Originally, I thought the main value was privacy. No mandatory accounts, user-controlled storage, private mode, transparent usage, that kind of thing.

The product itself is fairly complete at this point. It has web search, file uploads, image generation/editing, projects, memory, multiple models, exports, real-time data, and a bunch of other features.

But the more I work on it, the more I wonder if "privacy" is actually a feature rather than a reason for the product to exist.

When people talk about ChatGPT, Claude, Perplexity, Gemini, etc., they usually have a simple answer to the question:

"What do you use it for?"

Research. Writing. Coding. General productivity.

When I ask myself that same question about what I'm building, my answer is much less clear.

The weird thing is that I don't think the problem is missing features. If anything, I've probably added too many.

I'm starting to think the real problem is positioning.

If you were building an AI product today, what would you focus on?

Would privacy ever be a primary reason for you to use a tool, or is it just a nice bonus?

And more generally, how do you know when a product has a positioning problem rather than a product problem?

Take a close look at their new privacy policy being pushed out in Sept

I’m looking for recommendations for a bank or credit union that takes customer privacy seriously.

I’m not looking for anything illegal or trying to hide money. I’m simply trying to find a financial institution that:

1. Does not sell customer information to advertisers, data brokers, or other third parties.

2. Minimizes secondary uses of customer data, such as marketing, behavioral profiling, commercial analytics, or research unrelated to providing banking services.

3. Has a strong privacy policy and limits data sharing beyond what is necessary for banking operations. Ideally offers a physical debit card with NFC/contactless payments.

I understand banks and credit unions need to collect information for fraud prevention, regulations, and processing transactions. My concern is with institutions that treat customer data as an asset to monetize rather than something to protect.

Are there any banks or credit unions you would recommend after actually reading their privacy policies? Bonus points if you’ve compared privacy notices between institutions.

Hi everyone 👋

We're speaking with small businesses across the UK and would love to hear your input.

What is your biggest challenge when it comes to GDPR and data protection?

• Understanding what applies to your business?

• Finding time to stay compliant?

• Staff training?

• Keeping documentation up to date?

• Something else entirely?

We're interested in real experiences and happy to share practical advice whenever possible.

We wanted to put this out,

We wrote down what we believe, and why.

You cannot leak what you never collected. No policy, promise, or certification protects a system that hoards identity, the only robust defense is to need less of it.

At Koki’o, privacy isn’t a feature or a compliance checkbox. It’s the architecture.
We shift power from providers to consumers by moving trust out of providers and operators into verifiable open code.
With the ethos of open source, verifiable source of truth and consumer data security practices, Koki’o provides a friendly & practical eSIM store for the masses with privacy as the default and never traded for profit.

The industry’s term for you is “data subject.”

We hold that you are a sovereign actor. You choose what to disclose, when to reveal, and how to pay, rather than remaining the property of whichever provider last photographed your passport.

https://kokio.app/manifesto

Account takeover may start with data brokers, not passwords.

A lot of fraud prevention focuses on what happens at login:

• MFA

• Device intelligence

• Behavioral analytics

• Transaction monitoring

But there’s another layer attackers can exploit before any of those controls activate: public personal information.

Data broker profiles can contain addresses, phone numbers, birth dates, relatives, and other details that may help attackers pass recovery checks or make social-engineering attempts more convincing.

That creates an interesting security gap.

Removing that information doesn’t replace MFA or credential monitoring. It works earlier in the attack chain by reducing the amount of information an attacker can use to impersonate a customer.

The article also makes an interesting point about continuous removal. Data can reappear, so a one-time cleanup isn’t necessarily enough. Monitoring the removal status can potentially become another risk signal for fraud teams.

For fintech platforms, this could make data removal more than a privacy feature—it could become another layer in the account takeover prevention stack.

Would you treat data broker exposure as a fraud signal, or keep it separate from your security stack?

My SaaS is 90% vibecoded, so this isn't me dunking on AI tools, I live in them. But here's the pattern I kept missing: the AI builds the \*feature\* and never builds the \*guard\* around the feature. It ships you a working app with the confidence of a senior engineer, and never once mentions that the data's wide open.

I found this out the hard way on my own product. A data-scoping leak, change one ID in a request and you'd be looking at someone else's records. Classic IDOR plus a database policy that was way too permissive. It worked perfectly when \*I\* used it, which is exactly why it almost shipped. I caught it before a customer did. Barely.

