Section 10: The Feature That Knows Where You Sleep - Privacy, Safety & Abuse

Executive Summary: Three of Section 9's six challenges were answered with privacy mechanisms rather than performance mechanisms, so this section makes them the subject. In a location product privacy is the architecture, not a compliance layer bolted to the side — and Section 3's arithmetic already made the biggest privacy decision for free when it declined to keep history. We walk the mechanisms (two gates, per-group granularity, coarsening, the prefilter doing double duty, the off switch that purges, the quiet leak through logs), name the abuse and safety vectors honestly, take apart ghost mode's reciprocity problem, and close on the legal surface.

The interviewer has stopped attacking throughput. They ask the question that separates engineers who have shipped a location feature from engineers who have only designed one: "Suppose this works perfectly. Who gets hurt?"

Stripped of its product framing, a nearby-friends service is a continuous stream of where a hundred million people's bodies are. It knows where you sleep, who you sleep near, which clinic you visited — not by design, but because that is the inescapable residue of the feature working. Treating this as a settings screen ("we'll add a toggle") misses the shape of the problem as badly as the Index Reflex missed it in Section 7. The toggle is the user interface of privacy. The architecture is privacy.

Key Insight: Every privacy mechanism worth having is a property of where data flows, not a check performed on data at rest. A flag consulted at read time is defeated by the cached copies, in-flight messages and log lines that outlive the flag flip — which is why this design refuses to treat sharing as a boolean.

Section 3 Already Made the Biggest Decision

The most consequential privacy choice here was not made in a privacy review. It was made with a multiplication. Persisting the update stream — a third of a million updates a second at roughly a hundred bytes each — costs about 2.9 terabytes a day of the most sensitive data the company is capable of holding, and we declined it because the product never asks the question history would answer: "where is my friend now" is served entirely by a cache entry with a ten-minute TTL.

Notice what that bought. No historical store to breach, no decade of traces to subpoena, no retention schedule to argue about, no deletion pipeline, no insider-access surface over past locations. The rejected alternative — keep the stream, we might want analytics later — creates all five, permanently, for a feature nobody asked for. The flip trigger is narrow: an opt-in location timeline earns its own encrypted store with its own retention policy, which Section 12 prices. It never gets this cache.

Say this out loud in the room: the cheapest privacy control any system has is the data it never collects, and you usually find it during capacity estimation, not compliance.

Quick check before moving on: