Nothing here is sophisticated. Nobody is being hacked. People are caught by autocomplete and by notification previews, which is why the fixes are mechanical and take about ten minutes in total.
The eight places it actually surfaces
Address bar autocomplete. Type two letters, the browser offers the site. The most common leak by a distance, and it survives clearing history if the site is bookmarked or has a saved password.
Lock-screen notifications. From the app, or from your bank about the charge. Previews show the sender and the first line to anyone in the room.
Synced tabs and history. Chrome, Safari and Firefox sync across devices on the same account. An open tab on your laptop is visible on a family iPad signed into the same account. Private browsing does not stop this because the tab is not private — it is on your normal profile.
Saved passwords. The autofill list is a list of the sites you use, readable by anyone with an unlocked device.
Downloads folder. Generated images land there with descriptive filenames.
Photo library sync. A downloaded image on a phone can land in a library that backs up to a shared family album.
App store purchase history. Family Sharing surfaces purchases to other members.
Keyboard learning. Phone keyboards learn the words you type and then suggest them in other apps, including messaging ones. This one genuinely surprises people.
The fixes, in order of value
Use a separate browser profile
The single highest-value change, and it takes two minutes. A second Chrome or Firefox profile — signed out, or signed into a separate account — gets its own history, its own autocomplete, its own saved passwords and its own sync.
This solves autocomplete, sync, saved passwords and most of the rest in one move, and unlike private browsing it stays logged in, so it is actually sustainable.
Turn off notification previews
System-wide is easiest: iOS Settings → Notifications → Show Previews → When Unlocked; Android has the equivalent under notification settings. Do it for your banking app too, for the reasons in payment privacy.
Do not save the password in the shared profile
Keep it in a password manager behind its own lock, not in the browser's autofill on a device other people use.
Change the download location
Point image downloads somewhere that is not the default Downloads folder, and keep it out of any folder that syncs.
Check keyboard learning
On iOS, Reset Keyboard Dictionary clears learned words. On Android it is under the keyboard's personalisation settings. Worth doing once after a few weeks of use.
Private browsing is not the answer
It is worth being precise about this, because people rely on it and it is only partial.
Private browsing prevents history, cookies and cached files persisting on that device. It does not prevent synced tabs, saved passwords, downloads, notifications, keyboard learning or anything at the network level. It also logs you out every session, which for a browser-only app means re-authenticating constantly.
A separate profile does more and costs less friction.
Why browser-only can be the safer choice
Camsoda AI and Joi run only in a browser, and Secret Desires in a mobile browser. On a shared phone that is a genuine advantage: no icon, no app in the app switcher, no entry in purchase history.
The cost is session persistence — browsers clear cookies and iOS evicts site data aggressively, so expect to log in often. The full trade-off is in browser or app store.
If the device is not yours
A work laptop is a different category entirely. Assume network monitoring, assume managed-device software can see browsing regardless of private mode, and assume IT can read it. No browser setting changes any of that.
The only correct answer on employer hardware is not to. That is not a privacy tip, it is an employment one.
The honest floor
None of this protects you from someone with your unlocked device and an interest in looking. It protects you from the accidental case — the glance at a lock screen, the shared tab, the autocomplete — which is what actually happens.
Pair it with the account-side basics in account security and you have covered the realistic risks.
