Why this page names no menus
Any guide that walks you through a specific service's settings screen is wrong within a few months. Labels get renamed, sections get merged, whole categories appear after a feature launch, and a step-by-step written last spring sends you looking for a menu that no longer exists. So this page describes what to look for and what the setting is usually called generically. Menus move. The principle does not, and once you know what you are hunting for you can find it in whatever the interface currently looks like.
One practical note before the categories: nearly every service keeps its privacy controls split across at least two places — an audience or visibility section for what you publish, and a separate data or ad section for what the company collects and shares. People find the first and never look for the second. When you go through a service, assume there are two areas and keep hunting until you have found both.
The categories worth finding, on any service
| Category | What it usually controls | What to set it to |
|---|---|---|
| Profile or account visibility | Whether anyone, or only approved connections, can see your posts and profile | The narrowest setting you can live with. This is the single highest-value control and it is usually one switch. |
| Default audience for new posts | Who sees each thing you publish from now on | Set it deliberately rather than leaving it. Many services remember the audience of your last post and apply it to the next one, which is how something private goes public months later. |
| Past posts, in bulk | A one-time action that restricts the audience of everything you have already published | Run it. Changing the default does nothing to a decade of archive, and the archive is what people actually read. |
| Discoverability by phone number or email | Whether someone who has your number can find your account from it | Turn it off unless you need it. This is how an account someone knows nothing about gets linked to a person. |
| Search engine indexing | Whether your profile appears in public web search results | Off, in most cases. Separate from in-service visibility and easily missed. |
| Tagging and mentions | Whether others can tag you, and whether tags appear without your approval | Turn on review before a tag attaches to your profile |
| Friend or follower lists | Whether your connections are visible to others | Restrict. A visible connection list is the raw material for impersonation attempts against your family. |
| Location | Location attached to posts, and background location permission for the app | Off at the app permission level, which is stronger than any in-app toggle |
| Contact and address book upload | Whether the app has uploaded your phone contacts to build suggestions | Off, and look for a separate control to delete what was already uploaded |
| Ad personalization and partner data | Whether activity elsewhere feeds what you see, and whether the service shares or sells data | Opt out of what can be opted out of. Depending on where you live there may be a legal right to request deletion. |
| Active sessions and connected apps | Devices currently signed in, and third-party services with access to the account | Sign out anything unfamiliar; revoke every app you no longer use |
The last row is a security control as much as a privacy one, and it is the row people skip. A third-party app authorized in 2019 to post on your behalf still has that access, and the company behind it may no longer exist in any form you would recognize.
Why the audit has to repeat
Two things happen over time, and both mean a one-time cleanup decays. The first is that new features arrive with new settings, and those settings arrive at the default the company chose — usually on. Nothing was reset; a category simply appeared that you have never made a decision about. The second is that some settings genuinely do revert, most often after an account migration, a merge between products, or a policy change that resets consent. Neither of these is announced in a way anyone reads.
The workable answer is to make it a recurring appointment rather than a project. Twice a year, on a date you already remember for something else, spend twenty minutes per account you care about. Check the categories in the table, look for anything you have not seen before, and sign out of every session you cannot account for. That cadence catches new categories while they are still new.
The test that actually tells you where you stand costs nothing: open your profile in a private browsing window, signed out, and look at what a stranger sees. Every service shows you a friendlier version of yourself when you are logged in, and the logged-out view is the honest one. Doing this from a browser you are not signed into anywhere is the point — if you want to confirm what a site can see about your browser before you start, my browser info shows what a page reads from a visit without you sending anything anywhere.
The half you do not control
Your settings govern what you publish. They do not govern what other people publish about you, and for most adults that is the larger surface. A photograph posted by someone else, with your name in the caption and the venue tagged, is public regardless of how locked down your own account is. A relative who lists your birthday in a greeting has published a piece of information that shows up on identity verification forms.
| What leaks through others | What you can actually do |
|---|---|
| Photos of you posted by friends and family | Turn on tag review so at least it does not attach to your profile. Beyond that, asking is the only tool, and asking specifically — "please do not post pictures of the kids" — works better than a general request. |
| Group and event membership | Check whether your membership is visible to non-members; many groups have a setting the members never look at |
| Comments you leave on public posts | These are public even from a private account. A restricted profile with a decade of comments on open pages is not private. |
| Your name in someone else's caption | Nothing technical. Worth knowing that this is how most name-to-face links get built. |
| Children's photos posted by relatives | Agree a rule once, in plain terms, rather than reacting each time. Most people comply when asked directly and never think about it otherwise. |
What a photograph carries besides the picture
Image files from a phone typically embed capture metadata: the time, the camera settings, and often the coordinates where the shot was taken. Most large platforms strip this on upload, and a good number of smaller sites, forums and file-sharing services do not. The practical consequence is that a photo emailed directly, posted to a small forum, or attached to a marketplace listing may carry the location of your home.
