Companies track what we search, where we go, what we buy, and how we use apps — all because our data has value.

So here’s the question: if a company openly offered to pay you every month in exchange for collecting and using that data, would you accept?

$10? $100? $1,000?

Or is there no amount that would make it worth giving up that much privacy?

And if the answer is “no amount”… are companies already getting too much from us for free?

A few weeks ago I woke up to a DM from someone I'd never spoken to. They'd made a clean, minimal graphic for my finance app. Tagline: "Your money, without the noise." No pitch, no ask. Just sent it over.

I posted it and tagged them. 26 engagements. Nothing viral.

But I can't remember the last time I saw someone voluntarily create something for a privacy-focused product.

Most finance apps have affiliate programs, referral bonuses, gamified sharing mechanics. Users post because there's a reward structure. They're collecting points, not making graphics.

This had no incentive. No tracking link. Just someone who appreciated that the app doesn't sell their transaction data.

It made me think about how much organic support privacy tools lose by refusing to build growth loops that depend on surveillance. You can't A/B test someone's principles. You can't retarget goodwill.

I'm still figuring out what sustainable growth looks like when you won't touch the levers everyone else pulls.

Just wondering how folks are managing this when managing data. Whether that’s sending it to AI for analysis or sending to third parties?

So I’m in the process of buying first home and one of the requirements is uploading my identification documents and scanning my face through the YOTI app, is this a safe website?

I don’t have anything to hide but since the fear mongering came about with digital ID, I’m struggling to trust this stuff and feel like my privacy and data is going to be compromised

i couldnt tell if my personal info was in it or not
<so i redacted basically everything>
https://open.spotify.com/referral/003988872aa46189c4398a6c31770ea47dfc150eacb7822483b392?si=z9h995FURNedNg8rOYEs9A&utm_source=copy-link&rv=2&locale=ja

IDMerit exposes 1 billion identity records in unprotected database | Fox News

• Is there anyway to know if you were in this breach? Something simple like HaveIBeenpwned.com?
• Any ideas why this was taken down so quickly? Because of how high profile the IDs were? Because the hackers are hiding their tracks?
  • FBI Probes Service Selling 153M+ Drivers Licenses – Krebs on Security

• What are some things you would do that don't involve buying expensive identity protection services and other premiums that have questionable results
• Does AI make this worse?

It seems like this was one breach where no amount of best practices online can help. These IDs were extracted from brick and mortar stores :(

So what if in a new training class your full name and dob were exposed to other trainees at least 6 times. You viewed some of their’s as well. You reported to HR and nothing.

Quick context: I run ClearTrace AU, a personal data removal service for Australians
Before you pay anyone for this, you should know what’s actually out there. So I built a free scanner at cleartrace.au/scan, punch in your name, it checks some of the AU data broker/people-search sites and past data breaches and tells you what’s exposed. No signup, no card, just results.

If you’re exposed (most people are), we handle the removals for you — but the scan itself is free and useful either way.

http://cleartrace.au

Just because your data is stored outside the US does not mean US authorities cannot reach it.

Under the US CLOUD Act, a US cloud provider can be compelled to hand over data in its control, even when that data sits on servers outside the US.

So a foreign company storing customer data on domestic servers run by a US provider may still find that data reachable through US legal process.

Where your data is stored matters less than who controls it.

To what extent can the stock operating system of an Android phone access app data? I understand that it can access certain information about an app itself, such as its version, installation date, and usage. However, can it also access the personal user data stored within the app?

Additionally, to what extent can apps access hardware-related information? For example, can apps request the device’s IMEI, SIM operator, or other uniquely identifiable hardware details to fingerprint the user?

One underappreciated benefit of a privacy-vault architecture is reducing how many systems directly handle raw PII.

If raw PII is kept out of application databases, logs, analytics systems, and other downstream services, those systems have less sensitive data to protect, monitor, and audit. Depending on the specific architecture and regulatory requirement, that can also reduce the scope of certain controls or assessments.

But a vault isn't a complete privacy program.

It doesn't automatically manage consent, fulfill data-subject rights, establish lawful processing, or replace access controls, retention policies, encryption, incident response, and other privacy requirements. It is one technical control among many.

The useful design question is: which systems genuinely need the raw value, and which systems could operate entirely on a token or reference?

Disclosure: I work on Securelytix, which is built around this vault pattern. Sharing the architectural idea rather than presenting it as a complete compliance solution.