I am writing a page to document how my tech stack has evolved recently. I will continue to update this page as the process continues to document the reasons why I am updating my tech stack and the choices I have made along the way. I know it is rather silly to enumerate my entire attack surface to hackers, but really, some of these companies are so good I really can’t resist sharing.

Why

Surveillance is the hallmark of fascism

In the quest to find safer software privacy alternatives, it’s crucial to avoid painting giant swaths of the industry as simply good or bad based on primitive judgment calls like country of origin. While Canada’s “Elbows Up” strategy is admirable and necessary, it is also a crude instrument for protecting one’s privacy. History teaches us that it’s easy to simplify complex struggles like World War II into “goodies” and “baddies,” but this oversimplification doesn’t survive even the most basic analysis of history, the truth is always more complex. Similarly, while we can agree that Putin’s Russia is an authoritarian regime, the Trump administration shows authoritarian tendencies, and democracy is in global retreat. We can reference Mark Carney’s Davos or European Parliament speeches to show Canada as the de facto leader of the global resistance. To then say that all Canadian and European software is “good” and all U.S., Russian, or Chinese software is “bad” divorces us from reality. We must recognize that there are authoritarian and anti-authoritarian tendencies in every corner of the globe, and that digital sovereignty is a complex and nuanced topic.

Surveillance is the hallmark of authoritarianism and fascism. As a society moves toward authoritarianism, it devotes increasing resources to surveillance of its citizens. Surveillance can be used as a barometer of democracy’s retreat. When one thinks about the most oppressive components of an authoritarian society such as communist East Germany, it is the massive files the Stasi kept on it’s citizens that stands out as the most egregious state transgression. The digital nature of modern life means that the amount of resources a state needs to expend in order to surveil it’s citizenry is greatly reduced. Therefore, choosing and advocating for privacy-first, sovereign tech stacks is one of the most powerful things we can do to thwart authoritarianism.

We must also recognize that the justifications for surveillance have always been suspect. Despite the fact that society has been able to catch and prosecute criminals for as long as there have been crimes, there is always some new bogeyman that justifies why the entire population must be surveilled. During the Cold War, the bogeyman was communists. After the fall of the Berlin Wall, terrorists became the new bogeyman. Today the bogeyman is child sexual predators. This excuse is particularly rich since when we have mountains of evidence of child sexual abuse in the Epstein files, we do nothing if the perpetrator is rich and powerful. This pattern reveals that the threat of surveillance is rarely about genuine public safety, it’s about control and power.

We must not create a “cult of personality” around Mark Carney or any other leader, as such personality cults are themselves authoritarian acts. The Liberal government is attempting to pass laws that seriously impede upon Canadian’s right to privacy. Nor can we accept the “Elbows Up” strategy’s basic flaw: portraying all Canadian companies as good and all American companies as bad, which is far from the truth. Blind nationalism is not an antidote to the irrational trade war the United States has launched against the world. Ultimately, those interested in protecting our freedoms, privacy, and democracy must make a real effort to constantly educate themselves and to assert agency in choosing their software stack, as software and regulatory environments inevitably evolve.

Edward Snowden‘s Legacy

In June 2013, Edward Snowden, a contractor for the US National Security Agency (NSA), gave thousands of secret documents to journalists. The first reports appeared in The Guardian and The Washington Post. They showed that the NSA and its allies collected data on a very large scale, also about people who were not suspects. Some of his main revelations include:

