Privacy shouldn't be a setting

Privacy is boring, and we may as well admit it. Nobody brings it up at dinner. Nobody posts about the app that didn’t track them. It shows up as the last line on a roadmap, gets a paragraph in terms nobody reads, and everyone moves on.

But there are two ways to be boring. There’s boring because nobody’s paying attention, and there’s boring because it just works — like a seatbelt, or the lock on your front door. Privacy should be the second kind. Right now it’s mostly the first.

Nobody can show you what wasn’t collected

Privacy has a marketing problem. When it works, there’s nothing to point at. You can demo a new button. You can’t demo the data you didn’t take. So the thing that quietly protects people loses to the thing that looks good in a screenshot, over and over, until privacy turns into a checkbox someone adds at the end.

That’s how it ends up in the settings.

If it’s in the settings, it isn’t the default

Here’s the part that actually matters. Most people never open settings. Not because they don’t care — because they’re busy and the app already works.

So when a company tells you that you can turn tracking off, what they usually mean is: we left it on, and you’re welcome to go find the switch.

An option buried three menus deep isn’t privacy. It’s an escape hatch for the handful of people who go looking. Whatever an app does the moment you install it is what it does for almost everyone who uses it. That’s the real setting, and it was chosen by someone else.

Ask the question before there’s a switch to argue about

We try to settle this long before there’s a settings screen. The question we start with:

Important

Can this feature work without collecting the data at all?

More often than you’d expect, it can. And when it can, a whole pile of problems simply never shows up. Data you never collected can’t leak, can’t be sold, can’t be handed over to anyone who asks, and can’t be dug up in three years by someone who doesn’t work here yet.

The good kind of boring

When this is done right, there’s nothing to notice. No banner asking you to reconsider. No settings screen to audit on a Sunday. No moment where you have to decide whether you trust us, because we never asked you to hand anything over.

That’s the boring we’re after. Not the boring that means nobody’s looking after it — the boring that means it’s already handled, and you can go think about something else.

Sometimes the honest answer is that a thing genuinely does need your attention, and the work is deciding how rarely to ask. Autofill approval in Vauz 1.4.2 is our attempt at that balance — including why we picked the default we did, and who should change it.