How Arkyn protects you

Protection	In short
Full-disk encryption	LUKS2, ticked by default; a red warning if you untick it.
Network privacy	Random MAC per network, random MAC for Wi-Fi scans, encrypted DNS to Quad9, IPv6 privacy addresses.
No telemetry	Ubuntu’s reporting, crash upload, “insights” and Ubuntu Pro client are removed; the login news feed is off.
No snaps	Removed and pinned so they can’t return.
Firewall	On, refusing incoming connections; KDE Connect allowed from your local network only.
Hardening	AppArmor enforcing; a curated kernel profile that keeps developer tools working.
Bluetooth	Off on a fresh install; your choice sticks afterwards.
No credentials in the image	Claude Code and the GitHub CLI ship signed out; the build fails if anyone’s sign-in is found.
Secure Boot	Ubuntu’s signed boot chain and kernel, unchanged.

Read What Arkyn doesn’t do too.