Two habits cover it. Turn off location permission for the camera app if you do not need geotagged photos, which stops the data being recorded at all. And when sharing a photo outside a major platform — a classified listing especially — check whether your device's share sheet offers an option to remove location before sending. The other thing worth watching in photos is the background: reflections, mail on a counter, a parcel label, a window view, a key on a hook. Marketplace listings are the common case, and the fix is looking at the frame before you post rather than any setting.
Accounts you stopped using
An abandoned account is a privacy problem and a security problem at once. It still holds whatever you published, it is still discoverable, its password is probably one you have not changed since, and nobody is watching the email address it notifies. Old accounts are also a favored route into current ones, because the recovery information on them is often out of date in ways an attacker can work with.
Deleting beats abandoning. Look for account deletion rather than deactivation — the two are different, and deactivation frequently means the data is retained and the profile returns the moment someone signs in. Before deleting, request a copy of your data if the service offers an export; most do now, and it is the only way to keep the photographs. Expect a waiting period, often measured in weeks, during which signing in cancels the deletion, which is a trap worth knowing about. Digital decluttering covers doing this at scale.
A twenty-minute pass, for one account
Sign out and look at your public profile. Set overall visibility. Set the default audience for new posts, then run the bulk tool on old ones. Turn off discoverability by phone number and email, and search engine indexing. Turn on tag review. Restrict your connection list. Revoke every connected app you do not recognize and sign out every session you cannot place. Find the ad and data-sharing section, which is usually somewhere else entirely, and opt out of what can be opted out of. Check whether your contacts were uploaded and delete them if so. Then look at the public profile again and see if the changes did what you expected.
Put the next pass on the calendar before you close the settings screen. That single act is what separates a clean account from one that was clean once, because the categories you have not decided about yet have not been invented.
Questions people ask
Why do my privacy settings keep changing back?
Usually they have not changed — a new category appeared and arrived at whatever default the company picked. Feature launches, product merges and account migrations all introduce settings you have never made a decision about, and the default trends toward open because discovery is what makes the service work for its owner. Some genuine resets do happen, most often around policy changes and account merges. Either way the response is the same: treat the audit as a recurring twenty-minute check twice a year rather than a one-time cleanup, and look specifically for anything you do not remember seeing before.
How do I see what a stranger can see on my profile?
Open a private or incognito browsing window, do not sign in, and go to your own profile address. That is the honest view. Every service shows you a friendlier version of your own page when you are logged in, and features like "view as public" inside the app are helpful but do not always reflect what a search engine has already indexed. Check search results for your name too, since profile indexing is usually a separate setting from in-service visibility and it is the one people miss.
Do photos I post reveal where I live?
They can. Phone cameras commonly embed the time and the coordinates in the image file. Most large platforms strip that metadata during upload, but plenty of smaller forums, marketplaces and file-sharing services do not, and a photo sent as a direct email attachment keeps everything. Turn off location permission for the camera app if you do not need geotagging, and check whether your share sheet offers an option to remove location when sending outside a major platform. The background of the frame matters as much as the metadata — reflections, mail, parcel labels and window views give away more than people expect.
Should I delete an old account or just stop using it?
Delete it. An abandoned account still holds everything you published, is still discoverable, and almost certainly carries a password you have not changed and a recovery email you no longer read — which makes it a plausible route toward accounts you do still use. Look specifically for deletion rather than deactivation, since deactivation usually retains the data and restores the profile the moment anyone signs in. Request a data export first if the service offers one, and be aware that most deletions have a waiting period during which signing in cancels the request.
Can I stop other people posting photos of me?
Not by any setting, which is the uncomfortable part. Privacy controls govern what you publish; they do not reach what someone else publishes about you. What you can do is turn on tag review so a photo does not attach itself to your profile, restrict who can see your connection list, and ask directly. A specific request works far better than a general one — naming what you mind, once, tends to be respected, while a vague preference gets forgotten. For children, agreeing a rule with relatives in advance is more effective than objecting to each post.