloved by people who want to actually own their notes. Anytype is a newer, local-first, encrypted take for people who want something more structured.

File encryption

Sometimes you just want to lock a specific file or folder, hard. VeraCrypt is the long-standing, battle-tested tool for creating encrypted vaults on your computer. Cryptomator shows up again here because it’s great for this too. And Picocrypt is the underrated one — tiny, simple, and very strong, ideal for encrypting a file before you email or back it up. Note that Picocrypt’s original author has since archived it as complete rather than abandoned, so it still works; a community successor exists if you want ongoing updates.

Your phone and your movements

Two things about a smartphone are unusually revealing: everywhere you physically go, and the fact that the phone’s own operating system is often the biggest data collector on it. Here’s how to push back on both.

Your location history is arguably the most sensitive data you generate, because it reveals where you live, work, sleep, worship, and seek medical care, all without a word of text. The private map apps keep that to themselves. Organic Maps is the lovely, lightweight, offline-first pick built on open map data, with no tracking and no accounts. OsmAnd is the power-user option, packed with features for hikers, cyclists, and travelers. CoMaps is a newer community-run fork of Organic Maps, worth watching. And Magic Earth offers turn-by-turn navigation with live traffic while still promising not to track you, which is the feature most people miss when they leave the mainstream apps.

De-Googling your phone

This is the deep end, and I want to be clear that most people never need to come here. But if you want to reduce how much your phone itself is watching you, there’s a well-trodden path. GrapheneOS is a hardened, de-Googled version of Android (Pixel phones only) that’s the genuine article for security — it’s what the serious people run. Short of replacing your whole operating system, you can swap individual pieces: Aurora Store lets you download Android apps without a Google account, F-Droid is an app store of open-source software, HeliBoard is a keyboard that has no internet access at all (worth pausing on — your keyboard sees literally everything you type), and NewPipe lets you watch videos without the tracking and ads of the official app. You can adopt these one at a time, and each one stands on its own.

Cleaning up the mess already out there

Everything so far reduces the data you leak from now on. This last category deals with the data that’s already escaped — the files data brokers have been quietly building and selling for years.

The brokers won’t delete your file unless you make them, and there are hundreds of them, so doing it by hand is a part-time job. Incogni and DeleteMe are paid services that send removal requests to data brokers on your behalf, over and over, because the brokers tend to quietly repopulate. This is one place where paying for a service genuinely saves you dozens of hours. On the free side, Mozilla Monitor and Have I Been Pwned tell you which known breaches your email has turned up in, so you know which passwords to change. Start with the free breach check today; it takes about thirty seconds and is often a useful jolt.

You don’t need all 62. Here’s a realistic plan.

The failure mode with a list this long is trying to do everything in one heroic weekend, getting overwhelmed by hour three, and abandoning the whole project. So don’t do that. Here’s a sensible order.

This week, do the three foundations. Install Signal and nudge a couple of people onto it. Set up Bitwarden and let it start replacing your reused passwords as you log into things. Run the free breach check on Have I Been Pwned so you know where you stand. That’s it. Three things, maybe an hour total, and you’ve already closed off the risks that catch most people.

Over the next month, upgrade how you browse. Switch your search engine to DuckDuckGo or Brave Search. Install uBlock Origin. Move to a private browser like LibreWolf or Mullvad Browser. Turn on an authenticator app for your important accounts. None of this is hard, and it’s the layer that quietly stops most day-to-day tracking.

Then, when you feel like it, go deeper on whatever you actually care about. Open a Proton Mail account and start the slow email migration. Move your photos to Ente. Add a Mullvad subscription. Try email aliases. Pick a private maps app. Each of these is optional and stands alone, so you can pick the two that match your life and ignore the rest without missing anything.

The de-Googled phone, if you ever get there, is the last step and the one the fewest people need. That’s the correct order. Foundations, then browsing, then the specific things you care about, then maybe the deep end.

