6.15 Data and Privacy
The full answer to the question the whole audience arrives with.
Specified with the template fixed on the etalon, node 1.1 Welcome. Source: docs/nodes/6-15-data-privacy.md. Composition from the block bank, type G. Supersedes this node's section of account.md.
Purpose and jobs
Personas has Ravi refusing every app that will not say plainly what it does with the data, and the landing already promises an answer; this is where the answer actually is. J5 is primary, with E3. It is also the screen that makes leaving easy, which is what makes staying a choice.
/privacy. Breadcrumb: back to Settings.Content blocks
| # | Block | Carries | From the bank |
|---|---|---|---|
| 1 | Back, and the title (GC1) | GC1 | TAKE |
| 2 | The plain answer, name-the-fear: the fear stated first, then denied with specifics: we read your recurring charges, read-only; we cannot move your money; we do not sell your data | J5, E3, master-research M2 | TAKE, DIFFERENTLY (Canva): a statement before any control. Vague "bank-level security" language is exactly what scares this person; specifics earn trust |
| 3 | What each source can reach, one sentence each: the bank connection, and what you typed yourself | D2, principle 4 | TAKE |
| 4 | The controls that actually control something: refresh automatically, and use my activity to improve Tendd, off by default. Above them, one stated line about what is counted either way | J5, O20, principle 4 | TAKE, DIFFERENTLY: two real toggles, no theatre, and a statement where the category would have put silence |
| 5 | Export my data, free | J5, D-Export | TAKE: decided on 2026-08-04. A plain, complete export of what we hold about you is a right, not a feature, so it is free and it lives here. The analytical export of history and trends is Pro and lives with node 5.12 |
| 6 | Delete everything, into dialog 6.15.1 | J5, E3, legal duty | TAKE: one clearly labelled action, two taps from the You tab |
| 7 | Links to the policy and to node 6.14 | E3 | TAKE |
On block 4, and the two classes of telemetry, decided 2026-08-10. This block said "use my activity to improve Tendd, off by default" and nothing else, which reads as though switching it off switches off all measurement. It does not, and pretending otherwise on the one screen built to be believed would be the worst possible place to be imprecise.
Counted either way, and stated rather than toggled: anonymous counts of what happened, such as whether a reveal was completed and how many subscriptions it showed. No profile, and never tied to a bank, an amount or a merchant. This is how we know whether the product does the one thing it claims to do; cjm-to-be.md measures H0 as the share of people who see three or more subscriptions in their first session, and a product that cannot tell whether it helped anybody cannot get better and has no honest reason to keep asking for a bank connection.
Behind the toggle, off by default, exactly where it already was: anything person-level. Behaviour tied to an individual, session replay, any picture of a particular human being. The line above the toggles says the first in one plain sentence. The failure this avoids is not "we measured", it is "we measured while the screen implied we did not". Whether the counting itself needs a consent banner is part of the EU review that D5 defers, and node 9.4 already carries that ?.
Named and not added: toggles for advertising, personalisation and profile enrichment. We do none of these, and offering a switch implies we could. It is the same rule that dropped the read-against-write toggle at node 1.3: a control with only one legal position is theatre, and theatre is the opposite of what this screen is for. And no toggle for the counting above, for the mirror of that reason: a switch on something we would keep doing is worse theatre still.
States, filters, the one action
| Node | State | Reads like | Trigger |
|---|---|---|---|
| - | default | The seven blocks | Opened |
| 6.15.1 | Delete everything (dialog) | The consequence in plain text, then two doors: delete everything, or keep my data | "Delete all my data" tapped |
| - | Exporting | "Preparing your file", then the download | Export tapped |
| - | Deleted | Signed out, with a plain confirmation that it is done | Deletion completed |
On 6.15.1: two doors, and no alarm colouring. The bank takes Fingerprint's shape (a warning callout, "keep account" against "continue") and drops its palette under D-Concept: clay is for a genuine error, never for decoration. The consequence carries the weight, not the colour. The destructive button says what it does, not "OK", and Escape maps to the safe door. The dialog was numbered on 2026-08-04; account.md specified it without a node number. Filters and facets: none.
No primary action, and that is the point. This screen is read, not used. Its two actions, export and delete, are both a person taking their data back, and neither is a thing the product wants them to do more of.
Responsive. Mobile: one column, the plain answer above the fold and the controls below it. Desktop: the same order at a wider measure. The dialog is a centred modal on desktop and a full-width sheet on mobile, which is presentation and not a structural change.
Emotional support
| Job | Mechanism | Where exactly on this page |
|---|---|---|
| E3 feel safe, control data | Read-only stated in the same breath as the bank, the source of every figure shown, and disconnect and delete reachable in one tap rather than buried | Block 2 for the promise in the person's own words, block 3 for the source, blocks 5 and 6 for the exits |
This node is E3's fullest home. Everywhere else in the product E3 appears as one line; here it is the screen.
SEO, locked, open
SEO. noindex, no schema. Private, behind auth. The public policy page, if one is published, is a different surface and belongs to node 8.
Locked: the statement before the controls, no theatre toggles, the free plain export (D-Export), one-tap deletion with a single confirm that deletes everything, two doors with no alarm colouring. Open: none. The export question that was open here was answered on 2026-08-04 (D-Export), and CLAUDE.md was corrected with it.
Done at the wireframe rebuild, 2026-08-05: node 6.15.1 has a page for the first time. It lived inside the page as a block and could not be walked as the interruption it is.
Grey screen: wireframes/data-privacy.html. No coloured screen yet: only Home and Subscription Detail were taken into colour at Concept, and the rest arrive at UI + Visual (design/overview.html).