The privacy promise that needed an asterisk

Build in public — Taigency daily series. 6 August 2026.

Some promises are easy to keep until the business needs you not to.

The exception, done honestly

ColourIQ's entire privacy pitch, since day one, was absolute: a stylist photographs a mall guest on an iPad, the frame is sampled in-memory in the browser, and nothing — not the photo, not a pixel of it — is ever uploaded or stored. That claim was the whole point of building it client-side instead of reaching for a backend. It's in the README, it's in the app copy, it's the thing that lets a brand run a face-adjacent activation without legal shutting it down.

Then the client asked for the obvious next thing: let a guest get their result on their own phone, and let the brand know the activation actually reached someone. Both of those want a phone number. A number is personal data. The old promise had no room for it.

The honest move wasn't to quietly start storing numbers and hope nobody re-read the privacy notes. It was to make the exception as narrow and visible as the promise it's replacing. So: the result card gained a "WhatsApp this to my phone" button that sends over the Meta Cloud API. By default, the number used for that single send is never kept — same as before. Only if the guest explicitly ticks a new opt-in checkbox does the app hold onto it, and declining still sends the message and throws the number away either way. Production adds a 90-day deletion clock on anything kept. And the "never stored" copy got updated everywhere it appeared in the app, not left to rot next to a feature that made it false.

The same week, /dashboard grew up too — from a stylist's session counter into an actual admin campaign overview: filters by period, colour and source, stat tiles, trend-colour and time-of-day charts, a filtered session table, CSV export. That's the brand-facing proof the activation is working, and it's exactly the kind of feature that tempts you to just quietly widen what you log. The discipline was keeping those two things — richer reporting, and the personal-data promise — from bleeding into each other.

Elsewhere this week: paying for real

Two other products spent the week on the less glamorous work of being ready to take real money from real people.

hansrooseboom.art replaced Payfast with Paystack for its ZAR checkout — a cleaner hosted-checkout flow with HMAC-verified webhooks instead of Payfast's form-POST scheme — and then went further: checkout across five currencies end to end. A visitor picks ZAR, USD, GBP, EUR or AUD, every price on the site shows in it, and the order settles in that same currency — ZAR through Paystack, the rest through Stripe. If a work isn't priced in the currency shown, checkout simply refuses rather than guessing a conversion; that's the safe failure. Reservation holds got sturdier alongside it — a hold releases and can be self-reclaimed by a returning buyer instead of quietly locking the only copy of an original.

FieldForce SA shipped the paperwork side of launch readiness: POPIA-aware Terms and Privacy pages, and a required consent checkbox at signup — the actual consent capture, not just a link in the footer — that gates both email and Google signup and stores a timestamp as proof. The Google-signup shortcut that used to skip consent entirely is gone.

The pattern

None of these three are the feature you'd screenshot for a demo. A privacy exception, a payment-provider swap, a consent checkbox — they're the unglamorous work of turning "looks ready" into "is ready for someone else's money or someone else's data." The interesting discipline isn't building any one of them; it's building each one narrow enough that it doesn't quietly widen into something you'd have to walk back later.