We do not know how many people use it

Every app store listing this year says privacy first. On device. Your data never leaves your phone. The phrase has been worn smooth, and it now conveys roughly what all natural conveys on a cereal box.

So rather than make the claim, here is the invoice.

We ship a sound meter. It has no analytics, no crash reporting, no attribution, no advertising code, and no third party libraries compiled into it, which means there is nothing in the binary that could report to anyone even by accident. The privacy page says what we collect, and the answer is nothing.

The consequence, written on the same page: we do not know how many people use it, which features they use, or when.

That sentence is the actual product decision. Everything else is a marketing claim that costs nothing to make.

Here is what it removes. We cannot tell you a retention curve. We cannot see that a screen is confusing because everyone leaves from it. We cannot run an experiment. When someone writes to say a reading looked wrong, we cannot pull their session, so the reply is a series of questions and the answer takes three exchanges instead of none. We cannot tell whether the feature we spent six weeks on is used by thousands of people or by four. We will not know if we build the wrong thing for a year.

Product teams give up crash reporting last, and for good reason. It is the one piece of telemetry that is defensible on the user's own terms: it exists to fix the thing that broke for them. We do not have it. When this app crashes, we find out because a person is annoyed enough to send an email, and most people are not.

We think the trade is right for this particular product, and the reasoning is specific rather than principled. A sound meter asks for the microphone. That is the most sensitive permission on the device, and it is the one permission we cannot do our job without. An app that holds the microphone open and also talks to a server is asking for a kind of trust it has no way to earn back if it is ever wrong. Removing the network entirely is not a virtue, it is the only way to make the microphone request answerable. There is nothing to send because there is nowhere to send it.

That reasoning does not transfer. Our admissions tool cannot work without a server, and it would be dishonest to pretend otherwise or to imply that the same promise applies across everything we make. A studio that claims one privacy posture for seven different products is describing a brand rather than a system. This is also why the mobile privacy policy lives at its own address rather than the root of this site: a policy that opens with "we collect nothing" is true of the meter and false of things beside it, and a policy in the wrong place is a lie by position.

The part that surprised us is how much the constraint improved the product. With no way to observe usage, the only path to knowing whether a reading is trustworthy was to make the app state its own uncertainty on screen: the margin of error beside the number, a warning when the microphone is clipping, a refusal to invent a figure when the room is quieter than the hardware can measure. We built that because we could not measure our way to confidence and had to hand the user the means to check us instead.

A team with full telemetry would have found the confusing screen faster. We had to design one that did not need finding.

We are not recommending this to anyone. It is expensive, it is slower, and it will cause us to miss something we would rather have caught. It is a defensible trade for one category of tool and an indefensible one for others. What we would recommend is stating the cost. If a privacy claim in a listing does not come with a sentence describing what the team gave up to make it, the claim is decorative, and the honest way to read it is as nothing at all.