I've had a Facebook account since 2009. That does not mean I agreed.

I am not a lawyer, I am not an activist, I do not work for an NGO. I have used Facebook since 2009, Instagram since 2012, WhatsApp since 2015; I don't have TikTok, but my daughter does. I have a Gmail account that receives the passwords to every other account. I pay with BLIK and a card. I order from Allegro and Amazon. I carry a phone whose apps know more about me than I remember about my own life.

I read the 33 cards in this database. Not cover to cover — honestly, I did not work through every section of every case. But enough to see what the editors write in the introduction: that this is not about isolated scandals. It is about something systematic, repeatable, and directed at me — personally, not at the abstract "user" of the reports.

I want to describe what follows from that reading for me. Not as a political program. As the ordinary, everyday housekeeping I do to lower my exposure — not to zero, because that is impossible, but to a level where I can still sleep.

"I have nothing to hide"

That is the first sentence I hear whenever I try to talk to anyone about privacy. "I don't do anything interesting anyway, let them collect whatever they want." For years I could not answer it. Now I can.

It is not about whether I have something to hide. It is about who decides what is worth hiding. Twenty years ago I decided whom to tell I was pregnant; today Meta's advertisers know before I tell my mother. Fifteen years ago the list of my medications was known to my doctor; today it is known to the app I trusted to remind me about my doses. Ten years ago I knew whom I was meeting; today my mobile carrier holds the metadata of every visit to every person over the last five years. It doesn't need to know what I did there — where I was, when, and for how long lets the rest be reconstructed with high probability.

Second: what I do not have to hide today may become sensitive tomorrow — without any change on my part, without any decision of mine. A change of government, a change of law, a change of company policy is enough. Data that are routine now are compromising in a different context. Women in Texas who used cycle-tracking apps found this out in 2022, when their data began to be subpoenaed in the prosecution of abortions. The data did not change overnight. The legal environment did. Privacy is not a comfort. It is a margin of safety against the unpredictability of the future.

Third: "I have nothing to hide" assumes that hiding is the only point of privacy. But privacy is also the precondition for the existence of a person who can be in different states — uncertain, searching, withdrawn, changing her mind. If every thought of mine, every search of mine, every interaction of mine is observed and recorded, I have no place in which I am allowed not to know what I think. Everything I do, I do for someone who is watching. That is not innocent observation. It is a structure that changes who I am becoming.

What I did after reading the database

This is not a list I recommend. Everyone has a different life, different needs, different trade-offs. It is the list I made, because I want to show that these things are doable. That the choice is not between full participation in the platforms and living in a forest cabin without internet.

First: a password manager. I installed Bitwarden, migrated every password from my notebook and my memory, and generated new, unique ones for every account. It took me three evenings. I pay 10 euros a year for the premium version. Any data breach I suffer is now the problem of a single service, not a chain of thirty.

Second: two-factor authentication everywhere I can get it. Not by SMS, because SIM-swap attacks are a real risk — only with a hardware key or an authenticator app. I bought a YubiKey for 180 zloty. Gmail, bank, Facebook, and WhatsApp accounts are covered. Setting up each one took me about ten minutes.

Third: Signal instead of Messenger. For family and close friends. Not for everyone — I did not push the change on colleagues at work, because that creates friction. But what actually matters has moved to Signal. Messenger stays for small talk.

Fourth: Firefox instead of Chrome. Multi-account containers, so that Facebook can't see what I do outside Facebook. uBlock Origin. An extension that forces HTTPS. Together it took me an hour. The browser runs faster, not slower, despite what some people say.

Fifth: I uninstalled the apps I had not used in months. That had been a quiet accumulation — I would install the app of brand X to buy something on sale once, and it would stay. Each of them had permissions for contacts, location, photo library, microphone. Uninstalling thirty of them took twenty minutes. The phone I carry now knows less about me than the one I carried a week earlier.

Sixth: Amazon Prime canceled. Not because I didn't use it — I did. But after reading the card on the Ring "police access" program, on warehouse working conditions, on the punishment system for Flex drivers — I decided that 199 zloty a year is money I can choose not to hand to that model. I buy from Polish shops; it arrives a day later. The world has not ended.

Seventh: a recurring donation to the Panoptykon Foundation. 20 zloty a month. Not because I expect one organization to solve the problem. Because it is a symmetrical answer — someone on my side is working systematically, and I pay systematically for it. In the same period, Meta spends a hundred times Panoptykon's entire budget on lobbying in Brussels. That is not a reason to withdraw. It is a reason to start.

Eighth: the privacy settings on Facebook, Instagram, and Google. I went through all of them, turned off everything that could be turned off without losing a function I use. I disabled ad personalization. I disabled cross-site tracking. I reset my advertising identifiers. The ads are dumber now. There is no difference in how I use the platforms.

What I did not do

I did not delete Facebook or Instagram. I stay in touch with people there whom I would otherwise lose. I did not migrate every photo from iCloud to my own drive — that is too much work, and the probability that Apple will use them against me is, for me, lower than the probability that I will break the drive. I did not stop using Google Maps. I did not switch to Linux. I have a smartphone, a laptop, and commercialized home devices, and I do not plan to give up basic functionality.

That is not a failure. It is a realistic assessment that privacy is not binary and is not a zero-sum game. Every setting I changed, every permission I revoked, every service I walked away from lowers my exposure. The sum is significant, even if it is not radical.

What I learned

I learned that shame is not a constructive feeling in this matter. I felt it when I started — that for years I had "been naive," that I had "let this happen," that I had "failed to take care." That is the feeling Big Tech wants me to have, because as long as I am ashamed, I am paralyzed. I was not naive. I was a teenager in 2009 setting up an account on a new platform whose terms of service were unclear. No one bought me off — I was drawn into a structure that never included the option of informed consent. The shame does not belong to me. It belongs to the people who built an architecture in which informed decisions were not possible.

I learned that panic is not a constructive feeling either. There are weeks when I read one card from this database and want to throw my phone out the window, change my name, and move to the Bieszczady mountains. Panic is a first-order reaction — it subsides once I make a list. A list reduces the problem to doable actions. A list is a civic instrument.

I learned that taking care of my own privacy and supporting systemic change are two different things, and neither substitutes for the other. I can have the best privacy settings in the world and still be a citizen of a state where the security services can buy a facial-recognition tool and use it at a protest I attend. Only systemic change — legal, political, civic — protects me at that level. But without daily housekeeping on my own devices, I have no energy left to think about the systemic kind. The two must move together.

I have had a Facebook account since 2009. I did not agree to what has been done with that account. Consent that no one asked me for is not consent. And citizenship — political, digital — begins at the moment I notice that and decide what to do about it.

This database gives me facts. What I do with them is up to me. What you do with them is up to you.