Tech companies don’t have favourite songs, but if they did, they would all pick Radiohead’s Just – “You do it to yourself, you do/ And that’s what really hurts,” they would croon, staring their users dead in the eye. And strictly speaking, they’d be right: many of the worst excesses of the industry are, technically, optional. The world isn’t actually a binary choice between living in a surveillance state and opting out of all technological development since the turn of the millennium. You can opt out – you just have to know how.

Of course, that knowledge is not always easily acquired, nor is it necessarily easy to apply. So a new breed of services has arrived to try to help normal users take control of their digital lives. Companies including Disconnect.Me and Jumbo act as something like a digital concierge for their users, tweaking privacy settings, deleting sensitive data and throwing a spanner into the inner workings of surveillance capitalism.

But there’s a Faustian pact involved: to use the privacy apps to their fullest requires handing them a level of control over your digital life that would be all too easy to abuse – and it’s hard to be certain that any company can be trusted with information that sensitive.

The primary justification for the rise of privacy apps is the proliferation of settings screens in our lives and the powerful options buried within them. Web platforms are complex beasts, with sprawling networks of linked services, spin-offs and acquisitions, each of which treats users differently, has a separate place to change privacy settings and any one of which could theoretically expose some information you would rather was kept private.

Most of the companies that track you aren’t open enough for you to even know they’re snooping on you in the first place

Adding to the confusion is the fact that what your settings are at any given moment probably depends on when you made your account, when you last logged in and how good you are at reading pop-ups that flash in front of you when you just want to find out the address of the party you’re going to. Notoriously, Facebook has even actively changed privacy settings in the past, a practice for which it was hit with a “consent decree” by the US Federal Trade Commission in 2011. (Which it then broke in the course of the Cambridge Analytica scandal, leading to a $5bn fine.)

But even if a company hasn’t been so creepy as to actively change privacy settings to maximise the amount of information you publish, it can still be hard to find out exactly what you are sharing. For instance, whether or not Google is tracking your physical location 24/7 through your Android phone depends entirely on when you first used Google Maps and whether you have changed any settings since. Once, the company turned location history on by default; now, it does not.

Jumbo founder Pierre Valade: ‘Companies write privacy policies with lawyers. They make it harder for you to figure out how to opt out.’ Photograph: Courtesy Pierre Valade/PierreValade.com

Jumbo, an app for iOS and Android, launched in 2019 with the promise that it would cut through some of that confusion. The offer was simple: download the app, check a few boxes and it would automatically lock down your privacy settings on platforms including Facebook, Google, Twitter and Amazon. Rather than having to hunt down every individual preferences screen and decipher which settings were innocuous and which were merely deliberately phrased to sound innocuous, the app would do it for you.

Pierre Valade, the company’s Brooklyn-based founder, describes its role as an advocate for users everywhere. “It’s an unfair game between users at one end and companies at the other. Companies write privacy policies with lawyers and they make it harder for you to figure out how to opt out, how to delete your data, but as a user you’re supposed to figure out all of that yourself.

“It would take you a whole year to read your privacy policies, but if you go to a doctor, they don’t tell you to go and spend a year learning medical science; you go to a lawyer, you don’t need to read the whole IRS code. In fact, they have a whole ethical code about how to represent their clients. That’s the idea here: it’s about representing people and working for them, to simplify a complex system.”

Jumbo’s offering is possible, basically because the largest technology companies can be guilt-tripped into offering users the ability to opt out of the most egregious violations. Google doesn’t want you to turn off all of its ad personalisation, but, the company rationalises, most people probably won’t even know about the setting and it satisfies the privacy warriors to have the option to remove themselves from the tracking apparatus, even if most of the world leaves the options exactly as they are.

But for the rest of the internet, shame doesn’t work. Most of the companies that track you across the net aren’t polite enough to give you the ability to opt out, nor open enough for you to even know they’re snooping on you in the first place. You might remember to go into the cookie settings ‌for some websites, if you’re diligent, but eventually you’ll forget – or just visit a shady site that views GDPR as nothing more than a reason to ask for a vowel on Countdown.

For those sites, you need a rather pushier sort of advocate – something like Disconnect.Me. The company offers a service that mixes features of adblockers, firewalls and virtual private networks (VPNs) to sit between you and the snoopers, only letting through the information you intend to release into the world.

“Without protection like ours, thousands of trackers collect information about our online activity when we simply use our phones or computers,” says Casey Oppenheim, the company’s co-founder. “Most of these trackers are companies we’ve never interacted with directly, yet they collect detailed profiles including our location data, browsing history and more.”

