Gathering some basic information about the people using your application is fairly standard. A couple personal details, some custom events, a few external services and maybe some social stuff. No big thing.
But it doesn’t take long to find an article in the news about a data breach or record breaking fine to highlight that privacy is becoming a very mainstream topic. So mainstream in-fact that Apple produced a billboard to poke fun in other companies’ phones lack of privacy.
All that mainstream attention begs a question you might not have asked before.
What’s my application’s position on privacy?
Initially, this sounded like a silly question. The applications I build are very private. HTTPS and everything. However, after reading Feedbin’s private by default, It became apparent that I hadn’t even scratched the surface of what privacy really means.
Privacy isn’t security and I had fucked up thinking it was one and the same. Sometimes security and privacy overlap but just because you’ve built a secure application doesn’t mean it’s a private one.
A private application strives to capture as little information about people, prevents people from being subjected to tracking and respects people’s information.
A tall order, but given that my application is secure, why should I put my (limited) energy into making my application more private? Here are two reasons I hadn’t considered when I asked the same question.
Privately faster
There is a real benefit to private application design and it takes the form of a leaner product.
When you set a standard for privacy you write off many tempting things. Products which allow you to really figure out who people are using your application are a big no. Convenient services that speed up feature development are no longer a consideration. Even small things like loading fonts becomes a little more cumbersome.
This all sounds pretty doom and gloom but It needn’t be, as the end result is an application which is not only more private but leaner too. Here are just a couple by-products of private application design I’ve found along the way:
- You ask for less information about people and have less of it hanging around. You can’t breach what you never stored to begin with.
- Your application creates no third-party requests (it’s like a magic trick for performance).
- Onboarding workflows are made simpler as there is less complicated consent to jump through.
- The myriad of tick boxes and user preferences on settings pages vanish.
- Chunks of business logic become simpler as you report less about people’s behaviour (this increases at a factor of every language/platform you support).
- You have fewer moving parts syphoning data to and from external services.
- With fewer services to depend on, your application has fewer of their dependencies (both literal package dependencies and availability of their service).
- Loading fonts or proxying images become important to “get right”. Initially this feels like a waste of time but in the end, the elegance and performance of loading assets solely through your application are worth it.
I’ve found that every part of an application has a burden lifted when you decide to record as little about people as possible by default.
A feature you never knew you had
Facebook’s classic “You might know” feature was already creepy when it came out in 2016. Can you even imagine that same feature produced In 2019? It would be dead on arrival. So it’s no surprise, there’s a surge in popularity for privacy-focused products like DuckDuckGo and ProtonMail. Private products are on the rise.
To contrast that, there’s a lot of applications out there that focus on clever features that crunch and process user data to do something “magical”. The features they promote that walk the line on privacy are becoming anti-features.
These types of companies are easy pickings to compete against because for them, nothing is off limits. Consider that Standard Notes competes with Evernote on (largely) privacy alone and I’m optimistic that privacy is a feature your application can compete on too.
When your application is private by default, so are your application’s features. As long as you don’t track people and do weird things with their data you’ve just gained a brand new feature. It’s that simple. You’re now the application that focuses on privacy and you’ve just found yourself a brand new set of users who will pay you to record less.
The weightlessness of privacy is liberating not only the people using your application but building it too. Why not introduce more privacy and become faster and more featureful along the way.
I know very little about you, and that’s just fine with me.