You’re publishing more than you post.

Case one

The data hidden inside your files

A file is never just its contents. Photos and documents carry metadata — a hidden layer describing when, where, and how they were made — and unless something strips it along the way, it travels with the file.

A phone photo can embed the exact GPS coordinates where it was taken, the device that took it, and a timestamp. A document can carry the author’s name, the software used, and sometimes an edit history. Post it as-is and you’ve published all of that too.

The location isn’t vague. The format^[1] stores the coordinates where you took the photo, next to the make and model of the device and its camera settings. Documents keep a different haul: Word, Excel, and PowerPoint files^[2] can hold the author’s and organization’s names, the software version, reviewer comments, the full record of tracked changes, and text that was deleted but never cleared. You can see all of it before anyone else does — a photo’s info panel shows where and on what it was taken, and Office’s Document Inspector lists everything a file is carrying.

Closing it is mostly a habit: strip the data before you share, on your own device, so nothing has to be uploaded to a stranger’s server to be cleaned. On an iPhone, the Share sheet’s Options^[3] let you drop the location from what you send; to clear it from a photo you’ve already saved, open the photo’s info panel and tap Adjust Location, then No Location. On a computer, ExifTool^[4] wipes an image in one line — exiftool -all= photo.jpg — though it saves the untouched original beside it as photo.jpg_original, metadata and all; delete that copy, or add -overwrite_original so it’s never made. Office’s Document Inspector^[2] (File → Info → Check for Issues) pulls the author, comments, and change history out of a document before it leaves your machine. The cleaner fix is to stop the data being written at all: set the camera’s location permission to Never — on iPhone, under Settings → Privacy & Security → Location Services → Camera — and no coordinate is attached in the first place.

Case two

The address behind your domain

Every domain has a registration record, and your registrar has to collect your real name, street address, phone number and email for it. How much of that a stranger can look up depends on three things you choose at checkout: the registrar, the ending, and one optional box on the form.

For decades, that record was public. Type a domain into a WHOIS lookup and you got the owner’s name, home address, phone number and email. Europe’s privacy law forced the first big change in 2018, when ICANN started allowing registrars to hide personal details, and that arrangement became permanent policy^[5] on August 21, 2025. The lookup changed too; since January 28, 2025, the official source for .com and the other generic endings has been a newer system called RDAP^[6], not WHOIS.

Redaction has limits. A registrar that redacts must blank out your name, street, postal code and phone^[5] and swap your email for a relay address or a contact form, but your state and country stay public no matter what, and your city may too. Redaction is only required where a privacy law demands it; everywhere else it’s the registrar’s call. Then there’s the optional Organization box. Whatever you type there becomes the domain’s legal holder^[5], and it’s published if you agree. Put your club’s name in it and the record names the club, not you.

Hiding is not deleting, either. Your registrar keeps the full record for at least 15 months^[5] after it stops managing the domain, and it has to answer properly filed requests for it within about a month, weighing each one on its merits. Records a company holds about you get weaker legal protection than papers in your home; the third-party doctrine is why.

The one ending to skip for anything personal is .us. Its registry bans privacy and proxy services outright^[7], and its public lookup has shown every registrant’s name, home address, phone number and email to anyone, no login required. The federal agency that oversees .us has listed what that invites: spam, phishing, harassment, doxxing. In 2023 it floated making people give a name, an email address and a reason^[8] before looking; a gate like that slows a stranger down, but your real details are still what’s on file. If you want yourname.us, it comes with your address attached.

For most people, redaction and a careful signup form are enough. For an activist, a source, or someone avoiding a stalker, the hidden record is the weak point: it exists, and a registrar can be made to disclose it. That’s the case for a shield like Njalla, which isn’t a registrar at all but a middleman between registrars and the people who use the domains^[9]. It registers the domain in its own name, so registries and lookups see Njalla instead of you. The cost is that on the registry’s books the domain is Njalla’s, and your use of it depends on Njalla’s choices. In 2021, when Iceland’s registry threatened to suspend every .is domain Njalla held, Njalla took several accused piracy sites offline^[10] to protect its other customers, while a court case to identify the sites’ owners was already under way. The shield kept the names hidden; it didn’t keep the sites up, and it didn’t stop anyone from asking.

Closing this one is mostly a checklist, and most of it happens before you pay. Run a domain you own through ICANN’s lookup to see exactly what a stranger sees. Pick a generic ending over .us for anything with your name on it. Leave the Organization box blank on a personal domain. Register with an email address you use nowhere else, since the relay forwards whatever reaches it. And if your record ever showed your address, assume a copy survives; commercial archives sell old records^[11] going back to the 1980s, searchable by name, email or phone.