~/setups/standard

Standard Setup

last updated 2026-08-02 · a weekend + slow migration · ~€10/mo · what changed

Balanced security and usability for someone who's done the basics and wants the structural changes too. Who this is for: you've decided that ad-tech holding your whole life is itself the problem, not just thieves and leaks. Costs about two coffees a month and one weekend of focus.

prerequisite This tier assumes the beginner setup is done: password manager in daily use, a free Proton Mail account, 2FA on critical accounts, Brave, Signal, encrypted DNS. If any of those are missing, do them first: they're the foundation this tier builds on.

the setup

Your own domain

foundation
~€10/yr~30 minany reputable registrar

A domain you own means your email address is portable forever. Why it's here: it converts every later choice from a commitment into a preference: switch providers and nobody ever knows.

  1. Buy a boring domain at a reputable registrar (Porkbun, Namecheap, Gandi, ~€10/year). Nothing cute; you'll say it out loud at front desks for a decade.
  2. Turn on WHOIS privacy (usually free and default now).
  3. That's it for today: the next step connects it.

Proton Mail

email
~€4/mo~2 h + months of driftcategory page

Upgrade the free Proton Mail account from your beginner setup to Mail Plus and attach the domain you just bought. Why it's here: your inbox is the master key to everything else; a custom domain turns switching providers into a preference, not a commitment. (Mailbox.org if you'd rather keep IMAP and any client.) The paid plan also bundles SimpleLogin: a unique forwarding address per signup, so a leak becomes traceable instead of just annoying, and killing the alias kills the spam with it.

  1. Upgrade your existing free account to Mail Plus, add your domain (Settings → Domains), follow the DNS records it gives you.
  2. Create you@yourdomain as the primary address.
  3. Set Gmail to forward everything to it, don't delete Gmail; let it become an empty hallway.
  4. Move the heavy hitters this weekend: banks, government, employer, and every account's recovery address. The long tail migrates itself as forwarded mail reveals it.
  5. Turn on SimpleLogin (Settings → Aliases) and install its browser extension. Rule going forward: humans get the real address, companies get an alias. Don't retrofit old accounts; migrate them when they email you.

Notesnook

notes
free tier~20 mincategory page

Notesnook keeps your notes end-to-end encrypted, with clients on every platform and a real export if you ever want to leave. Why it's here: the average notes app is a diary a company can read, and this one just isn't.

  1. Create an account, install the app on your phone and computer.
  2. Import from your old notes app if it offers a plain export; a messy import beats losing years of notes.
  3. Turn on app lock (biometric or PIN) so an unlocked phone doesn't mean an open notebook.
  4. Send new notes here first, and migrate old ones as you actually need them.

YubiKey ×2

hardware 2fa
~€110 one-off~1 hcategory page

YubiKeys give you phishing-proof login for the accounts that unlock the rest. Why it's here: app codes can be phished in real time, hardware keys can't. Two keys because one key is a lockout waiting to happen.

  1. Buy two YubiKey 5s (one USB-C/NFC for daily use, one for the drawer). Nitrokey if open firmware matters to you.
  2. Register both keys on: Proton, your password manager (1Password supports keys natively; Bitwarden needs premium, ~$10/yr), Google (while it exists), banking where supported.
  3. Where keys are registered, remove SMS as a fallback method.
  4. Backup key goes somewhere that isn't your bag. It only works if it exists when the primary doesn't.

Proton VPN

network
~€5/mo (less bundled)~20 mincategory page

Proton VPN is audited no-logs, fast, and it bundles with the Proton Mail plan you just bought at a meaningful discount; at this tier the suite deal is hard to beat. Why it's here: your ISP stops seeing where you go, and public Wi-Fi stops being a consideration at all. Its free tier is a genuinely usable fallback, unlimited data and no ads, just fewer server locations and one device at a time, but the bundle discount here makes paying the easy call. (Mullvad instead if anonymous payment matters more than ecosystem value.)

  1. Upgrade to Proton Unlimited (or add VPN Plus) from your existing Proton account, compare against paying separately; the bundle usually wins.
  2. Install the app on phone and computer, sign in.
  3. Turn on the kill switch and NetShield (Proton's DNS-level ad/tracker blocking).
  4. Set it to auto-connect on untrusted Wi-Fi at minimum; always-on if speeds hold up for you.

Filen

Cloud Storage
from ~€2/mo · free tier~45 mincategory page

Filen keeps your photos and files on a zero-knowledge E2EE cloud, with proper clients on every OS, Linux included. Why it's here: "Google can read my files" stops being true, without losing sync. (On a Proton Unlimited bundle, Proton Drive covers the same job, unless you're on Linux, where it has no sync client.)

  1. Create a Filen account (10GB free covers the trial run) and turn on camera upload on your phone; let it run overnight.
  2. Start the Google Takeout export now: it takes days to arrive, and the photos archive is the thing people regret not having.
  3. Keep one versioned backup outside the sync loop: an external drive plus restic/BorgBackup, monthly.

EasyOptOuts

data brokers
$19.99/yr~20 min + ongoingcategory page

EasyOptOuts scrubs your name, address, and phone number off the people-search and data-broker sites that resell them, then keeps re-removing you as those sites re-list you. Why it's here: a locked-down inbox and an encrypted vault don't matter much if anyone can still buy your home address for two dollars.

  1. Sign up at easyoptouts.com and submit the personal details it needs to find your listings: name, past addresses, birth year.
  2. Let the first sweep run; it's the slowest one, expect removals to land over the following weeks.
  3. Leave monitoring on: brokers re-list you on their own schedule, and ongoing removal is the point, not a one-time cleanup.
  4. Check the dashboard after the first month to confirm removals are actually landing, then let it run quietly in the background.

after setup

The email migration is a season, not a step. Three months of forwarded mail will surface accounts you forgot existed. Each one: log in, change address (or alias it), move on. The day forwarding goes quiet is the day you've actually left.

Don't delete the Google account. Empty it, secure it with a key, and keep it: old recovery paths, the odd service that demands it, and YouTube comments you forgot about all live there. An account you control is safer than one recycled.

Common pitfall: alias sprawl without notes. Name each alias after the service in SimpleLogin's note field as you create it, or in six months you'll be scared to delete any of them.

Going further: if your threat model includes a specific someone, or you want your phone itself out of the ecosystem, the hardened setup is next. For most people, though, this tier is the destination. Maintain it and live your life.

checklist