3 ms·

What's with all the analytics and UUIDs + obfuscated data transfer to analytics.andisearch.com?

jedwhite 5y ago
Thanks for the chance to chat a bit about this, as it's super important to us and our early user community. We're using PostHog on our own domain. We've spent a lot of time talking with our early user community about the right approach to privacy while still trying to understand enough about whether the app is useful to keep improving it. We've tried really hard to come up with a good approach that allows us to understand broadly how people use the app while protecting individual privacy. Early on we tried building a custom system using differential privacy and that failed badly, so we're trying PostHog during our alpha. But this is very much still something we're working out, and we're very open to feedback on it. So it's worth sharing some details and our thoughts on how we're approaching understanding app-use enough to keep improving the search product, while also protecting our community's privacy. With Posthog, we don't auto-capture events, and only a limited specific engagement indicators are recorded (list below). We don't log or store searches, personal information, IP address, users' geocoordinates (we capture to the nearest city so we can see what internationalization priorities matter). You can also disable the in-app engagement on the Settings page here (as well as disabling the question answering tech): https://andisearch.com/settings/ https://andisearch.com/settings/ We don't log or record searches in any way (either from the address bar or within the search session). We don't log what is typed, the links clicked on, or any personally identifying information. Users are anonymous and the client identifiers aren't connected in any way across browser profiles, devices, or anonymous use. We use the client id in aggregate to understand whether there is repeat use and roughly how many visitors we have, without knowing anything about any user individually, and then we're discarding it and just keeping aggregate data (still figuring out how to do that properly as we're only a team of two people and have no analytics background). So lots of work to do here. Things we try to understand about app use: 1. Broad search intent (eg it was a knowledge search, wiki search, programming search, question asked) but not what the search was, and not what the results were. But without logging any searches or what was opened. This tells us what broad areas we need to improve. 2. Engagement - that someone clicked a type of link (but not what the link was), or used a reader view (but not what was read), and whether anyone uses the different views (grid etc). This gives us signals to improve the app. The things we do to try to help protect privacy: We don't store any cookies. We block Google's FLoC (Federated Learning of Cohorts) tracking technology from this app. We don't log or store user IP address. It's used to lookup approximate location (nearest town) for location searches only, then discarded. It is never passed to third-parties. We only use GPS or detailed location for searches with express user permission, and then only to approximate the area. GPS location details are not stored or passed to any third-parties. Searches are anonymous and private to users. We don't log searches. We only use analytics within our service to improve it for our users, and only record broad aggregated engagement data. We are using PostHog on our own domain, with data restricted to specific engagement actions and no IP use. We block referrers on external links and use "nofollow noopener noreferrer" to protect you. We do not share or sell customer or personal data with any third parties whatsoever. We collect only the data needed to provide the service. We don't use any off-site or third-party industry user tracking. There is no ad tracking such as Facebook's or third-party analytics platforms like Google Analytics. No advertising display or advertising tracking. We use randomized proxies to retrieve content for preview and reader mode. We use https encryption everywhere including for external links wherever available. We proxy images and try to strip third-party cookies from any reader content as much as possible. We use anonymous rotating proxies with all identifiers stripped to connect to external APIs for searching. We display embedded videos and content for our users' convenience (so you can play a YouTube video in chat), but they are in a sandbox to help protect a bit, and restricted to only services that users have asked us to support (like YouTube or Spotify). We use the no-cookie domains but an embedded video might have cookies outside of our control. Keeping searches within encrypted POST packets also helps with privacy, because searches aren't being leaked to browser vendors through browser history. So we have a long way to go, and we're still figuring this out. Before we exit beta we've also committed to have our privacy audited. But as an early alpha this is still very much a work in progress. There are some more details on our privacy page also: https://andisearch.com/privacy/ https://andisearch.com/privacy/ We also shared an early prototype with some of the privacy focused communities on reddit and got some great feedback there as well, and we have an active Discord with a lot of discussion around privacy also if you'd like to chat more about this and are interested in what we're doing on this front. It's something we want to try to get right. https://discord.gg/qcCcrbMuex https://discord.gg/qcCcrbMuex I was hoping someone would ask this, and thank you for giving us the chance to share a little more about it :)