Bulk phone records (Section 215 of the Patriot Act): A secret court order made Verizon give the NSA the metadata of all its customers’ calls every day: numbers, times and durations. This applied to millions of Americans.
PRISM (Section 702 of FISA): The NSA got data from large US tech companies, for example Google, Microsoft, Apple, Facebook and Yahoo.
Upstream collection: The NSA collects data directly from the fibre-optic cables of the internet, with help from telecom companies.
XKeyscore: A search tool that let analysts search large databases of emails, chats and browsing history.
MUSCULAR: The NSA and the UK agency GCHQ secretly tapped the private links between Google’s and Yahoo’s data centres. The companies did not know this.
Weaker encryption (Bullrun): The NSA worked to weaken encryption standards and to put weaknesses into security products. For example, it influenced a random number standard (Dual_EC_DRBG).
Spying on allies: The NSA monitored the phone of German Chancellor Angela Merkel and other world leaders.
Five Eyes cooperation: The US, the UK, Canada, Australia and New Zealand shared surveillance data and helped each other.
Canada’s signals intelligence agency, then named CSEC (now CSE), used data from free Wi-Fi at a Canadian airport to track travellers for days after they left the airport (CBC, 2014).
Canada let the NSA conduct surveillance during the G8 and G20 summits in Toronto in 2010.
Canada’s CSEC spied on Brazil’s Ministry of Mines and Energy.

The US charged Edward Snowden under the Espionage Act. He lives in Russia and became a Russian citizen in 2022. In response, the USA Freedom Act (2015) stopped the NSA’s bulk collection of US phone records, however the USA still provides no protections for non-US citizens.

Europe

General Data Protection Regulation (The GDPR)

The GDPR (General Data Protection Regulation) is the main privacy law of the European Union. Many people consider it the strongest general privacy law in the world.

Organizations must:

collect data only for clear, specific purposes,
collect only the minimum data that they need,
keep data only for as long as necessary,
keep data accurate and secure,
be able to show that they obey the law.

Your rights under the GDPR:

Access: see the data that a company has about you.
Correction of incorrect data.
Erasure: the “right to be forgotten”, in some cases.
Portability: get your data in a format that you can move to another service.
Objection: stop some uses, for example direct marketing.
Protection from decisions that only a computer makes, if they have important effects on you.

Enforcement:

Each EU country has a data protection authority.
Fines can be up to €20 million or 4% of the company’s worldwide annual revenue, whichever is larger.
Companies must report serious data breaches within 72 hours.
The largest fine so far: €1.2 billion against Meta in 2023, for transfers of EU data to the US.

Data Retention Directive (2006/24/EC)

In response to the terrorist attacks in Madrid (2004) and London (2005), the EU adopted The Data Retention Directive (2006/24/EC) in 2006. Much like Canada’s Bill C-22, this law made telecom and internet providers keep metadata about all users for 6 to 24 months. This data included who you called or emailed, when, for how long, and from which location. It did not include the content of communications.

The privacy group Digital Rights Ireland, and more than 11,000 Austrian citizens in a separate case, challenged the law in national courts, which referred the question to the European Court of Justice. The Court said that the directive interfered seriously with two rights in the EU Charter of Fundamental Rights: respect for private life (Article 7) and protection of personal data (Article 8), and cancelled the law on April 8, 2014. The court’s reasoning for cancelling the law included:

It applied to all people, also people with no link to any crime.
It did not limit retention to a specific time, area or group of people.
It did not have clear rules about which authorities could get access, and for which crimes.
Access did not need prior approval by a court or an independent body.
It did not make the retention period depend on the type of data or its usefulness.
It did not require that providers keep the data inside the EU, or protect it sufficiently.

EU “Chat Control” (CSA Regulation)

Terrorism is out of vogue as the surveillance-justifying bogey man, but the child sexual abuse bogey man allows the EU to try its hand at mass surveillance again, this time attempting to view the content of messages, not just the metadata. The original EU “Chat Control” made the detection and reporting of child sexual abuse material a legal requirement for all digital platforms, which of course requires all digital platforms to monitor all private communications regardless of content. However this law is still not agreed upon, even after 5 rounds of negotiation and significant pushback from privacy groups, the requirement to scan all encrypted messages has been removed.

EU data retention and encryption plans (ProtectEU)

This is a strategy, not a law. The intent of this strategy is to give Europol “next-generation decryption capabilities”. It remains to be seen what laws will flow out of this effort, and whether they will survive the inevitable court challenges.

The special case of Proton and Switzerland

Switzerland is not a member of the EU, so the European Court of Justice has no jurisdiction over Swiss law. However, it is subject to the European Court of Human Rights, as Switzerland is a member of the Council of Europe, an important distinction. In Podchasov v. Russia (2024) the European Court of Human Rights decided that a law that requires the weakening of encryption for all users violates the right to private life. This decision applies as a standard to all member of the Council of Europe, including Switzerland.