The honest part: what these tools won’t do

A guide that only tells you the good news is really an advertisement, so here’s the sober version.

They won’t make you anonymous, and they’re not supposed to. The goal was never invisibility; it was opting out of automated, industrial data collection. If your threat model genuinely includes a well-resourced government adversary, you need far more than an app list and probably professional advice. For everyone else, chasing total anonymity is a way to waste effort and eventually give up.

The network effect is real and frustrating. You can switch to Signal in five minutes, but you can’t make your family and friends switch, and an encrypted messenger with nobody to talk to is just an icon on your home screen. This is the single biggest reason privacy tools don’t stick, and there’s no clever fix. You lead by using them and accept that adoption is slow.

A VPN is not a force field. It’s the most oversold product in this entire space. It hides your traffic from your internet provider and shifts that visibility to the VPN company; it does not make you untraceable, it does not stop websites from tracking you once you’re logged in, and it does not protect you from your own habits. Use one for what it’s good for and ignore the marketing that implies it does everything.

Some things will break, occasionally. A private browser will trip a website that demands you look ordinary. A de-Googled phone won’t run a banking app that insists on Google’s services. Aliases confuse the occasional customer-service rep. These are minor and usually solvable, but if you expect a perfectly frictionless experience you’ll be annoyed, and if you expect the odd rough edge you’ll shrug and move on.

And the biggest vulnerability is usually you. No tool on this list protects you from reusing a password, clicking a convincing phishing link, or oversharing on a platform you never left. The unglamorous habits — unique passwords, two-factor authentication, a moment of skepticism before you click — do more than any single app. The apps are the easy part. The habits are the whole game.

How to judge a privacy tool yourself

New tools appear constantly, old ones get bought and quietly change, and no list stays current forever, so the durable skill isn’t memorizing which app is best this year — it’s being able to size one up on your own. Four questions do most of the work.

Is it open-source, and has it been audited? Open code means the promise is checkable rather than just stated. An independent audit means someone qualified actually checked. Both together is the gold standard, and most of the best tools on this list clear that bar.

How does it make money? This is the question that cuts through the most marketing. A subscription or donation model means you’re the customer. A free product with a vague business model means you might still be the product, funded by the very data collection you’re trying to escape. Follow the money and a lot becomes clear.

Where is it based, and who can compel it? A company is subject to the laws of its country, including demands for user data. This matters less if the service is built so it has nothing readable to hand over in the first place, which is exactly why zero-access encryption is such a big deal — it takes the question off the table.

What can it see even when it’s working perfectly? Come back to metadata. A messenger can encrypt every word and still keep a record of who you talk to and when. The best tools are the ones designed to know as little about you as technically possible, so that even a breach or a subpoena turns up nothing worth having.

Run a new tool through those four questions and you’ll usually land in the right place without needing anyone’s list at all.

The complete directory

Here are all 62, grouped by category, with links. Bookmark this section; it’s the reference you’ll come back to.

Messaging — Signal, Molly, SimpleX Chat, Session, Briar

Private email — Proton Mail, Tuta, Mailbox.org, Mailfence

Email aliases — SimpleLogin, addy.io, Firefox Relay, DuckDuckGo Email

Browser — Mullvad Browser, LibreWolf, Brave, Tor Browser

Search engine — DuckDuckGo, Brave Search, Startpage, SearXNG

VPN — Mullvad, Proton VPN, IVPN

Passwords — Bitwarden, KeePassXC, Proton Pass

2FA / authenticator — Aegis, Ente Auth, 2FAS, Proton Authenticator

DNS and ad-blocking — NextDNS, AdGuard, Pi-hole, uBlock Origin

Encrypted cloud storage — Proton Drive, Filen, Cryptomator, Syncthing

Private photos — Ente Photos, Cryptee, Stingle

Private notes — Standard Notes, Joplin, Obsidian, Anytype

File encryption — VeraCrypt, Cryptomator, Picocrypt

Maps and navigation — Organic Maps, OsmAnd, CoMaps, Magic Earth

De-Google your phone — GrapheneOS, Aurora Store, F-Droid, HeliBoard, NewPipe

Data broker removal — Incogni, DeleteMe, Mozilla Monitor, Have I Been Pwned

Where this leaves you

The point of all this was never purity. It’s not a competition, there’s no score, and nobody’s grading you on how many mainstream apps you’ve purged. The point is that the defaults were set by companies whose interests aren’t yours, and you’re allowed to change them.

