What is the difference between privacy and security?

Security protects information from intruders — locks, encryption, alarms keep the wrong people out. Privacy is control over exposure — deciding who is allowed to see, collect, or share your information in the first place. Security is the lock on the door; privacy is deciding who gets a key.

Can something be secure but not private?

Easily — it describes most of the internet. A company can guard your data expertly against hackers while reading, profiling, and monetizing it themselves. Bank-grade security says nothing about what the company itself does with what it can see.

Is encryption a privacy feature or a security feature?

It depends on who holds the keys. Encryption where the company keeps a key is security only — it protects against outsiders, not the company. Zero-knowledge encryption, where only you hold the key, delivers both at once: intruders get nothing usable, and the company can't see your data either.

Does a privacy policy mean my data is private?

No — a privacy policy is a description, not a protection. It tells you what a company chooses to do with the data it can see. Real privacy is architectural: the company can't misuse what it was never able to read.

What gives you both privacy and security at once?

Zero-knowledge, end-to-end encryption: your data is encrypted on your device and only you hold the key. That single design choice keeps intruders out (security) and keeps the provider itself unable to look (privacy).

Privacy vs. security: the difference, and why both

Not the same thing

"Private and secure" gets said in one breath so often that the two words have blurred into one. They aren't the same thing — and the difference decides who can actually see your information. The short version: security keeps intruders out; privacy decides who's allowed in at all. Security is the lock on the door. Privacy is deciding who gets a key — and who even knows what's inside.

Once you see the distinction, a lot of confusing product claims suddenly become easy to read. Here it is in plain English.

The distinction

Two different questions

Every product that holds your information answers both, whether it says so or not — security is a property of the walls, privacy of the rules and who holds the keys.

Security

"Can the wrong people get in?" Protection against intruders — encryption, strong logins, alarms, audits. Keeping attackers away from what's held.

Privacy

"Who's allowed to look at all?" Control over exposure — who may see, collect, keep, and share your information, including the company holding it.

Two failure modes

One without the other

This is where the confusion does real damage, because the two failures look nothing alike.

Secure, but not private

Most of the internet. A company defends your data expertly against hackers — while reading, profiling, and monetizing it itself. The walls are excellent; you're just not who they serve.

Private, but not secure

The diary in a drawer, the passwords in a notes app. Nobody's supposed to look — but nothing stops whoever finds it. A promise with no enforcement.

You need both

Neither half is enough alone.

Security without privacy builds a beautifully guarded warehouse of your life — one someone else controls. Privacy without security is a polite request that lasts until someone impolite shows up. Real protection is both: the lock, and deciding who gets a key.

Both at once

What having both looks like

One design delivers both at once — because it changes who holds the keys. Its name is zero-knowledge encryption, where security and privacy stop being separate features and become one architecture.

Encrypted on your device

Your data is scrambled before it goes anywhere — intruders who break in find nothing usable. The security half.

Only you hold the key

Not the provider, not its staff, not anyone who compels it. Nobody can look without you. The privacy half.

You choose every exposure

Sharing becomes a decision you make per person and per detail — not a default someone else set for you.

And remember the other half of the picture: privacy isn't only about the tools you pick — it's also about how much of you is already out there. That's its own topic, and its own fix: what personal data you're giving away, and how to take it back.

How to tell

What a product actually gives you

Three signals for each — and one red flag that fools almost everyone.

Security signals: encryption in transit and at rest, two-factor authentication, independent audits, a way to report vulnerabilities. These tell you the walls are real.

Privacy signals: data minimization (it asks for less, not more), no selling or sharing with partners, real deletion, and — the strongest — zero-knowledge design, where the provider can't read your data at all.

The question that cuts through: "If this company wanted to read my data tomorrow, could it?" If the honest answer is yes, you have security at best — privacy is running on trust.

The red flag: "we have a privacy policy" offered as proof of privacy. A policy is a description, not a protection — it tells you what a company chooses to do with what it can see. Real privacy means there's nothing for the policy to decide.

Where Simply Once fits

We refused to pick one. Simply Once is zero-knowledge and end-to-end encrypted, so the same design that keeps intruders out also keeps us from ever seeing what you store — and every share is a choice you make, field by field. Security and privacy, one architecture. See exactly how on our security page.

Part of the guides to protecting your personal data and organizing your family's information →