For trackers across the net, that means the app maintains a blacklist, preventing the worst offenders from loading on to protected devices at all. Then, in situations where the snoopers might be sitting between the device and the internet – think an unscrupulously monetised airport wifi – the app offers a simple VPN service that kicks in automatically when needed, preventing anyone else on the connection from seeing what’s being shared.

Anyone, that is, other than Disconnect.Me. Because the difficult problem with the new wave of privacy apps is that, to use them to keep your data safe, you have to really trust them with the most sensitive information of all.

We’ve designed a technology that only works on the phone. It’s not bulletproof, but it makes it much harder Pierre Valade, CEO of Jumbo

Any VPN service, for instance, is in a position to monitor all of your internet use, with access only equivalent to an internet service provider in terms of what they see. (Better, in fact, since the VPN moves with you from network to network.)

Services such as Jumbo make an even bigger demand: for that app to work, it must ask you to enter your username and password for every service you want it to work with, probably the most sensitive passwords you have, given the importance of accounts on Facebook, Google and Amazon.

Both apps make clear that they have no intention of using that information. Disconnect.Me’s Oppenheim says: “We don’t want and don’t ask users to trust us with any sensitive information. In fact, we collect as little data as possible; we don’t even require email or any personal information and our technology is architected to not collect any user data. As per our privacy policy: ‘We don’t collect any of your personal info, including your IP address, other than information you voluntarily provide.’”

Jumbo goes a step further still: the app is carefully written so that the most sensitive information never leaves the user’s device. Where it would be a lot easier for Jumbo to work as a web service, connecting to various sites from a centralised server, instead it operates more as a heavily automated web browser, logging on to Twitter, Facebook and the rest on your behalf. The process is, admittedly, arduous: the first run-through can take a good while to complete and leave your phone rather hot. But, Valade hopes, it helps people trust his app with the keys to their digital kingdom.

Mark Zuckerberg testifies before the Senate commerce and judiciary committees, April 2018. Photograph: Xinhua/Rex/Shutterstock

“We’re trying to do a better job in the long run,” he says, “but I think that we do have a good foundation. If you go to a doctor, you have to give them your X-rays, your bloodwork. If you go to a lawyer, you have to give them the information about your case. You must trust them to work for you. But we’ve designed a technology that only works on the phone; we don’t have access to it. By design, it’s very safe. It’s not completely bulletproof, but it makes it much, much harder.”

Ultimately, it needs to come down to trust. That’s not unusual; after all, nearly every action you take in life is backed up by trust rather than technical guarantees. (There’s no technology, for instance, that stops the postie from opening your mail and gossiping about it with their pals.) But the sensitivity of their access means that the companies that provide privacy apps need to fight harder than most to prove they’re trustworthy.

For Valade, that means a particular plea not to focus on the gratis nature of Jumbo. “Something that’s been important for us is that we’re not seen as a free product, because everyone knows there is no such thing as a free product,” he says. Indeed, tech history is littered with the corpses of startups with a privacy-positive message that went on to monetise with far less consumer-friendly practices.

Jumbo is planning to introduce a subscription service in March, which will add extra features for people who want to increase their privacy and security; Disconnect.Me already has a similar option, Disconnect Premium, which offers permanent VPN use across up to three devices for $50 a year. The paid-for features, the companies hope, will convince their users that they aren’t secretly selling data on the side to fund their development. But the free tiers remain available, and, trust aside, it’s hard to see why they aren’t more popular.

There may be an element of fatalism for many: a feeling that there’s no real option to keep big tech out of our lives and privacy apps will only ever be a sticking-plaster solution. Valade hopes otherwise: “[It’s] a bit like saying you shouldn’t lock the door because someone can smash a door. Yes, I think people can stop using their phone, move to India, pay cash and live in the mountains. But the reality is that we can get more privacy now, within the world that we actually live in. So our goal is to make privacy so convenient that you can actually get it.

“Our point is actually more about control. Are you OK with what you sign up for?”

• This article was amended on 19 February 2020. An earlier version misquoted Pierre Valade as suggesting that people worried about internet privacy did not need to “. . . take hash and live in the mountains”. He said “pay cash and live in the mountains”. The article also said that the Jumbo app stored usernames and passwords for customers’ online accounts; in fact, the company has pointed out that this information is not stored, except as an optional feature in respect of Alexa.