So change a few. Install the messenger, get the password manager, run the breach check, and see how it feels. My guess is that it feels like almost nothing — that’s the whole idea — except that a little less of your life is being quietly logged, sorted, and sold. Then, when you next find yourself thinking about your photos, or your location, or the diary you’ve been keeping in a notes app, you’ll know there’s a better option and where to find it.

Privacy in 2026 isn’t a wall you build once. It’s a handful of small, sensible decisions you make when you’re ready, on the parts of your life you actually care about. Start with three. The other 59 will still be here when you want them.

Found this useful? We break down tools like these without the hype over on YouTube and Instagram at @BeingAiReady. Save this guide, and send it to the one person in your life who needs it.

Frequently asked questions

What is the single most important privacy change I can make?

Stop reusing passwords. Install a password manager like Bitwarden, let it generate a different long password for every account, and turn on two-factor authentication for your email. Most people are not undone by exotic surveillance; they are undone by one leaked password that also unlocked twenty other accounts. This one change removes that entire category of risk in an afternoon.

Are free privacy apps actually safe to use?

Often the free ones are the safest, because the best privacy tools are open-source and funded by subscriptions or donations rather than by advertising. The thing to check is how the company makes money. If a product is free and the business model is unclear, you may still be the product. If it is free because it is a nonprofit or community project with published, audited code, that is a very different situation.

What is the difference between a VPN and a private browser?

A VPN hides where your traffic is going from your internet provider and the local network, but the VPN company can now see it instead, so you are moving your trust rather than removing it. A private browser like Mullvad Browser or LibreWolf reduces how much websites can track and fingerprint you while you are on them. They solve different problems, and using one does not replace the other.

Is Signal really more private than WhatsApp?

Yes, and the difference is mostly about metadata and ownership. Both encrypt message content, but WhatsApp is owned by Meta and still collects information about who you talk to and how often. Signal is run by a nonprofit, collects almost nothing, and is built so that even Signal cannot see your contacts or messages. Signal is the one app on this entire list that almost everyone should install first.

Do I need to buy a new phone to be more private?

No. A de-Googled phone with GrapheneOS is the deep end of the pool, and most people never need to go there. You get the large majority of the benefit by simply replacing individual apps: a private browser, a private search engine, an encrypted messenger, and a password manager. Start with the apps and only consider the phone later, if ever.

What does open-source mean, and why does it matter for privacy?

Open-source means the code that runs the app is published for anyone to read. For privacy that matters because it turns a promise into something checkable. A company can claim it does not read your messages, but if the code is closed, you are trusting the marketing. If the code is open and has been independently audited, outside experts have looked inside the kitchen rather than reading the menu.

Can these tools make me completely anonymous online?

No, and anything that promises total anonymity is overselling. The realistic goal is not invisibility; it is putting sensible defaults in place so you stop leaking data by accident. You are trying to opt out of routine, automated data collection, not disappear from a determined investigator. Setting that expectation correctly is what stops people from either giving up or wasting effort on the wrong things.

Are paid privacy tools worth it over the free versions?

Sometimes, and it depends on the category. For a VPN, paying for an audited provider like Mullvad or Proton is worth it, because a free VPN has to make money somehow and that usually means selling your traffic. For password managers, note-taking, and messaging, the free open-source options are excellent and you may never need to pay. Spend money where the free version's business model would otherwise compromise you.