Most cloud storage isn’t private by default. Google Drive, Dropbox, OneDrive — the provider holds the keys to your files, encryption or not. Over the past year I’ve rebuilt how I store everything, from photos to SSH keys, around one plain rule: whoever hosts my data should never be able to read it. Here’s exactly how that looks in practice.
A NAS-First Home Foundation
The backbone of my setup is a Synology NAS on my local home network — not exposed to the internet, and kept segmented away from untrusted devices like the game console or the TV box. It doesn’t just store files: it runs CalDAV and CardDAV, so my calendar and contacts sync across every device without ever touching a third-party server. Synchronization happens through Synology Drive and DAVx5, along with automatic photo upload. One honest limitation: sync only happens once a device reconnects to the home network, so parallel edits from multiple people while offline can conflict. A portable encrypted hard drive, stored off-site, handles the backup.
Cryptomator Layered On Trusted Storage
For anything I need on the go — travel documents, things I want reachable from my phone — I run a Cryptomator vault inside a Nextcloud instance run by a trusted organization. The vault means the provider only ever sees encrypted blobs, regardless of who’s hosting it — this setup used to live on Dropbox before I moved it, and Cryptomator genuinely doesn’t care which cloud sits underneath. The apps feel like just another drive on every platform, so there’s no real friction to using it daily. For anything more sensitive still — SSH keys and similar — I keep a second, local-only Cryptomator vault, backed up to encrypted USB keys rather than synced anywhere at all.
Options If You Skip Self-Hosting
Not everyone wants to run a NAS. If you’d rather not self-host, Proton Drive is a solid entry point — zero-knowledge by default, Swiss jurisdiction, and it folds neatly into the rest of the Proton ecosystem if you’re already there; I use it myself for occasional temporary storage, though it’s not yet as mature as the alternatives (no native Linux desktop app as of mid-2026). If you’re on an iPhone, switching on iCloud Advanced Data Protection is worth doing even though it’s imperfect — mail, contacts, and calendar stay outside the encryption for interoperability reasons, so treat those as still visible to Apple.
There’s no single right answer here — it’s a trade-off between convenience and privacy that only you can weigh for your own situation. Self-hosting gives you full control but takes real effort to set up and maintain. A zero-knowledge provider gets you most of that privacy benefit without touching a server. And standard cloud storage remains the convenient default that most people are unknowingly trading their privacy for. Whatever you pick, the goal is the same: make sure the provider storing your data can’t actually read it. If you’d rather skip the personal story and just see the recommended tools, check out our Simple Privacy Fix on cloud storage.
Key Takeaways
- A local NAS keeps files, calendar, and contacts synced without ever leaving your home network
- Cryptomator adds client-side encryption on top of any cloud provider — the storage layer becomes irrelevant
- Keep especially sensitive data, like SSH keys, in a separate, local-only vault
- If you don’t want to self-host, Proton Drive and iCloud Advanced Data Protection are solid starting points
- Privacy versus convenience is a personal trade-off — there’s no universally correct choice
Image: AI-generated via Venice AI