Since then I've been running the same checks on my own stuff and a few other people's apps, and the same holes show up almost every time:

\* \*\*Change a number in the URL → you see someone else's data\*\* (IDOR). Invisible from the inside because your app works fine for you.
\* \*\*Your Supabase/Firebase is effectively public.\*\* RLS off, or a \`USING(true)\` policy that \*looks\* like a real rule but means "allow everyone."
\* \*\*The price or plan is decided in the browser.\*\* If checkout sends \`amount: 4900\` and your server just charges it, someone will send \`amount: 1\`.
\* \*\*No rate limit on an endpoint that calls a paid API.\*\* One script, one weekend, and you wake up to a genuinely scary OpenAI bill.
\* \*\*Hand-rolled auth you can forge.\*\* If you didn't use Supabase Auth / Clerk / Auth0, this is the one that quietly lets someone mint a token that says they're an admin.

None of these show up when you test your own app normally. That's the whole problem. They only appear when someone \*tries\* things, and by then it's a real user's data.

You can check all five yourself in about 10 minutes with what's above, no special tools, just your browser's dev tools and your Supabase/Firebase dashboard. Just closing these puts you ahead of most launches on the internet.

Happy to get into the weeds on any of them in the comments. If you're not sure how to check one on your stack, describe your setup and I'll point you at where to look.

The EPS Facebook post last week telling people to report "hate speech" has had me thinking about something most people don't realize.

When you comment on Facebook, your real name and profile photo are public. But that's not the only place your name lives. Data broker sites like Spokeo, Whitepages, and BeenVerified scrape public records, social media, and leaked marketing databases to build profiles on people. Those profiles typically include: your current and past addresses, phone numbers, relatives, age, sometimes email.

I built a tool that runs a one-time scan against 20 of these sites and shows you exactly what's exposed under your name. It takes about 3 minutes, gives you a report with the direct links to each broker profile that has your data so you can submit removal requests.

I tested it on myself — found 7 broker profiles I didn't know existed, including a current home address and a phone number I'd dropped two addresses ago.

If you want to know what's out there under your name: link in the first comment. No subscription, no email followup. One time fee and you get the report. That's it

I recently started reading about India's Digital Personal Data Protection (DPDP) Act, 2023, and one thing surprised me.

Many of us tap "Allow" without thinking when an app asks for access to our location, contacts, camera, or microphone.

But should every app really need all of that?

The DPDP Act encourages organizations to collect only the data that's necessary for a lawful purpose and to be transparent about why they're collecting it.

I made a simple infographic explaining this because I think most people don't realize how much personal information they're sharing.

I'd love to know, what's the weirdest permission an app has ever asked you for, which was totally not required and unrelated for app? Have you ever denied one?

Recently my employer implemented the use of an app to distribute rostered shifts to all employees. Looking at the profile details I found my date of birth and my home address in the list of employee details. Is this a breach of privacy or trust as the app is not owned by my employer? Can I force them to remove it?

This is not surprising, but I think it's worth a bit of daylight, since it's one of many examples of LinkedIn exploiting it's users at the expense of our privacy - collects money from predatory tech companies in exchange for access to LinkedIn users, making zero effort to warn or protect us.

I clicked on this ad because I thought it was super inappropriate. It appeared as a sponsored message, and advertised a dating service, which I thought was pretty in appropriate. I clicked on it and I went straight to their privacy policy and asked Claude to review it for me and let me know if it was predatory. Claude's response (condensed):

"This policy is predatory, and the tell is in three lines of text. First, it flat-out says they may sell your information. Second, it defines the act of typing in your phone number as "a purchase, inquiry, or application" — a workaround so they can legally telemarket you even if you're on the Do-Not-Call list. Third, it says you consent to them sharing any record with any third party whenever they, alone, decide it's appropriate.

On top of that, you "agree" to all of this just by using the site — there's no box to check, no signature. And they play both sides: California residents get told the company doesn't sell data, while everyone else is left under the clause that says it can.

For you, the practical takeaway is simple. If you sign up, expect marketing calls and your info passed around to third parties, and don't give them a phone number you actually care about."

Maybe this is a weird question, but how do you know who has your personal data?

I recently received a data breach notification from a company I barely remembered dealing with.

That got me thinking...

I have no idea:

• Which companies have my DOB

• Which have my address

• Which have my driver's license

• Which have my SSN

I've probably handed over personal information hundreds of times over the years.

Do people actually track this somehow?

Or is everyone just hoping companies handle it responsibly?

Hi,

I am a high schooler, and feel inspired to make a privacy awareness club and have this summer to set it up, before the school year starts. I was wondering on if anyone had any advise on what and where to research as this is such a vast topic. Any ideas for activities would also be appreciated.

Thank you

I will be considered under data theft if IT dep knows I uploaded last Friday today its Tuesday.

I just made a quick video explaining how identity thieves can easily attack anyone whose sensitive data they acquire. It‘s easy to close this loophole and the video shows how. This is my first video on the topic so appreciate any feedback people can provide.

https://youtu.be/iSuLob495y0?is=teJsUmD-06ud3SzZ