https://www.youtube.com/watch?v=lxCR8-YsuHU  (32:57–40:56; transcribed by the authors by ear, 9 Oct 2026; H = host)

32:57
H: And earlier you mentioned Have I Been Pwned? It's a great database. You can see if you're caught in data breaches. So you guys integrate with that. And that's the only server connection? Is there any telemetry or anything else in the app that people should be aware of?

Alex Logan: So the app has two external providers. So we use revenuecat to process purchases, which is in substantial amount of the apps in the app store, if not most at this point, I'd imagine. And then the paywalls we have in the app are powered by Superwall. Both of those are effectively in the most limited state they possibly can be. So to give you a bit more information on that, we don't have any identifiers that we track. So if you wrote me an email and you said, why is my subscription not working? I couldn't go into anywhere and find you. I have no way to know who you are. All I know on tools like revenuecat is I know what our revenue is, and it updates effectively in real time. And it lets me do things like I can change offers remotely. So when we run our sales, I can just set that going remotely and we can tweak the prices here and there. And then with Superwall, Superwall lets us do paywalls without having to change the app all the time. And that doesn't mean we're adding new paywalls, but what it does is it lets us change how our paywall looks and feels to try and get more people to use Strongbox. It's a huge lever that we have, which means we don't have to invade someone's privacy and start tracking what they're doing in the app to work out how can we get them to pay. We can just test, if I show you something different on the paywall, are you more likely to pay for it or not? A really good example would be, what if I had a paywall where all it talked about was autofill? And that's what you saw when you got through onboarding in the app is I was just like, hey, autofill's incredible, but you need pro to use it. I can just test that and see if that works better or worse. And the only information I get is how many people paid and how many didn't. I don't get telemetry on who did it, who they are, anything like that. I just know that someone paid or someone didn't.

H: So someone who hears this, I mean, how do you distinguish the safety of someone's passwords to what you just described here, if someone's concerned about that?

Alex Logan: Yeah, the general rule that we followed throughout all of this is that we haven't added analytics. I know there's been some debate around whether or not they think Revenue Cat serves as analytics. And I understand that there's a discussion there, but Revenue Cat also weighed in to help out there and let people know that the data in Revenue Cat is the same data that the app store gives us. So nothing has changed. The kind of second line of defense is I have a very firm policy that nothing like this is allowed to be after the database is opened. So Strongbox's paywalls and syncing purchases and so on happens when you open the app. It's not when you open a database, it's when you open the app. I'm sure we can get background updates that say, hey, the subscription's expired, but we're not sending anything to anyone. We just might realize that your subscription's expired and tell you, you know, you can't use Touch ID to unlock your database anymore. That was kind of a long answer, but the short answer is nothing goes to anyone and we don't really have a plan to change that. It would be really useful if I had analytics about how people use the app just to drive forward where to put our time, the usual answer to analytics is scary data collection and so on, which I completely understand, but it would also be not for that purpose, but we've stayed true and we will do. I will just ask people with a survey every now and again how they use Strongbox.

H: Yeah, just to clarify, if Touch ID isn't allowed, you can still get in with a password.

Alex Logan: Yeah, yeah, so.

H: It's not just keeping you away from your passwords.

Alex Logan: Yeah, that would be a terrible strategy for user attention to take their database away if they don't pay us, but yeah, all of our.

H: That's very last pass though.

Alex Logan: I've definitely seen places say you haven't paid, you can't get in and thanks to them not using KeePass, that database is just gone, but with us, all we do is we take away convenience features. We don't actually stop you getting into a database or anything. You will just lose auto fill and you'd lose Touch ID, Face ID, so you can still do everything just about. It's just not quite as cool.

H: Right, and then I'll touch a little bit more on the business model in a second as we zoom out, but the last question, I feel like telemetry analytics, very charged, very controversial subject because the way I see it is that it is so prolific and so bad in all these services. People have this association with analytics and telemetry coming from these really invasive and bad big tech companies that it's just easier to say I don't want any of this, and I think that is not a wrong answer, but having spoken to so many privacy-first projects, even on this podcast, one of the most common themes is we don't know what our users actually use our service for because they don't have any insight, and so they all say we wish there was a way, but if we did this, then there would be too much pushback, and so it's a really hard line to walk around. So I understand the difficulties there. I'm sure it impacts you guys as well.

Alex Logan: Yeah, I think it's an interesting subject because I think people are very right to be scared of invasive telemetry. I think it's something that you should always be careful with. I use tools like Little Snitch on my computer to check where's data going. I've downloaded this cool app off the internet. What's it doing? Especially if I've had to have to given it a sensitive permission or something. So I entirely agree. But then the flip side of it is I think something that's happened over time is analytics are absolutely everything everywhere now. You'll be tracked in like basically everything. Even a lot of privacy first projects still have analytics somewhere. They just try and say it's not in there. And I generally think the analytics from bad actors are looped in with analytics from people who like us, would just really benefit from knowing how do people use this thing. We obviously get the cynical answer of well they use it to store passwords. But the nuance is if we knew a little bit more about, for example, how many passwords do people have in here? Do people use Strongbox as their only password manager? Which we could kind of insinuate by. Do they have a huge list of vaults and passwords? Do people share things with each other a lot? Do businesses use this a lot? All of these things can help drive our direction on the product. Like do we find that people download the app and then start onboarding and then get to the sync screen that tells them all the different options and just close the app? That's probably happening, but we have no idea. So we kind of just have to trust what people tell us and ask people and try our best to get information that way. Whereas in other apps, I can tell the users are dropping off at a certain point, we need to make that better. And that's a really useful thing to be able to do. And I sort of, as a thing I think about quite often is is there any way that privacy apps could do some kind of opt-in super light information dump somehow? I've never come up with an answer for it. So I've never, never come back to it, but I'm sure, yeah, you've had a similar discussion many times where people just say, we could have a much bigger business and much happier users if we have that information, but we can't have it for a very good reason. So for now we don't have it, but I can kind of get a good feel for things from public communities, the emails that come in and so on.

40:56