The long term ramifications scare me. Even if you use rolling ID's as suggested, someone with enough data points could infer identity from the patterns. This

The long term ramifications scare me. Even if you use rolling ID's as suggested, someone with enough data points could infer identity from the patterns. This might be more palatable if it were approached in an "old school" fashion. Start by clarifying your customer is not any public health authority; it's individual users. I could walk around with a notebook and keep track of everyone I interact with - even if some strangers aren't recorded by name (e.g. Cashier working aisle 6 at 3pm on Thursday). Design the app to mimic that task and make it easier for me. I keep sovereignty over my records. If some agency wants them, they have to request them through me. Bake in meaningful, plausible deniability so I can simply say "sorry, I don't have any" if I don't like the name of the agency. Better yet, use encryption such that both parties need to consent before any particular contact link can be inferred. Make it so secure that you could broadcast the scrambled bits on a blockchain which any user can view through the lens of their private keys to check if they might have had contact. In a sense, this problem shares some characteristics with zero-knowledge proofs or anonymized financial transactions (all I need to know is I might have been exposed; not any details of how Covid found its way to me). Consider lessons learned hardening against crypto tracing efforts. If people feel it's safe, effective and anonymous, enough may even opt-in organically of their own accord.