Start with the threat
Privacy is not one property. Decide whether your concern is identity exposure, message confidentiality, file retention, account takeover, network metadata, or the recipient making a copy.
What application encryption can protect
Authenticated encryption can protect supported data from being read or modified by parties that do not possess the required keys. It cannot protect a compromised endpoint from the person operating it.
What encryption does not automatically hide
Transport systems and service infrastructure can still have metadata. Depending on deployment, this can include timestamps, IP information, session events, sizes and operational logs.
The recipient is part of the model
If the recipient is trusted, encrypted messaging can be useful. If the recipient is malicious, they can forward, photograph or otherwise preserve what they can legitimately view.
Practical privacy checklist
- Minimise unnecessary identifiers.
- Verify recipients.
- Use expiry for temporary information.
- Keep endpoints patched.
- Use strong authentication for administration.
- Do not claim anonymity where the threat model does not support it.