Nostr privacy checklist: what leaks and how to stop it

Nostr is public by design. That's fine if you know exactly what you're publishing. Here's what leaks, in order of how often people get caught out.

1. Relays see your IP address#

Every relay you connect to sees your IP. Most clients connect to 5 to 20 relays, so many different operators can log it, and you don't know their retention policies.

• Use Tor. Amethyst (Android) has Tor built in. On desktop, run your client through a Tor SOCKS proxy if it supports one.
• A VPN is the weaker option. It moves the trust to the VPN provider.
• Keep your relay list short. Fewer relays means fewer logs.

2. Old DMs leak metadata#

NIP-04 DMs (kind 4) encrypt the text, but the sender, the recipient and the timestamp are all public. Anyone can see who you talk to and when.

• Use a client that supports NIP-17 private DMs. NIP-17 wraps each message in a "gift wrap" signed by a throwaway key, with a randomized timestamp, so outsiders can't see the conversation graph.
• Even then, a DM's privacy depends on both sides' clients. Don't put anything in a Nostr DM you couldn't survive leaking.

3. Your follow list is public#

Your contact list (kind 3) is a public event. It maps your social graph: friends, employer, local meetups, interests. Following your real-life friends from a pseudonymous key links the two.

4. Zaps are public receipts#

A zap creates a zap receipt (kind 9735), published by the recipient's wallet provider. It names the sender, the recipient and the amount. Some clients offer private or anonymous zaps; check what yours actually does before relying on it. A plain Lightning payment with no zap request attached leaves no public Nostr event.

5. Photos carry metadata#

Phone photos often include EXIF data: GPS location, device model, timestamps. Don't assume your client or the upload server (Blossom, nostr.build and others) strips it. Strip it yourself first, e.g. exiftool -all= photo.jpg, or take a screenshot of the photo and upload that.

6. Separate identities need separate everything#

A second npub is not a second identity if it:

• posts from the same IP (see 1),
• uses the same relays, avatar style, writing quirks or posting hours,
• follows or zaps your main account,
• uses the same Lightning address or NIP-05 domain.

Keep a separate key, a separate client profile, separate relays and a separate wallet for each identity.

7. Keys and signing#

• Your nsec is your whole identity. Use a signer (NIP-46 remote signing, or a NIP-55 Android signer like Amber) so web clients never see the raw key.
• Never paste an nsec into a website you don't fully trust.

8. Deletion is a request, not a guarantee#

A kind-5 deletion asks relays to drop an event. Many will, some won't, and anyone who already saved it keeps it. Assume everything you publish is permanent.

Quick checklist#

• Tor or VPN on
• NIP-17 DMs only
• Follow list reviewed: does it link me to anyone it shouldn't?
• Zaps: know what's public
• EXIF stripped before upload
• One key per identity, no cross-links
• nsec stays in a signer

If this helped, a zap keeps more guides coming. Corrections welcome.