Switzerland’s surveillance ordinance (VÜPF) would have enabled mass metadata surveillance and removal of some types of encryption. Proton started to move its servers and infrastructure out of Switzerland as this law came closer to passing. Switzerland backed down and this law did not come into effect. Rather, the law was sent for impact analysis and revision. This shows that privacy-first software companies like Proton can have as much influence as citizen’s groups in protecting privacy. One can hope that Signal’s and Proton’s objections to Bill C-22 can have a similar effect in Canada.

Eurostack

All this to say that the GDPR, a strong judiciary in the European Court of Justice, and a general culture of privacy consciousness makes Europe a bastion of privacy-centric software companies.

In response to geopolitical tension, Europeans are creating the Eurostack, which enumerates European developed and hosted software for most use cases. The Eurostack is composed of trusted European services and open source technologies that champion interoperability, GDPR compliance, and put you in control of your digital stack. It is no coincidence that many of my software choices are listed here.

The GDPR combined with a strong judiciary

Canada

PIPEDA

The Personal Information Protection and Electronic Documents Act (PEPIDA) is Canada’s federal privacy law for the private sector. For government services, there is the colliery Privacy Act. Under PIPEDA:

You can ask a company for the personal information that it has about you.
You can ask it to correct errors.
You can complain to the Privacy Commissioner of Canada.
Since 2018, companies must report serious data breaches to the Commissioner and tell the affected people.

The EU considers PIPEDA “adequate”. Thus, personal data can move from the EU to Canadian companies that PIPEDA covers.

Protecting Privacy and Consumer Data Act (PPCDA)

PIPEDA is now more than 25 years old and needs to be updated to account for mobile phones, social media and AI. On June 15, 2026, the government introduced Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA), which would modernize the privacy part of PIPEDA. This is the third attempt in six years. Bills C-11 (2020) and C-27 (2022) did not pass. PPCDA would recognize privacy as a fundamental right, and would introduce fines of up to $10 million for non-compliance.

The Lawful Access Act (Bill C-22)

The Canadian Senate is at second reading of this Bill C-22, and it could receive Royal Assent in as short as a few months. Over 300 organizations oppose the privacy parts of the bill. More than 25 civil liberties, refugee rights and privacy groups, and 15 privacy scholars, ask for its withdrawal.

Bill C-22 allows the Canadian government to require companies to store metadata about all Canadian citizens, not just Canadians suspect of a crime. It also targets non-Canadian users of Canadian software, making Canadian software companies less competitive globally. It also lowers the standard of evidence required for the government to demand release of subscriber data. Metadata can reveal health data, religious and political activities, location data and who you associate with
Bill C-22 has text that says that it protects encryption but critics contend that this protection is not reliable because the government is open to changing the definition of “encryption” by regulation. The bill has been amended so that it does not require decryption, but critics contend that this protection is not reliable.
Bill C-22 can force companies to collect and retain data on all Canadian citizens
Bill C-22 can enable data sharing to US intelligence agencies for acts that are legal in Canada
Bill C-22 does not provide adequate monitoring or oversight of data collection and sharing.

When this passes, Canadian software or software hosted in Canada cannot be considered privacy safe, and this may well provoke an exodus of privacy safe software vendors from Canada. The Canadian Chamber of Commerce says that no similar Western country has lawful access laws with scope this broad.

Canadians can try and use a VPN to protect their privacy, but telecoms will still store data about your connection to the VPN, and the VPN is required to store metadata about Canadians as well. Many major VPNs like NordVPN are planning to exit the country, however Proton VPN is refusing to comply with the law for now. Secure services like Signal may just simply become unavailable to Canadian users.

