Privacy and security

Off by default: telemetry, remote code, unverified downloads, and shortcuts that trade security for convenience. Every change is listed here with the file behind it.

Everything on this page is a config file or a service state you can inspect and reverse. Running the installer again re-applies the set; uninstall.sh --restore-telemetry puts Ubuntu's defaults back.

Off by default, at a glance

Telemetry: crash reports and usage statistics to Canonical, Ubuntu Pro adverts, the connectivity probe, and data collection in Firefox and the Chromium family.
Remote code: no curl | sh installers, no plugin hooks, no menu extensions, no themes cloned from arbitrary repositories.
Unverified software: every archive checksummed, every apt key checked against a pinned fingerprint, every upstream pinned to a commit, root steps run with a fixed PATH.
Security shortcuts: no passwordless sudo, no autologin, no remembered screen-share permissions, no plain-text password storage in browsers, no radios silently unblocked.

Canonical and Ubuntu

Crash reporting. apport is disabled (/etc/default/apport) and whoopsie, the uploader, is removed. ubuntu-report, popularity-contest and kerneloops are removed if present.
Ubuntu Pro adverts. Off in the login message (/etc/default/motd-news) and in apt output (pro config set apt_news=false). The Pro timer is disabled.
Desktop statistics. Usage statistics and problem reporting are off in the GNOME privacy settings that GTK apps read.
Connectivity probe. NetworkManager's check against connectivity-check.ubuntu.com is off (/etc/NetworkManager/conf.d/99-ombuntu-no-connectivity-check.conf). The trade-off: captive-portal login pages are no longer detected, so on hotel or airport Wi-Fi open any plain http:// page to reach the login. Delete the file and reload NetworkManager to restore it.

Firefox

A policy file at /etc/firefox/policies/policies.json, which the snap reads too: telemetry, Firefox Studies, Pocket, sponsored tiles and suggestions, and recommendation nags are off; tracking protection is strict with cryptomining and fingerprinting blocked.

Chrome, Chromium, Brave, Edge, Vivaldi

A policy file in each browser's managed-policy directory (for example /etc/vivaldi/policies/managed/): metrics reporting, URL-keyed data collection, extended Safe Browsing reporting, cloud spell-check, address-bar search suggestions, alternate error pages, link prefetching, promotions, surveys, shopping features and the Privacy Sandbox ad APIs are off. Field-trial fetching is limited to critical fixes. Edge additionally has diagnostic data and personalisation reporting off.

Saved passwords are stored with the GNOME keyring rather than a plain-text fallback, because Ombuntu launches browsers with the keyring backend selected.

Developer tools

DO_NOT_TRACK=1 and the opt-out variables for .NET, Next.js, Nuxt, Astro, Gatsby, Homebrew, PowerShell, Azure CLI, AWS SAM, Stripe CLI and Hugging Face are set in the session and shell. VS Code and Zed installed from the menu get telemetry off in their settings.

Left alone, and why

snapd talks to the Snap Store; that is how the Firefox snap updates.
Vivaldi sends its own anonymous usage-count ping, which has no policy switch.
apt downloads package lists from Ubuntu mirrors.

Security choices, in detail

Screen sharing asks which screen or window to share every time; the upstream default remembers the choice (a restore token).
Opening the Wi-Fi or Bluetooth panel does not unblock a radio you switched off.
The desktop's own command directory sits at the end of PATH, so nothing in it can shadow a system command.
Root is used for three things: apt, Signal's apt repository, and the login session file. Root steps run with a fixed system PATH, never one that includes user-writable directories.
Every download is pinned and checksummed; a mismatch aborts the install. Upstream code is pinned to commit hashes, not just tags; apps from GitHub releases (Helix, Zed, Ollama and the rest) install a pinned version with a pinned checksum rather than "latest". Vendor apt keys are verified by fingerprint before apt trusts them. Release tags are signed, and the installer refuses an unsigned one.
Plugin-style code execution is disabled: hooks, menu extensions and remote theme installs would all run arbitrary code with your user rights.
Passwordless sudo, autologin and installers that pipe remote scripts into a shell are not offered. The uninstaller removes only what the installer wrote.