The apps count how they are used

Why

Nobody could tell whether registration worked

Registration refused everybody, in every app, for as long as the form existed, and the note about it is candid about why nobody noticed: signing in worked, so the form looked fine to everybody who tested it, and all of them already had an account.

Underneath that is a plainer problem. Nothing counted how many people started making an account and how many finished. A form that turned everybody away and a form nobody had opened produced the same evidence, which is none.

What it carries

A random number made on your device

The number is generated on the device and stands for nothing outside itself. It is not derived from your account or your email address, and it is not an identifier the phone hands out to whatever asks. There is nothing in it to turn back into a person, which is a statement about what a count contains rather than a promise about what anybody would do with it.

The requests are not authenticated. A count arrives with no login attached and the server cannot answer the question of who sent it. Sending counts with a token would name you whether or not anybody meant it to, and would go on naming you every time somebody wrote a new query against the pile.

What it records

That something happened, never what

An app opened. A registration finished. The name of the event is the whole of it. Nothing anybody typed, nothing anybody said, no message, no photograph, no address and no part of a name goes into a count.

What that buys is one question answered — whether people get through signing up — and one question permanently unanswerable, which is what any particular person did. The second is not a limitation to be lifted later. It is the reason the first one is safe to ask.

The other half

The same list turns a feature off

The list of names the counts are written against is also the list the feature switches run on, so a feature can be turned off without shipping a new build to three app stores. One list rather than two, because a name that exists on one side and is missing from the other is a switch that does nothing, discovered by the person relying on it.

On the transparency page

A ninth row, not a footnote

The transparency page is a row-by-row inventory of everything Ridgeback holds: where each kind sits, who can see it, whether the AI reads it, how long it is kept. A kind of data missing from that table makes the table untrue, so the counts are in it as of tonight, and the eight kinds it described are nine.

The AI does not read them. How long they are kept is not decided, and the row says that rather than guessing a number that sounds reasonable.