“Complying with foreign surveillance orders without Swiss legal process is a criminal offence. Not happening. We’ll defend our Canadian users and never compromise them. We will fight C-22’s application by every means available.” – David Peterson, General Manager, Proton VPN ¹

“Signal would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users.” – Udbhav Tiwari, Vice President of Strategy and Global Affairs, Signal ²

For more information on Bill C-22, read Michael Geist’s excellent blog posts from April 15, 2026, May 19, 2026 and September 30, 2026

Critical Cyber Systems Protection Act (Bill C-8)

Bill C-8 provokes the same concerns from privacy advocates as Bill C-22, but is directed at telecoms, finance, energy and transport operators instead of electronic service providers like messaging apps, VPNs and email services. It has the same requirements to collect and share data with the government, has the same lack of independent monitoring or requirements to disclose data collection and sharing. The Privacy Commissioner has said that the privacy standards for data sharing with foreign governments are not sufficient, so this bill will most likely facilitate data sharing with US intelligence services. The intent of Bill C-8 is to secure data systems, whereas the intent of Bill C-22 is the mass surveillance of Canadians, however the effect of these two bills is similar in many respects. Bill C-8 is already law.

Age verification for websites (Bill S-209)

In addition to Bills C-8 and C-22, Canada is also trying to pass Bill S-209, requiring age verification for software and sites sharing content that the Canadian government deems “sexually explicit material”. Age verification requires government ID or biometric data. The scope of this bill is wide enough to include social media and AI, not just pornography sites. The government can order nationwide blocks of sites or services that do not comply.

The United States

The United States has no federal privacy law like the EU’s GDPR or Canada’s PEPIDA. Although some states such as California have rolled out their own privacy legislation, but most have not, and those that have are not synchronized. Individual states such as Texas are also rolling out age verification laws to the detriment of American’s privacy. However there are no privacy protections at all for foreign users of American software, even if that software is hosted outside the USA. Canadians using American software are subject not only to surveillance by US government entities, but the complete lack of privacy protection means that data collected by US companies is freely available for sale by data brokers to anyone with money.

FISA Section 702

FISA Section 702 lets US intelligence agencies collect the communications of foreign persons outside the US without individual warrants. Canadians are foreign persons. US companies, for example Google, Microsoft, Apple and Meta, must give this data to the government.

The CLOUD Act (2018)

The CLOUD Act lets US authorities make US companies give data that they control, also if the data is stored in another country. Any US company can be ordered to hand over data in a Canadian or EU-based data centre. This makes “Sovereign Cloud” products from companies like AWS or Microsoft Azure a huge privacy risk.

Schrems I (2015)

The EU Court of Justice cancelled the “Safe Harbor” agreement for EU–US data transfers, because of US surveillance.

The most popular platforms are shit anyways

The largest and most popular platforms are the worst. They weren’t always this bad, as they have grown in popularity, they have steadily become enshittified to the point where they are virtually unusable. Switching off these platforms does not only increase your privacy, it often gives a much better user experience. Enshittification is well documented by the term’s originator, Cory Doctorow. The three stages of enshittification are:

A platform is good to its users, often with investor money, to get them to join and stay.
When users are locked in, the platform makes things worse for users to give value to its business customers (advertisers, sellers, publishers).
When business customers are also locked in, the platform takes the value from them too, and keeps it for its leadership and shareholders. The result is that everyone feels locked into a platform that is bad for everyone.

Cory Doctorow’s blog can be found here, called pluralistic.net. His book Enshittification, Why Everything Suddenly Got Worse and What to Do About It is a very good read.

The solution

In light of the trade war that the US has launched against the world, Cory Doctorow has a new call to action. This talk at 39C3 is a highly entertaining and inspiring intro to Cory Doctorow.

