Devices · guides

Encrypted phone: what a service can and cannot read

By Alberto Gulotta · Updated 10 September 2026 · 5 min read

This is the entrance to the devices tower — the encrypted phone, the messaging apps, the fingerprint and the face, and the screens belonging to people you are responsible for.

The organising idea here is that a device is not one thing to protect but three. There is the hardware, which somebody might pick up. There is what leaves it, which is messaging. And there is who is allowed to unlock it, which is where biometrics and children both live. Those three need different answers, and they are kept apart here for that reason.

The tower is deliberately unglamorous about this. The most effective things a person can do to a phone are a long passcode, automatic updates and a review of which apps hold which permissions — and all three are free, take under an hour, and are more valuable than any purchase this subject will ever offer you. The permissions review is the one that takes longest, and app permissions on iPhone explains why: the screen sorts by what is being asked for, not by who is asking.

The messaging wing carries the one distinction that matters most in this building: the difference between a service that cannot read your messages and one that promises not to. Both are described as private in advertising. Only the first is a technical fact, and the pages here say which is which, quoting each service’s own documentation.

The floors listed below are being built and are not here yet, so this page names the pages that already do the unglamorous half of the job: which apps hold which permissions, how to back the phone up before anything else, what a password on a folder actually protects, and the passcode and the manager behind it.

One expectation is worth setting at the door, because this tower disappoints people who arrive looking for a purchase. There is very little to buy here. The phone in your pocket already encrypts its storage, already isolates apps from each other, and already asks you before handing over a location or a microphone; the gap between a default phone and a well-configured one is almost entirely a matter of settings and habits rather than hardware. The specialist devices and the paid services those floors will cover are for people whose threat is specific and serious — an activist, a journalist, somebody leaving a dangerous household — and any page here that covers one will say so in its first paragraph, so that nobody buys a solution to a problem they do not have.

Not covered here. It will not sell you a secure phone. That market runs on the implication that ordinary devices are broken, which they are not for the overwhelming majority of people; what is written here says plainly who the specialist options are genuinely for.

It will not describe an app as private without saying what that means. The word is used for services that cannot read your messages and for services that have simply promised not to, and every page here about messaging separates the two before doing anything else.

And it will not treat monitoring a child as a technical problem with a technical solution. Any page here that covers it will be written on the assumption that the tools support a conversation and cannot replace one.

On sourcing: what a messaging service holds about you is quoted from that service’s own published documentation, with the date it was read, and never from a comparison table written by somebody else. Several of the most widely repeated claims in this category are years out of date, and a few were never accurate. What holds instead is simple: the most valuable changes in this tower cost nothing at all, and nothing here carries an affiliate link of any kind.