Privacy Is a Budget, Not a Setting.

Half past eleven at night, a form open, her thumb not moving. Name. Contact. A box for anything the practitioner should know. She has been sitting with it for eleven minutes, and the hesitation is not about whether she wants the thing. It is about what she is about to leave behind her.

And the advice, when she looks for it, is uniformly useless. Be careful what you share. Use a strong password. Think before you post. All true, all unfalsifiable, and none of it tells her what to write in the box in front of her right now.

This chamber has argued that privacy used to be the default and is now something a person maintains. This essay starts where that one finished and asks the practical question: maintains how, at what cost, and to what standard. There is no single correct answer, which is the point rather than a hedge, and the aim here is to give you enough structure to pick your own and know what you are paying for it.

Start with what is wrong with the standard guidance, because it explains a lot of her fatigue.

Every privacy measure costs something. A separate address costs a login she will forget. A different name costs a moment of confusion at the door. Paying in cash costs a trip to a machine. Turning off a preview on a lock screen costs her seeing her own messages. Keeping one thing out of one conversation costs a small ongoing vigilance that runs in the back of her mind all evening.

Those costs are not moral failings to be overcome by trying harder. They are real, they accumulate, and the supply of attention a person has for this is finite and is already being spent on a job and a family. So "be careful" translates, in practice, to "spend an unspecified amount of a scarce resource on an unspecified risk", which is why she alternates between elaborate caution and giving up entirely. Both are rational responses to advice with no budget in it.

Treat it as a budget instead and the problem becomes tractable. A finite amount of friction is available. Some exposures matter enormously to her and some do not matter at all. The work is not to minimise exposure; it is to spend the friction where it buys the most, and to consciously not spend it elsewhere.

Here is the second correction, and it redirects almost everything.

The picture in most published advice is technical: databases, breaches, hackers, encryption. Those exist. But think concretely about what would actually hurt in her life, and it is almost never a stranger with a database. It is her sister knowing. It is a colleague seeing a name on a screen. It is a friend who is warm and kind and cannot hold a thing for six months. It is a family phone plan that lists numbers on one bill, a shared photo library that syncs cheerfully, a lock screen that shows the first line of a message to whoever is nearest the table.

In other words her exposure is relational rather than technical, and the path runs through people who already know her and through the ordinary conveniences of a shared life. That is a much more useful place to aim, and it also explains why she feels vaguely unsafe after doing everything the articles said: she secured the wrong perimeter.

It has one bracing implication worth saying plainly. The most important privacy decision most people make is not a setting. It is who they tell. Nothing technical recovers from a good-hearted mention at a family dinner, and no measure in this essay can do anything about it.

Now the choice, laid out honestly. These are three coherent positions. They are not a ladder from careless to wise, and a woman in each of them can be entirely sensible.

The first is open. She uses her own name, her usual contact details, her ordinary card, and she does not organise her life around not being found out. What it buys is enormous: no vigilance, no second system to maintain, nothing to remember, and no moment of internal alarm when somebody glances at her screen. What it costs is that anybody who looks in the obvious places can see it, and that the decision to be open is very hard to reverse later. It suits a woman whose people would be unbothered, or who has decided she would rather be known than careful. That is a legitimate choice and not a naive one.

The second is compartmentalised. One part of her life runs in its own channel: a separate address for this kind of correspondence, a chosen name, a habit of not mixing the two. What it buys is that an accident in one compartment does not open the other, which is the failure mode that actually happens. What it costs is upkeep, and the upkeep never ends, and there is a specific tiredness to maintaining any boundary that has to be remembered rather than built. It suits a woman with a real reason for separation and enough order in her life to hold it.

The third is minimal-trace. She keeps the footprint as small as the thing allows: as little written down as possible, nothing in a shared system, payment that leaves no line anybody else reads, and a general preference for arrangements that do not require her to be in anybody's records. What it buys is the smallest surface. What it costs is convenience, sometimes money, and a degree of effort that is genuinely wearing, plus the fact that a great deal of ordinary life simply is not built for it. It suits a woman for whom a single disclosure would be seriously damaging.

Choose against your own threat model, which is the thing none of this can see for you: who, specifically, would it hurt to have know, and what would actually happen. A woman whose honest answer is "it would be awkward for a week" and a woman whose honest answer involves her housing or her custody of a child should not be following the same advice, and almost all advice is written as though they should.

Whichever posture she picks, it is worth knowing where the leaks actually come from, because they are boring and they are not where she has been looking.

Messages announce themselves. A phone on a table shows a sender and a first line to anybody in the room, and that is a default rather than a choice she made. Photographs travel. A picture taken on one device appears on another that somebody else sometimes uses, because the convenience was switched on years ago and has been working perfectly ever since. Money keeps notes. A statement is a list of who she dealt with, and it arrives somewhere, and somebody may open it.

Shared arrangements are the quietest of all: a family telephone account, a household subscription, a device somebody borrows, a car that remembers destinations, a calendar that syncs a title to a screen in the kitchen. None of these was set up to expose her and all of them will, and the reason to know about them is not to become vigilant about everything. It is to be able to choose one or two and stop worrying about the rest.

And the one that is not technical at all: the second person. Anything she says is now held by somebody whose judgement is not hers and whose loyalties may shift. That is not a reason to tell nobody. It is the reason the disclosure decision deserves more thought than the settings do.

