Privacy is a feature you never see

Most of what we ship, you can see. A tighter layout, a smoother scroll, a delete button where you'd expect one.

This week, most of the work on a new social app we're building was the opposite. We went through it looking for the ways it could leak something about the people using it, and closed them before more people arrive.

None of it will show up in a screenshot. I still think it's some of the most important design work we've done on it.

Security gets filed under engineering

The usual split goes like this: designers own what you see, engineers own what's underneath, and security sits somewhere in a backlog until something goes wrong.

I don't buy that split for a social app. People hand it their photos, their location and their conversations. What happens to those things is part of the experience, even when nobody can see it happening.

So I'd rather treat privacy as a set of design decisions with a quiet interface.

What that looked like this week

A few examples, in plain terms:

• Photos carry more than the picture. A phone photo can hide where and when it was taken. The app now strips that hidden data when you post, so sharing a photo shares the photo.
• Your email stays yours. Other people looking at your profile no longer get your email address. You still see it in your own account.
• Signing out means signed out. Logging out, or changing your password, now ends your old sessions too, including on a phone you left somewhere.
• Conversations need a login to read. Chats under a post aren't open to anyone who knows where to look.
• Asking only for what we use. The Android app was set up to request microphone access it never needed. We removed it, and we wrote down exactly what data the app collects for the app stores.

There's more under the hood, but that's the shape of it. Each one answers the same question: what would someone reasonably expect to happen here?

The visible bits still matter

The same update also let people delete their own posts from the feed and their profile, not just from one hidden screen.

That one you can see. And I'd argue it belongs in the same list. Control over your own stuff is privacy too, it's just the part with a button.

Where this stops

I'm not claiming the app is now perfectly secure. Nothing is, and anyone who says otherwise is selling something.

We also made some calls on purpose and left a few things for later. Hardening is a habit, not a checkbox you tick once before launch.

And this level of care isn't the right first step for every product. A prototype for testing an idea doesn't need it. Something people trust with their photos and location does, before it grows, not after.

The best privacy work is the kind nobody notices. People just get what they expected.