🇬🇧 UK Online Privacy Toolkit

Mullvad Browser — Mullvad's own browser
→ It's basically tor but without tor, clears cookies/history upon closure
→ Provides their own DNS over HTTPS, Which can be used globally outside of just using their browser

Firefox — Open Source
→ Install uBlock Origin, At the very least will stop 99% of ads including YouTube ads
→ Used to be the best, You can use about:config to remove a bunch of unwanted calls to Mozilla and the rest can be blocked via pi-hole, host file entries etc

For more config options/settings - https://www.privacyguides.org/en/desktop-browsers/#firefox

Tor — Onion Routing
→ Will be ultimately slower, some UK sites may block tor
→ Depending on your threat model you might want to set the security level to safter or safest (Safest disables javascript)

Brave — Chrome like option
→ Ships with ad/tracker blocker enabled by default
→ If you want brave without all the crap you can use this as a reference or download Brave Origin which is free for Linux users

Proton Mail — End-to-end encrypted (Storage or between other Proton users)
→ Swiss jurisdiction with parts being currently mitigated to the EU
→ Free tier available & supports PGP
→ Has an onion address - https://account.protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion
→ Has mobile app and Proton bridge for desktop use with something like Thunderbird but requires at least the "Mail Plus" plan
→ Has a tool to import existing emails from other providers e.g Outlook, Gmail etc

Tuta — German-based encrypted email (Storage and between other Tuta users)
→ Open source, GDPR compliant
→ Uses post quantum encryption
→ Doesn't have as much metadata as say Proton however Tuta does not support PGP
→ Has a desktop/mobile app
→ Has a tool to import existing emails from other providers e.g Outlook, Gmail etc

Posteo — German-based mail provider
→ Powered by green energy and one of the cheaper options with IMAP/SMTP support
→ Supports PGP & has email content stored encrypted as a toggle
→ Doesn't have as much metadata as say Proton however Tuta does not support PGP

Mullvad — Swedish based, accepts cash & XMR
→ No account required
→ DAITA - Anti-AI traffic analysis, it add's random noise to all of your traffic - More Info
→ Multi-hop routing available

IVPN — Gibraltar based, also accepts cash & XMR
→ Multi-hop routing available
→ No account required

ProtonVPN — Swiss based, accepts BTC & cash
→ Free tier available (limited servers)
→ Multi-hop routing available

Duckduckgo — US based
→ No search history tracking

Startpage — Dutch based
→ Google results without tracking

SearX — Self-hostable meta-search
→ Public instances: See link above

Signal — E2E encryption centralized
→ Phone number required
→ Best switch case when switching from WhatsApp
→ Support groups

SimpleX — E2E encryption decentralized
→ Quantum resistance
→ No phone number required

Element — Matrix protocol, federated, E2E encryption (DM'S)
→ Can self-host your own server

GrapheneOS — Mobile - Pixel Hardened Custom ROM
→ The only caveat it you do need a fairly recent Pixel device, At the time of writing the Pixel 8a would be a good choice as it also supports MTE (Memory Tagging Extension)
→ Here is a list of whats been hardened/changed

Fedora — Linux
→ A Linux distro that comes with SELinux, For a more windows feel consider installing the KDE edition
→ Updates controlled via terminal using dnf update and dnf install to install packages

Arch Linux — Linux
→ Do it yourself distro, install whatever tickles your pickle
→ Updates controlled via terminal using pacman -Syu and pacman -S to install packages

• Online Safety Act: Don't give these companies/goverment your ID, Use a VPN/Tor to get around this, For device level at least for Android users a custom ROM for iPhone if possible then consider a jailbreak but this does weaken security a bit
• Account Creation: Unless legally required use fake information, Email Alias's, randomised usernames
• Use a password manager: Bitwarden (Can self host), KeepassXC or Proton Pass
• VPN's do not provide anonymity: They are a privacy tool
• GCHQ Five Eyes: UK intelligence sharing with US/CAN/NZ/AUS
• Investigatory Powers Act 2016: ISP data retention for 12 months
• Data Protection Act 2018: Personal GDPR Rights