Nothing here involves cleverness on anyone's part. Nobody is hacking you. People get caught by a suggestion in the address bar or a preview on the lock screen, so the remedies are simple and take roughly ten minutes all up.
Eight places you can give yourself away
Address-bar suggestions. Type a couple of letters and the browser offers the site. By a long way the most common slip, and it outlives clearing your history if the site is bookmarked or has a saved login.
Lock-screen alerts. They might come from the app, or from your bank about the payment. Previews show the sender and first line to whoever is in the room.
Synced tabs and history. Chrome, Safari and Firefox share data between devices on one account. A tab open on your laptop can appear on a family iPad signed into the same account. Incognito doesn't prevent that, because the tab was never private on your normal profile to begin with.
Saved logins. The autofill list is effectively a list of sites you use, readable by anyone holding an unlocked device.
The Downloads folder. Generated pictures end up there with revealing filenames.
Photo library syncing. An image saved on a phone can flow into a library that backs up to a shared family album.
Purchase history in the app store. Family Sharing shows purchases to other members.
Keyboard learning. Phone keyboards pick up the words you type and offer them in other apps, messaging included. This one catches people out.
Fixes, best value first
Set up a second browser profile
The biggest single improvement, and it takes about two minutes. A second Chrome or Firefox profile, signed out or signed in with a different account, keeps its own history, its own suggestions, its own saved logins and its own sync.
That covers suggestions, syncing, saved logins and most of the rest in one go, and unlike incognito it stays signed in, so you'll actually keep using it.
Switch off notification previews
Doing it for the whole phone is easiest. On iPhone go to Settings, then Notifications, then Show Previews, then When Unlocked. Android has an equivalent in its notification settings. Do the same for your banking app, for the reasons in payment privacy.
Keep the password out of the shared profile
Store it in a password manager with its own lock, rather than in browser autofill on a device other people use.
Move where downloads go
Send saved images to a folder that isn't the default Downloads, and make sure it isn't one that syncs.
Reset keyboard learning
On iPhone, use Reset Keyboard Dictionary to wipe learned words. On Android, look under the keyboard's personalisation options. Worth doing once after a few weeks of use.
Why incognito falls short
People trust it, so it's worth being exact about what it does.
A private window stops history, cookies and cached files from staying on that device. It does not stop synced tabs, saved logins, downloads, notifications, keyboard learning or anything happening on the network. It also signs you out every session, so with a browser-only app you'll be logging in constantly.
A separate profile does more with less hassle.
The case for browser-only apps
Camsoda AI and Joi work only in a browser, and Secret Desires in a mobile browser. On a shared phone that's a real plus: no icon, nothing in the app switcher, no line in your purchase history.
The catch is that sessions don't last. Browsers wipe cookies and iOS clears site data eagerly, so you'll sign in often. The full pros and cons are in browser or app store.
When the device isn't yours
A work laptop is another matter altogether. Assume the network is monitored, assume management software sees your browsing even in a private window, and assume IT can read it. No browser setting alters that.
On employer equipment, the only right move is to stay away. That's less a privacy tip than a job-security one.
What this can and can't do
None of it stops someone who has your unlocked device and wants to snoop. It guards against accidents: a glance at the lock screen, a shared tab, a stray suggestion. Those are what actually happen.
Add the account-side habits in account security and you've covered the realistic risks.
