The one setting everything else assumes.
Every privacy habit worth adopting, a locked chat, a hidden preview, a private album, starts from the same unstated assumption underneath it: that the phone itself is properly locked. A weak four digit code guessed in a few tries, or no code at all beyond a swipe, undoes every careful setting above it in one move, since an unlocked phone hands over everything at once rather than one careful layer at a time.
This is worth five minutes on its own, separate from any single app. The lock screen is the actual perimeter, the messaging apps sit safely behind it, and reinforcing that perimeter once is simpler than reinforcing every app individually and hoping none of them has a gap.
Passcode length, and why six beats four.
A four digit passcode has ten thousand possible combinations, comfortable odds for a determined guess with time and patience. Six digits pushes that past a million, and most phones now default to six for exactly this reason. Where the phone allows a custom alphanumeric passcode, letters and numbers together, it is worth the extra two seconds of typing each time, since it turns a guessable number into something patient guessing will not reach.
Whatever length is chosen, avoid the obvious: a birth year, four repeated digits, the last four of a number saved in a dozen other places already. A passcode chosen the way a good drawer key is chosen, memorable to you and meaningless to anyone else, is worth more than a longer one picked carelessly.
Biometrics, and the one thing they cannot refuse.
Face recognition and a fingerprint are quick, and quick matters, a phone unlocked dozens of times a day benefits from not typing a code each time. The trade worth knowing is a practical one rather than a technical flaw: a passcode lives only in memory and cannot be taken from someone unwilling to give it, while a face or a finger can, in principle, be presented without consent, a phone held up to a sleeping face, a hand guided to a sensor.
Most phones build in a fast way back to passcode only, worth knowing before it is ever needed rather than during. On an iPhone, pressing the side button rapidly five times opens the emergency screen and disables face unlock until the passcode is entered again. Several Android phones offer an equivalent lockdown option from the same power menu. Both take moments to learn and are worth trying once, calmly, rather than for the first time under pressure.
Auto-lock timing, the setting nobody revisits.
The gap between putting a phone down and it locking itself is its own quiet risk. A screen left face up on a table for the extra thirty seconds a generous timeout allows is a screen anyone nearby can glance at, notifications and all. Setting the screen to lock after thirty seconds or a minute, rather than the longer defaults some phones ship with, closes that window without making the phone noticeably less pleasant to use.
What a strong lock does not solve.
None of the above helps once a phone is already open in someone else's hand, whether passed over willingly for a photo or picked up while briefly unattended. A lock guards the door, not the room behind it, which is exactly why the settings covered elsewhere on this site, a locked chat, a hidden preview, a private album, still earn their keep once the door itself is shut properly.
Nor does the strongest lock make a phone easy to replace if it goes missing entirely. That is a separate, equally practical concern, worth planning for before it happens rather than during.
If the phone is lost or taken.
Amsterdam's cycling lanes and busy tram platforms carry a well known local caution: a phone held out while unlocking a bike or checking a map is an easy target for a passing snatch, and residents keep theirs close for exactly that reason. A strong lock screen turns a stolen phone from an open book into a locked box within seconds, buying time for the actual fix. Both major phone platforms include a remote find, lock and erase feature, worth switching on today rather than after the fact, since it cannot be enabled retroactively once the phone is already gone.
Where this meets a booking.
None of this changes how a booking itself is arranged. A hotel outcall evening in Amsterdam Centrum is confirmed the same three line way whether the phone that arranged it locks in five seconds or fifty, and a companion filed under petite or athletic is booked through the exact same thread either way. What changes is only what a stranger sees if that same phone is ever picked up, glanced at or briefly out of your hands, which is precisely why this setting sits first on this list rather than last. The booking page covers what that thread actually needs to hold.