Thanks for the chance to chat a bit about this, as it's super important to us and our early user community. We're using PostHog on our own domain. We've spent a lot of time talking with our early user community about the right approach to privacy while still trying to understand enough about whether the app is useful to keep improving it. We've tried really hard to come up with a good approach that allows us to understand broadly how people use the app while protecting individual privacy. Early on we tried building a custom system using differential privacy and that failed badly, so we're trying PostHog during our alpha. But this is very much still something we're working out, and we're very open to feedback on it. So it's worth sharing some details and our thoughts on how we're approaching understanding app-use enough to keep improving the search product, while also protecting our community's privacy. With Posthog, we don't auto-capture events, and only a limited specific engagement indicators are recorded (list below). We don't log or store searches, personal information, IP address, users' geocoordinates (we capture to the nearest city so we can see what internationalization priorities matter). You can also disable the in-app engagement on the Settings page here (as well as disabling the question answering tech): https://andisearch.com/settings/ https://andisearch.com/settings/ We don't log or record searches in any way (either from the address bar or within the search session). We don't log what is typed, the links clicked on, or any personally identifying information. Users are anonymous and the client identifiers aren't connected in any way across browser profiles, devices, or anonymous use. We use the client id in aggregate to understand whether there is repeat use and roughly how many visitors we have, without knowing anything about any user individually, and then we're discarding it and just keeping aggregate data (still figuring out how to do that properly as we're only a team of two people and have no analytics background). So lots of work to do here. Things we try to understand about app use: 1. Broad search intent (eg it was a knowledge search, wiki search, programming search, question asked) but not what the search was, and not what the results were. But without logging any searches or what was opened. This tells us what broad areas we need to improve. 2. Engagement - that someone clicked a type of link (but not what the link was), or used a reader view (but not what was read), and whether anyone uses the different views (grid etc). This gives us signals to improve the app. The things we do to try to help protect privacy: We don't store any cookies. We block Google's FLoC (Federated Learning of Cohorts) tracking technology from this app. We don't log or store user IP address. It's used to lookup approximate location (nearest town) for location searches only, then discarded. It is never passed to third-parties. We only use GPS or detailed location for searches with express user permission, and then only to approximate the area. GPS location details are not stored or passed to any third-parties. Searches are anonymous and private to users. We don't log searches. We only use analytics within our service to improve it for our users, and only record broad aggregated engagement data. We are using PostHog on our own domain, with data restricted to specific engagement actions and no IP use. We block referrers on external links and use "nofollow noopener noreferrer" to protect you. We do not share or sell customer or personal data with any third parties whatsoever. We collect only the data needed to provide the service. We don't use any off-site or third-party industry user tracking. There is no ad tracking such as Facebook's or third-party analytics platforms like Google Analytics. No advertising display or advertising tracking. We use randomized proxies to retrieve content for preview and reader mode. We use https encryption everywhere including for external links wherever available. We proxy images and try to strip third-party cookies from any reader content as much as possible. We use anonymous rotating proxies with all identifiers stripped to connect to external APIs for searching. We display embedded videos and content for our users' convenience (so you can play a YouTube video in chat), but they are in a sandbox to help protect a bit, and restricted to only services that users have asked us to support (like YouTube or Spotify). We use the no-cookie domains but an embedded video might have cookies outside of our control. Keeping searches within encrypted POST packets also helps with privacy, because searches aren't being leaked to browser vendors through browser history. So we have a long way to go, and we're still figuring this out. Before we exit beta we've also committed to have our privacy audited. But as an early alpha this is still very much a work in progress. There are some more details on our privacy page also: https://andisearch.com/privacy/ https://andisearch.com/privacy/ We also shared an early prototype with some of the privacy focused communities on reddit and got some great feedback there as well, and we have an active Discord with a lot of discussion around privacy also if you'd like to chat more about this and are interested in what we're doing on this front. It's something we want to try to get right. https://discord.gg/qcCcrbMuex https://discord.gg/qcCcrbMuex I was hoping someone would ask this, and thank you for giving us the chance to share a little more about it :)