Part Two: The product · Trouble and change
More data makes more features possible. People find out later what was collected and what was done with it.
People hand a product things they would not hand a stranger: who they talk to, what they earn, which medicines they take, where they were on Tuesday night. They do it because the product needs some of it to work. A map needs to know where you are.
The difficulty is that collecting is nearly free and feels prudent. Somebody says "we might want that later," and nobody argues for throwing information away. Data teams want it for analysis. Marketing wants it for targeting. So the product keeps everything, in case.
The person never sees this happen. They find out when an advertisement knows something it should not, when a breach notice arrives, or when a news story explains what a setting they never opened was doing. Then they go back over everything they ever gave the product and wonder about each piece. In software an employer buys for its staff, the people in the data never chose the product at all, which raises the standard.
The safest data is the data you do not have. In 2016 the makers of the Signal messaging app received a subpoena for information about an account. They published their response. All they could provide was the date the account was created and the date it last connected, because that was all they kept.
Checking whether a change helped is a real need, and it fits inside this rule. Counts will nearly always do in place of named histories, kept for weeks and described in the same plain words.
You may not decide what the company collects. You do decide what your own screen asks for.
Therefore:
Collect only what the product needs to do what the person asked. Say plainly what you keep and why, when you ask. Use it for nothing else except counting, briefly, whether a change helped. Then delete it.
In practice. List every field you store about a person. Beside each, write the feature that needs it. Stop collecting the ones with nothing beside them, and delete what you already hold.
Goes with. This is easiest when the people in the data are the ones paying: WHO PAYS, WHO USES (14). On forms it begins with ASK ONLY WHAT YOU NEED (74). Whether a change helped is a question for CHECK AFTER YOU SHIP (28), answered with counts.
Source: Open Whisper Systems, "Grand jury subpoena for Signal user data, Eastern District of Virginia" (2016).