CHAPTERS
01 — THE ACCOUNT
Not a settings page. A record of everyone you give to, and everything you gave.
Most accounts store a password and an address. DADO’s holds a member’s gifting life: what they gave, who they give to, the dates that matter and what they would love. Here it is, tab by tab.
My Gifting
Occasions & Events
Connections
Gift history
Wishlists
Saved
Account details
Preferences
01
My Gifting
Every wish a member runs, every gift they chipped in on, and the drafts they haven’t sent, in one list.
02
Occasions & Events
An occasion is a date worth remembering. An event is a time and a place, with members and non-members invited.
03
Connections
Add people, mark the close ones, and keep a private note only you can see. Someone not on DADO yet links up when they join.
04
Gift history
A memory album of gifts given and received, on DADO or anywhere else, with thank-you cards sent from any gift.
05
Wishlists
Wishlists from DADO and from other platforms, kept together in one place.
06
Saved
Pieces saved while browsing DADO, kept apart from what a member wishes for.
07
Account details
Important dates, preferences and sizes, family information and the profile, each field with its own audience.
MY PART ON ACCOUNTS
Wishlist privacy set per item, not per list: four audience levels, enforced on the screen, in the database and on every shared link
Connections as consent: a request the other person accepts, and nobody joins an occasion without saying yes
The Wishlists and Connections screens, so there is a reason to come back after the first gift
02 — THE SHORT VERSION
A lifetime record that keeps its privacy promises.
PROBLEM
Most gifting apps forget you after checkout. When the team started, six of the account’s controls did not do what they said.
WHAT WE DECIDED
Build the account as a personal gifting record, a tab for each part of a life of giving, and make every privacy choice hold on the server.
RESULT
Shipped in the private beta: gifting, occasions, connections and gift history in one place, visibility set per person, and five data leaks closed.
03 — PREFERENCES
Every part of the profile has an audience.
Contact info can be seen by only me, close connections or connections. Important occasions and preference fields carry their own audience, set on each item.
01
Only me
Nobody else sees it.
02
Close connections
Only the people you mark as close.
03
Connections
Everyone you are connected to.
04
The owner sets it
Occasions and preferences choose per item.
PROFILE VISIBILITY · CONTACT INFO
Your phone number, email address and date of birth, shown to the connections you choose.
Only me
Close connections
Connections
A CONNECTION SEES
Phone number
Hidden
Email address
Hidden
Date of birth
Hidden
A CLOSE CONNECTION SEES
Phone number
Shown
Email address
Shown
Date of birth
Shown
Checked where the data is read, so a direct request to the server gets the same answer as the screen.
04 — MAKING THE PROMISES REAL
A record this personal only works if the privacy holds.
Most account screens had been designed, and few had been checked against the data behind them. A setting hid a name on the page while the server still sent it. Family tabs read fields nothing wrote to. Two-factor lived only in the browser.
SIX CONTROLS · BEFORE AND AFTER
Hide amounts raised
A toggle in the wizard, never saved anywhere
Saved with the wish and respected by the public page
Hide contributor names
Saved, then ignored when the page loaded its contributors
Enforced where the page gets its data
Family info tab
Read from a place no screen saved to, so blank for everyone
Reads what members enter in the Family form
Birthday on a connection
Added by members, never seen by their connections
Shown behind the same setting as anniversaries
Who did this?
Notifications stored only the recipient
Every notification records who caused it, with a safe name and photo
Two-factor
Checked only in the browser, so a stolen login could skip it
Checked on the server, and required to pay or delete the account
Six controls: what the data did at the start, and what it does now.
05 — DECISIONS
Four calls that made the account keep its word.
D01
Every privacy setting is checked on the server
WHY
Hide contributor names was saved and then ignored. Hide amounts raised was never saved at all. A setting that only hides something on screen still hands the data to anyone who asks the server.
WHAT IT COST
Two database changes and a rewritten public lookup. None of it shows in a Figma file. It shows when someone asks the server directly.
D02
The connection profile reads what members save
WHY
Family and Occasions were blank for every connection, because the profile read fields nothing ever wrote to. Preferences showed six of ten fields.
WHAT IT COST
Eleven database changes in the first pass. One shared list of family relations now drives the grid, the family screen and who can see what.
BEFORE · WHAT THE PROFILE READ
Family
An old spouse field
Occasions
An old anniversary field
Preferences
6 of 10 fields
AFTER · WHAT IT READS NOW
Family
The family members entered
Occasions
The occasions entered
Preferences
10 of 10 fields, within the owner’s settings
D03
Every notification says who caused it
WHY
Notifications saved only who received them, so the bell showed an icon and nothing else. Now each one records who caused it, read through a small lookup that returns four safe fields. A thank-you became a card with a page of its own.
WHAT IT COST
The first version exposed whole profiles to anyone named in a notification. It was reversed the same day, so one change became two.
NOTIFICATIONS · TWO KINDS
From DADO
No person behind it. It leads with its type icon.
Your concierge request is underway
Caused by a person
The server records who did it and shows only four safe details, including a name and photo.
A friend sent you a thank-you card
D04
Five leaks closed, and two-factor moved to the server
WHY
A QA pass turned into a security pass. The leaks ranged from phone numbers and shipping addresses to anyone being able to write payment records. Each one was confirmed on the live database before the fix, and each fix checked the same way.
WHAT IT COST
None of the 38 users had two-factor on, so the change was confirmed live to lock nobody out. Sessions older than the window now see an error, logged as a follow-up.
FIVE LEAKS · ALL CLOSED
Connection profile
Any signed-in user, by adding themselves as a contact
Closed
Personal details
Full name, phone and birthdate on a public wish
Closed
Invite lookup
The whole wish record, shipping address included
Closed
Explore page
Recipient addresses to anonymous visitors
Closed
Transactions
Any user could write payment records
Closed
Engineers on the team confirmed every fix. There has been no outside audit.
06 — ALSO DECIDED
Smaller calls that shaped the account.
ALSO DECIDED
Birthdays, one setting
A member’s birthday shows on both connection views, behind the one important-dates setting they control.
Thank-you cards
Saved, notify the giver, and open from a private link, so someone without an account can see one.
Two-factor to pay
Paying, adding a card and deleting the account all need two-factor confirmed on the server.
One-step defaults
Setting a default card or address cannot half-fail. Deleting a card also removes it at Stripe.
Honest toggles
Notification toggles show a toast and revert when a save fails, instead of failing silently.
Real deletion
Deactivate and Delete are real actions. Deletion is scheduled, and signing back in cancels it.
07 — OUTCOME
Shipped in the beta. Measured by what can no longer happen.
The beta is private, so how members use the account is not measured yet, and there has been no outside security audit.
6
account controls made to do what they promise
5
live leaks closed and verified on production
10
preference fields on a connection, up from 6
0
members locked out when two-factor moved
08 — REFLECTION
Audit the data before the screens.
Reading the logic behind each screen found all six broken promises. None of them were visible in Figma. The team’s 307-case QA workbook, run by twelve people before the beta, logged two of the five leaks on its own.
The connection profile was redesigned, and then its tabs turned out empty for a data reason. Next time, the order reverses.
MORE FROM DADO
Behance
Copyright @2026 Manish Durgude