There is a question sitting underneath all of this for some readers, and it deserves to be met directly rather than tiptoed around.

Some women reading this are keeping something from a person who would be hurt to learn it. That is a real situation, it is common, and it is not the same as wanting a private life in general.

This essay does not advise on whether to keep it, how to keep it, or what it means. Not because the question is shameful, but because it is a question about a relationship and not about privacy, and answering it here would be answering the wrong one. This chamber has an essay about what a secret does to the terms between two people, and that is where the question belongs, and it is a genuinely different argument from this one.

What can be said here is only this: the fact that she wants a private life is not evidence of anything. Wanting one part of her life not to be discussed at dinner is ordinary, and she is allowed to want it without first proving that she has nothing to hide.

The general argument travels. The local conditions are specific, and two of them matter for the decision.

Ordinary life here runs through a small number of accounts that link a great deal together: a telephone line that is also an identity, a messaging app that is where nearly every relationship lives, a payment method attached to both. That concentration is convenient in a way that is hard to overstate and it means a single point of visibility covers unusually much, which raises the value of any separation she does decide to maintain.

And the social condition. There is a strong and mostly kind norm about not causing trouble for the people around one, and a woman weighing what to disclose is often weighing not her own comfort but the trouble a disclosure would cause her family. That is a real consideration and not mere timidity. It also tends to be undercounted by advice written elsewhere, which frames privacy as an individual right rather than as a calculation about other people's peace.

This chamber has written that a chosen name can be a boundary rather than a lie. In a country where one account tends to carry the whole of a person, a chosen name is doing more work than it looks like it is doing, and it is worth understanding as a structural measure rather than a small social evasion.

You do not owe anybody a justification for wanting one part of your life to stay in one place. Privacy is not a confession of wrongdoing, and the request to explain why you want it is not a fair request.

You do not owe anybody the maximum posture. If the honest answer to who would be hurt by knowing is nobody in particular, you are allowed to spend nothing on this and use your own name, and that is not carelessness. It is an accurate reading of your own situation.

And you do not owe anybody perfection. A budget spent in two or three well-chosen places and nowhere else is not a half-measure. It is what a competent decision looks like when the resource is finite, and it is a great deal better than the alternating pattern of elaborate caution and exhausted abandonment that "be careful" produces.

The disclosure belongs at the head of this section. This house sells an experience that is easier to consider when privacy feels manageable, so an essay that reduces a woman's anxiety about disclosure is commercially convenient for it, and that is worth stating before anything else in this section is read.

So the obligations are recorded, and the first is about what the house itself holds. Any booking creates a record somewhere, including here. A woman choosing a posture should count this house among the places her information sits, rather than treating it as outside the calculation, and the honest position is that a house that told her it holds nothing would be lying.

The second is the limit that matters most. Nothing in this essay is security advice and no measure described here is a guarantee. It is a way of thinking about a budget, not a protection, and a woman whose situation is genuinely dangerous — where a disclosure would put her housing, her children or her safety at risk — needs support of a different kind than an essay or a booking, from a professional or a specialist service, and this house is not that and should not be treated as it.

And the third. The house benefits when a woman shares more with it, because the work is better when a practitioner knows what matters. That interest is real and it is in tension with everything above, so the obligation runs the other way: a service should be legible enough that she can tell what it will hold before she decides, which this chamber has argued is readable off a booking form, and she should be able to say less and still be treated well. A house that required the fullest disclosure in order to be gentle would be selling a discount on her privacy and calling it care.

This essay is not security, legal or technical advice, describes no protection, and offers no guarantee about any service, application, device or payment method. It names no product and gives no instructions. A woman whose situation is genuinely dangerous — where a disclosure would put her housing, her children or her safety at risk — needs a professional or specialist service rather than an essay, and the house section says so in its own text rather than only here.

The central argument — that privacy is a finite budget of friction rather than an achievable state, that the exposure which matters in an ordinary life is relational rather than technical, and that several different postures are each coherent depending on a threat model only the reader can see — is this essay's own. It is offered as analysis rather than a research finding, no mechanism or effectiveness claim is made, and no figure, proportion or duration is asserted anywhere.

The three postures are presented deliberately without a ranking, each with its honest cost, and the essay states that a woman in any of them can be entirely sensible. Nothing is recommended, and the section on ordinary channels describes common defaults of shared life in general terms rather than instructing anybody to change any setting.

The essay explicitly declines the question of whether or how to keep something from a person who would be hurt by it, states that this is a question about a relationship rather than about privacy, and routes it to the earlier essay that is actually about it. It does not advise concealment and makes no claim about anybody's circumstances.

The claims that privacy used to be the default and is now maintained, that a chosen name can be a boundary rather than a lie, and that a service's character is readable off its booking form are credited to this Library's earlier essays and deliberately not re-expounded.

The section on local conditions describes account concentration and a social norm about not causing trouble for one's family. It is offered as observation rather than measurement, no statistic is given, and it makes no claim about any individual.

The section on the house discloses that the argument is commercially convenient for it, and records the obligations: that any booking here creates a record which belongs in her calculation, that nothing described is security advice or a guarantee and a dangerous situation needs professional support, and that the house's own interest in fuller disclosure is in tension with the argument, so a woman should be able to say less and still be treated well.