Most teams treat privacy the way an undergraduate treats the boundary condition on a problem set, a nuisance you scribble on the right margin so the proctor will give you half a mark. The work happens elsewhere, in the body of the answer, and the constraint quietly shapes everything without anyone wanting to look at it. Then a person walks into the lab, flips the apparatus around, and the boundary condition becomes the experiment itself.
I will give you the example I keep on my own bench. I run a small side project that does computer vision on the device itself, for home cameras. The pitch fits in one sentence. Footage never leaves the device, which means there is no cloud round trip on its way to a bucket in Frankfurt with a misconfigured ACL that some bored security researcher will eventually find on a slow Saturday morning. The customer pays me, every month, for an absence. The absence of a recording kept on a server, of a transmit step, of any stored frame that I could be subpoenaed for, sold for, or asked about by a regulator in Agargaon who has now started asking. The thing that is conserved across every interaction with my product is the property the customer was scared of losing in the first place. That is genuinely difficult to put on a marketing page, and it is also the only durable moat the category has.
When privacy lives on the right margin, every product decision becomes a small trade between a privacy cost and a feature gain, and on a spreadsheet the gain almost always wins. You add the analytics SDK because the growth team needs funnels for next quarter's review. You add the email pixel because the marketing tool's reporting is dead without it. Each of these looks rational on its own afternoon, and each of them slips through the same review meeting. When privacy is the actual experiment, those decisions arrive with a different weight on them. Adding the SDK is the thing you have been selling against. Adding the pixel is the thing you have been selling against. The growth loop your peers reach for is the very loop the customer is paying you to refuse. That sounds principled until you are three months in and a board member asks why your funnel dashboards are blank. The hard part of the discipline is refusing the asks that sound harmless, the ones that would not even feel like cheating. They tend to arrive disguised as a single innocent ping for crash reports, or a read receipt added quietly for service quality, or a cookie waved through as just for fraud.
Privacy as constraint
Privacy as product
In normal security framing the pyramid is drawn the other way around. At the bottom, where the area is largest, you have data exposed. Above that, audited. Above that, encrypted. At the top, the small triangle of dreams, data not collected. Most teams never reach the top. A company built around privacy as the product reads the same diagram inverted, with the widest, foundational row being what you do not collect. Encryption is table stakes. Audits are required. Exposure is what most products optimise for, dressed up as growth.
The privacy trust pyramid.
↓ read inverted from a normal pyramid · widest = most retained
A team building a company around privacy as the product lives at the top of that diagram and reads every drift downward as a failure of nerve. The constraint team lives at the bottom and reads every step upward as a small win for the security folks. The diagram on the chalkboard is identical in both labs. The only difference is which way you have decided to read it, and which direction your culture quietly punishes when nobody is looking.
Walk past the grocery on the corner of Town Hall in Mohammadpur and there is a CCTV pointed at the cabbage stall. Walk into a Banani apartment with five flats and a darwan who works part time and there is a doorbell camera at the gate. The state has installed thousands more on traffic poles and police boxes, and almost none of it is encrypted in any way an undergraduate would recognise as encryption. Most of it sits on a DVR in a back room with a default password that the installer wrote on a sticker and forgot to remove.
The privacy assumption in this country is not that footage is safe, it is that the footage will leak. The Daily Star has reported on this repeatedly, including a 2023 story on government sites leaking citizens' data, the sort of finding that trends on Facebook for a day and then becomes furniture. The ratio of signal to noise in public outrage is so low here that the leak is the steady state.
A higher bar than the one Bruce Schneier writes about in Data and Goliath, and the one I have to clear with my own khalamma in Dhanmondi when she asks why she should plug my thing in instead of the cheaper one her neighbour bought. She does not want a marketing answer. She wants to see the architecture, in plain Bangla, on the back of the box, ideally with an arrow showing exactly where the footage stops moving. If you cannot draw it for her in two minutes, the product is wrong.
Here is where most founders trip on the floor of their own first lecture. You can charge a premium for an absence rather than a presence. You just have to be willing to put the number on the page and watch the first two months of calls from customer success go badly while the right kind of customer slowly sorts themselves in. The mental model that holds up under scrutiny is that the customer is not comparing you to the free thing with ads on the side. They are comparing you to the cost of finding their family's footage on the front page of Prothom Alo on a Sunday morning, which is a number nobody in this room has ever computed, until the day they have to.
Build the company that way and the roadmap mostly writes itself. Every proposed feature has to clear one filter, which is whether shipping it would require you to know something about the customer that you did not know before. The answer that keeps the moat intact is the answer that keeps you small for longer than your investors would like. Most products will never get built this way, and that is a fine thing for a market to be made of. The few that do exist on this principle are the ones their customers stop being able to live without sometime in the second year.
Walk past the CCTV on the Town Hall corner tonight and ask yourself which side of that pyramid the camera is sitting on. The answer determines whether the footage of you walking past it ends up on a DVR in a back room in Mohammadpur with the installer's password still on the sticker, or in a bucket in Frankfurt that some bored researcher has not found yet.