What if I’m more paranoid than your regular user?

Then use the tools built for exactly that, and understand what each one actually does. Being cautious is not the same as being helpless; it is a matter of knowing which switch changes which risk.

Start here

1. Two-step verification. Settings, Privacy and Security. Adds a password on top of the SMS code, which closes the most common real-world attack.
2. Secret Chats. End to end, tied to the two devices, nothing in the cloud. Use them for anything that must not exist elsewhere.
3. Self-destruct timers. Inside a Secret Chat, set how long a message survives after it is read.
4. A passcode on the app. Separate from the phone's own lock, so the handset being unlocked does not mean the chats are.
5. Active sessions. Settings, Devices. Terminate anything unfamiliar, and set old sessions to expire automatically.

Reduce what you reveal by default

• Phone number. Set who can see it, and who can find you by it.
• Last seen. Hide it, or limit it to contacts.
• Profile photo. The same choice applies.
• Group additions. Restrict who can add you, which is how most unwanted group invitations arrive.
• Calls. Restrict who can call you, and use peer-to-peer only with contacts.

Reduce your account's dependence on a number

A username lets people reach you without ever seeing your phone number. You can go further and set the account to delete itself after a chosen period of inactivity, under Settings, Privacy and Security.