Mutiny Labs

Your family's digital life · Part 1 of 3 · 5 min read

A practical privacy reset for your family.

Six useful changes, a consent-based email breach check, and the places to turn when something has happened.

In this series · 3 parts
  1. 1. A practical privacy reset for your family.
  2. 2. What happens to the photos you share?
  3. 3. The conversation to have before a threatening message.

Six changes to make together.

  1. Review one public album. Look for names, birthdays, school details, uniforms, street signs, and locations. Remove identifying details you do not need to share.
  2. Check the audience. Use the smallest suitable audience for family posts and review followers. Privacy settings reduce exposure; recipients can still copy or reshare.
  3. Check photo location information. Review camera and sharing settings. Do not assume every app removes the same metadata.
  4. Protect the accounts. Use unique passwords and strong multi-factor authentication. Review recovery details and remove unfamiliar sessions.
  5. Practice asking for help. Explain that a child will not be punished for bringing you a threatening message. Discuss pressure, secrecy, money demands, and requests for intimate images without blame.
  6. Save the reporting resources. For threats or image abuse, get help through the resources below. Avoid forwarding intimate images to prove what happened.

Choose one change together. The aim is a family routine people can maintain, not a one-time lecture or a promise that every risk can be eliminated.

For non-consensual intimate imagery, the TAKE IT DOWN Act requires covered platforms to remove reported material and known identical copies within 48 hours of a valid request. Check the platform's process and the FTC guidance; this is not a guarantee that every copy across the internet will disappear.

Start with the addresses in your own house.

↳ yours first, then the others, with permission

An adult’s compromised account can expose the things a family audit is actually about: the recovery channels for everyone else’s logins, the school portal, medical records and the photo library. A reused password on a parent’s email reaches all of them. So this is a sensible place for a family audit to begin, and consent is the other half of doing it properly.

Put an address into the panel. We check it against Have I Been Pwned, the public breach index maintained by security researcher Troy Hunt, and show you what turned up.

the order matters: check your own address first, so you know what the result feels like before you sit down with anyone else.

Then, with their permission, help each person in your house check theirs.

Not behind their back. A teenager who finds out you ran their address without asking learns that you are someone to hide things from, which is the exact opposite of what this page is trying to build. Ask, do it together, and let them type it in.

Breach lookup

Check an address

Start with your own. Old addresses count too: the ones from 2009 are usually the worst.

Privacy: the address is checked against Have I Been Pwned through our own server. We do not save it in application storage or analytics, and we do not add it to any list. Being straight with you about the limit: it does travel through our server to HIBP, and transient operational logs may exist somewhere in that delivery chain, which is not something we can promise away. If you would rather avoid that entirely, look the address up on their own site instead. Full detail in our privacy policy.

Breach data powered by Have I Been Pwned.

The household list

One line per person, one address at a time. Tick them off as you go. The point is not the results: it is that by the end of it, everyone in the house has had the conversation about passwords once, on a calm afternoon, instead of in an emergency.

  • Your own main address, and every old one you can still remember.
  • Your partner’s, with them at the table.
  • Each child’s, with their permission, and with them typing.
  • The shared family address, if you have one: school forms, deliveries, the pediatrician.
  • Any grandparent whose email you already help manage.

If it has already happened.

↳ the numbers to have before you need them

Two things are true at once. The first is that this is more common than the silence around it suggests, and the family it happened to almost certainly did nothing careless. The second is that there are specific people whose actual job this is, and reaching them early changes how it goes.

Intimate imagery of a minor

NCMEC’s CyberTipline takes reports from anyone, and its Take It Down service helps get known images removed from participating platforms without sending the image anywhere.

report.cybertip.org ↗
takeitdown.ncmec.org ↗

Sextortion in progress

The FBI takes reports directly, and its guidance is consistent on the two things that matter: do not pay, and do not delete the messages. Keep the account open and screenshot everything.

ic3.gov ↗
fbi.gov/contact-us ↗

A child’s identity used for credit

The FTC runs the official recovery process, including the steps specific to a minor who does not have a credit file yet. It also has the checklist for freezing one.

identitytheft.gov ↗

the last thing, and the only one we would argue about:

Parents cannot control every downstream use of information already shared. Focus on the next post, the account settings you can change, and a conversation that makes asking for help easier. The photo-sharing article in this series explains the research and its limits.

Sections from the previous guide

Edited September 29, 2026. Research and source dates are retained; this edit is not a fresh review of every statistic or legal development.