Many people install Potato, change their profile picture and nickname, and start chatting right away, leaving privacy options at their defaults. Default settings usually favor "convenience" over "security." The checklist below is ordered by priority; all the steps take about 10 minutes, and it is recommended to review them every three months.
Step 1: Secure the account entry point first
If your account is stolen, all the privacy settings below become ineffective. Go to Potato's "Settings—Privacy & Security" and first enable two-step verification, linking an email address or phone number you commonly use. Do not store verification codes in chat history, and do not screenshot them and send them to yourself.
On the same page, find "Login Devices" or "Active Sessions." You will see each device's name, login time, and approximate location. Here is a specific scenario: you have only logged in to Potato on your office computer and one phone, but the list shows an unfamiliar device that logged in three days ago. In that case, you should immediately end that session, then change your password and recheck whether two-step verification is still enabled.
It is also a good idea to turn off "Allow others to find me by phone number," or set it to "Contacts only." Phone numbers are public information; once this is off, the chance that strangers can find your account by searching your number drops significantly.
Step 2: Manage chats, groups, and files
Privacy at the chat level mainly comes down to three things: who can message you, who can add you to groups, and who can see your online status.
- Message permissions: Set "Who can message me" to "Contacts or my contacts," so strangers can only send a friend request first and cannot pop up messages directly.
- Group invitations: Change "Who can add me to groups" to "My contacts." Otherwise, you may wake up one morning to find yourself added to a dozen marketing groups.
- Online status and read receipts: If you do not want colleagues to be able to tell whether you are online at any moment, you can turn off public display of "Last seen" and make it visible only to contacts.
- Auto-download: Turn off automatic downloading of images and files in groups. Compressed files and installers sent in unfamiliar groups are common sources of risk; opening them manually at least lets you check the file name and size first.
- Invite links: For groups you create, set the invite link to "Require admin approval" or reset it regularly. If a 200-person group's link is publicly posted online for a long time, advertising accounts may get in within weeks.
Group admins should also check "Who can send messages" and "Who can edit group info." Restricting speaking permissions to members and leaving permissions to change the group name and picture to admins can block most scams that impersonate the group owner.
Step 3: Build a few effortless habits
Settings are only the baseline; daily habits determine the actual effect. If you receive a private message from "customer service" saying your account is abnormal and asking you to click a link to log in, do not click it first; go back to Potato's official entry point and check it yourself. For conversations involving transfers, verification codes, or ID photos, try to use end-to-end encrypted private chats rather than group chats.
Before switching phones or selling an old device, go back to the "Login Devices" list and manually log out of the old device; do not just delete the app. After logging in to Potato on a public computer, remember to log out and clear the local cache when you are done.
If you have not tried these options yet, open Potato's settings page and go through them; adjust any items that do not apply according to your own usage scenario. There is no standard answer for privacy settings; the key is knowing what each item controls and when you need to come back and check it again.