The List

Tech	From	To	Experience
Email	🇺🇸 Gmail	🇨🇭 Proton Mail	I set a business account with Proton which allows me to run email on multiple domains that I own and have access to other Proton products. I find the mobile and desktop apps to be very mature and easy to use. This is a much better experience than Gmail, and infinitely more secure and private ⭐️⭐️⭐️⭐️⭐️
Domain Registrar & DNS Server	🇺🇸 Amazon Route 53	🇫🇷 Gandi	Gandi is now serving as both my Registrar and my DNS Server. I am extremely satisfied, and I trust that I own my domains and that my privacy is ensured when using Gandi. ⭐️⭐️⭐️⭐️⭐️
DNS Server	🇺🇸 Google 8.8.8.8	🇨🇭 Quad9 9.9.9.9	Very easy ⭐️⭐️⭐️⭐️⭐️
Cloud Hosting	🇺🇸 Amazon AWS	🇫🇷 OVH Cloud	Candidly speaking, as an AWS Certified Solutions Architect, moving from AWS’s rich and complex product line to OVH cloud has been a challenge. However, I have rediscovered that I just need a Linux box that I can SSH to in order to accomplish any task. I increasingly wonder if all the complexity of AWS actually served a purpose other than to tie me to their services. ⭐️⭐️⭐️
Blogging	🇺🇸 Meta Facebook	🇪🇺 Self-Hosted WordPress	I used to share a lot of thoughts on Facebook. But as time passed, I found what I shared to be disorganized, reactive to things that the Facebook algorithm thrust into my feed instead of things that I really cared about, and the comment sections absolutely toxic. So the blog you are reading now has been a liberating experience. Owning my own blogs has done wonder for my mental health. That said, WordPress is a pain in the ass to administer, so three stars. ⭐️⭐️⭐️
Microblogging	🇺🇸 Meta Threads, X (Twitter)	🇩🇪 mastadon.social (Fediverse)	I was never a huge microblogger, but I think that Mastadon will satisfy that itch adequately. For the moment, I am still building out connections and community on this platform. Candidly speaking, the networking opportunities are still limited compared with other platforms but I expect this to grow over time and I love the Fediverse. ⭐️⭐️
Photo Sharing	🇺🇸 Instagram	🇪🇺 Europixel (Fediverse)	I thought I would contribute to the Fediverse and spin up my own Pixelfed instance. It is a lot of work but rewarding. Shout out to Daniel Supernault in Canada who leads this project and coded this amazing software, including solid iOS and Android apps. Giving four stars because I have not got video uploads working yet ⭐️⭐️⭐️⭐️
LLMs	🇺🇸 ChatGPT	🇫🇷 Mistral Le Chat	Despite being a vocal AI skeptic, there are legitimate uses for LLMs in my daily life, so I pay for Mistral Le Chat which satisfies my AI needs for the moment. Eventually I would like to run my own LLM locally. ⭐️⭐️⭐️⭐️
VPN	None	🇨🇭 Proton VPN	I used to connect my devices directly to my internet provider’s modem, but I learned the security risks and privacy concerns of doing this. I now run my own wifi router and use Proton VPN directly on the router’s hardware. The connection is stable and there is no noticeable degradation in speed. ⭐️⭐️⭐️⭐️⭐️
Web Browser	🇺🇸 Chrome	🇺🇸 Mozilla Firefox	I just want something lightweight and fast that renders HTML and isn’t bloated. Is that too much to ask? ⭐️⭐️⭐️⭐️
Search	🇺🇸 Google	🇺🇸 Kagi	The more I use LLMs for research, the more I realize that what I really want is better search. Kagi is proving to be this better search. Ad free, private, customizable, and more relevant results. I am still evaluating it. ⭐️⭐️⭐️
Storage	🇺🇸 Apple, Google, Microsoft	🇨🇭 Proton Drive	Included in my Proton Business account, I have more than enough storage to stop using Apple, Google and Microsoft. That said, I question whether I really need a storage provider, it is easy enough to set up NAS attached to my router. ⭐️⭐️⭐️
