Loading page
About this tool
30-point X privacy audit — phone and email discoverability, protected posts, location tags, DM requests, Grok AI training and connected apps.
This checklist covers the 30 settings on X, formerly Twitter, that decide whether people can find you by phone number or email, what your posts and location tags reveal, who can message you and how your data is shared. It includes the discoverability pair that most often unmasks a pseudonymous account, the bulk removal of location information from past posts, the message-request options, the Grok AI training setting that was enabled by default for existing accounts, business-partner data sharing and connected apps. Each is weighted by exposure removed and re-weighted for whether you are anonymous, public, being harassed or minimising data.
Open X (Twitter) Privacy Settings Checklist on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Phone and email discoverability are the two settings that connect an anonymous handle to a real person — they lead the checklist.
The AI training and business-partner sharing switches were turned on for existing accounts without a prompt.
Being brigaded and staying anonymous produce very different orderings of the same 30 settings.
Settings and privacy > Privacy and safety > Discoverability and contacts, then turn off both 'let others find you by your phone number' and 'by your email address'. Also use Manage contacts > remove all contacts, because switching syncing off does not delete the address book already uploaded.
Settings and privacy > Privacy and safety > Location information. There are two separate things there: stop adding location to new posts, and a bulk action that removes location information already attached to past posts. Most people do the first and never run the second.
There is a dedicated control at Settings and privacy > Privacy and safety > Grok and third-party collaborators, covering whether your posts, interactions and inputs train X's models and are shared with collaborators. It was switched on by default for existing accounts, so check rather than assume.
It stops non-followers seeing your posts from that point and removes them from public search, but anything already public may survive as screenshots, archived copies and quote posts elsewhere. Protecting is a forward-looking control, not a retroactive delete.