Messaging	🇺🇸 Apple iMessage, Meta WhatsApp & Facebook Messanger	🇺🇸 Signal	I can’t say enough good things about signal. Video call quality is fantastic even across the oceans, and I trust them to be Moxie Marlinspike and Meredith Whittaker are both heros. I donate to the Signal Foundation regularly. ⭐️⭐️⭐️⭐️⭐️
Password Manager	🇺🇸 Chome, Apple	🇨🇦 1Password	I have been using 1Password for years and I love it. There is something amazing about being able to switch browsers and mobile operating systems at will without having to migrate all of your passwords. An independent password manager gives you such freedom. ⭐️⭐️⭐️⭐️⭐️
Music Streaming	🇺🇸 Apple Music, Google Play	🇫🇷 Deezer	Deezer may not have the same market share as Spotify, but Spotify’s ethics are questionable, and Deezer pays better royalties to artists. ⭐️⭐️⭐️⭐️⭐️
Video Streaming	🇺🇸 Netflix, Amazon Prime	🇨🇦 Crave, 🇺🇸 The Criterion Channel, 🇬🇧 Mubi, 🇬🇧 BBC Britbox	I do not miss formulaic slop that the Netflix recommendation engine spoon fed me for years. I so much prefer the human curated thematic collections of the best of world cinema provided by the Criterion Chanel and Mubi. And for mindless comedy, Britbox has me covered. Crave for watching Heated Rivalry! ⭐️⭐️⭐️⭐️⭐️
Health Trackers	🇺🇸 Garmin, Apple Watch	🇫🇷 Withings	Withings offer a rich ecosystem of health tracking devices that are way more advanced than a mere smartwatch. I have been using their under-the-mattress sleep tracker for a decade but I now use their entire product line, including their stylish watch. I am giving four stars because I still need to use my Garmin watch for accurate swim lap tracking, as I am a competitive swimmer. ⭐️⭐️⭐️⭐️
Ride Sharing	🇺🇸 Uber	🇪🇪 Bolt (Hopp in Canada) 🇨🇦 Hovr	Since I live in the EU, I can choose Bolt. Cars are not always as nice but I am happy with it. ⭐️⭐️⭐️⭐️⭐️
Food Delivery	🇺🇸 Uber Eats	🇪🇸 Glovo 🇨🇦 SkipTheDishes	These food delivery apps have all taken a very rapid ride down enshittification railroad. None are great these days to be honest. ⭐️⭐️⭐️
Maps	🇺🇸 Google Maps, Google Waze	🇩🇪 MagicEarth	There are actually two use cases for maps: 1. Public transit or driving navigation 2. Finding businesses Magic Earth is great for navigation and using it for navigation stops Google from tracking my location. However, I am still looking for an app that gives good information about local businesses and their opening hours. I do not trust google maps reviews, but google map’s database of businesses is complete and usually up-to-date. ⭐️⭐️⭐️
Calendar	🇺🇸 Google Calendar	🇨🇭 Proton Calendar	Migration from Google was easy. I have already deleted my Google Calendar data. ⭐️⭐️⭐️⭐️⭐️
Documents	🇺🇸 Google Docs	🇨🇭 Proton Drive, Proton Sheets, Proton Docs 🇩🇪 LibreOffice 🇩🇪 Hosted NextCloud	I am still figuring this out, but the options all seem solid ⭐️⭐️⭐️
Online Payments	🇺🇸 Visa 🇺🇸 Mastercard 🇺🇸 Paypal	🇵🇹 MBWay (Portugal Only) 🇨🇳 UnionPay 🇨🇦 Interac 🇪🇺 Free, Instant Wire Transfers within the EU	MBWay is faster and less cumbersome than Visa/Mastercard and ApplePay once you get the hang of it. QR codes are great! ⭐️⭐️⭐️⭐️
Phone hardware	🇺🇸 Apple iPhone	🇳🇱 Fairphone	I was hoping that my FairPhone with /e/OS could replace my dependency on having Google or Apple track my location while using CarPlay/Android Auto. This is not easy it seems. I will wait until this is resolved to migrate to this phone. ⭐️
Phone OS	🇺🇸 Apple iOS	🇪🇺 /e/OS	The only way to get Android Auto to work is to install Google maps or root your device which defeats the purpose of moving to Fairphone in the first place. ⭐️
Laptop/Desktop	🇺🇸 Apple MacOS	🇩🇪 Tuxedo Linux Computers	Next Laptop/Desktop purchase is a few years off, but I will 100% be returning to Linux.

My Profile

Your Profile

Ethical Digital Sovereignty and Software Privacy Choices

Why