Say hi 👋

back to the desk

DADO

One Big Wish

Accounts

The Edit

Accounts & privacy

How an account became a lifetime gifting record, with privacy that holds on the server.

ROLE

Product Designer

SCOPE

Wishlist privacy, connections

TIMELINE

Since July 2026

CASE

STUDY

jump to a chapter ↓

The short version

The account

Making the promises real

Decisions

Also decided

Outcome

Reflection

every privacy choice holds, right where the data is read

DADO · ACCOUNTS

every privacy choice holds, right where the data is read

DADO · ACCOUNTS

01 · THE SHORT VERSION

The whole story in three notes.

THE PROBLEM

Most gifting apps forget you after checkout. DADO had to remember people, dates and gifts, privately. When I joined, six privacy settings didn’t do what they said.

THE PROBLEM

Most gifting apps forget you after checkout. DADO had to remember people, dates and gifts, privately. When I joined, six privacy settings didn’t do what they said.

WHAT I DECIDED

Build the account as a personal gifting record, with a tab for each part of giving, and make every privacy choice hold on the server, not just on screen.

WHAT I DECIDED

Build the account as a personal gifting record, with a tab for each part of giving, and make every privacy choice hold on the server, not just on screen.

THE RESULT

Live in the private beta: gifting, occasions, connections and gift history in one place, per-person privacy, and five data leaks fixed.

THE RESULT

Live in the private beta: gifting, occasions, connections and gift history in one place, per-person privacy, and five data leaks fixed.

02 · THE ACCOUNT

Not a settings page. A record of everyone you give to, and everything you gave.

Most accounts just store a password and an address. DADO’s keeps a member’s whole gifting life: what they gave, who they give to, the dates that matter and what they’d love. Here it is, tab by tab.

My Gifting

Every wish a member runs, every gift they chipped in on, and drafts they haven’t sent yet, all in one list, so nothing gets lost.

Wishing

Contributing

Drafts

worldofdado.com

A tour on the test site: My Gifting, the occasions calendar, wishlists and account security. Personal details were cut.

Occasions & Events

An occasion is a date worth remembering. An event is a time and a place. Members add their own, and can host an event by inviting other members, or people not on DADO yet.

Occasion: a date to remember

Event: a time and a place

Invite anyone

worldofdado.com

Adding an event on the test site: who it’s for, where, when, then an invite that joins their calendar once accepted.

Connections

Add people like on any social app, then mark the ones who matter most as close. You can add someone who isn’t on DADO yet. When they join, everything you saved links up. Each person gets a private note only you can see.

Important dates

Wishlist

Gifting

Sizes & preferences

Family

Profile

worldofdado.com

My Connections, filtered by close connections, family, friends and colleagues. Profile screens built with Anchal.

Gift history

A memory album of gifts given and received, on DADO or anywhere else. Members can log outside gifts too, and send a thank-you card with a personal note.

Log a gift

Thank-you cards

worldofdado.com

Gift history on the test site: the timeline, a finished wish, logging an outside gift and a thank-you card.

05–07

The quieter tabs

Wishlists

Wishlists from DADO and other sites, kept together.

Wishlists

Wishlists from DADO and other sites, kept together.

Saved

Things saved while browsing, kept apart from real wishes.

Saved

Things saved while browsing, kept apart from real wishes.

Account details

Important dates, sizes, family and profile. Each item has its own “who can see this”.

Account details

Important dates, sizes, family and profile. Each item has its own “who can see this”.

Preferences: everything has an audience

Contact info can be seen by Only me, Close connections or Connections. Important dates and preferences each get their own setting too.

PROFILE VISIBILITY

Contact info

Your phone number, email and date of birth, shown only to the people you choose.

Only the people you mark as close can see this.

WHAT EACH PERSON SEES

A connection

Phone numberHIDDEN

Email addressHIDDEN

Date of birthHIDDEN

A close connection

Phone numberVISIBLE

Email addressVISIBLE

Date of birthVISIBLE

Try it: click an audience above.

worldofdado.com

Preferences as launched: who can see your contact info, and how DADO reaches you.

03 · MAKING THE PROMISES REAL

Personal only works if privacy holds. When I joined, six settings didn’t do what they said.

Most screens were designed, but few were checked against the data behind them. One setting hid a name on screen while the server still sent it. Family tabs read fields nobody saved to. Two-factor only lived in the browser.

Hide amounts raised

BEFORE

A switch in the wish setup that was never saved.

NOW

Saved with the wish, and the public page respects it.

Hide contributor names

BEFORE

Saved, then ignored when the page loaded.

NOW

Enforced where the page gets its data, no way around it.

Family info tab

BEFORE

Read from a place no screen saved to, so it was blank for everyone.

NOW

Shows what members actually enter in the Family form.

Birthday on a connection

BEFORE

Members added one, but their connections never saw it.

NOW

Shown to connections, behind the same setting as anniversaries.

“Who did this?”

BEFORE

Notifications only stored who received them.

NOW

Every notification records who caused it, with just a safe name and photo.

Two-factor

BEFORE

Checked only in the browser, so a stolen login could skip it.

NOW

Checked on the server at every sign-in, and needed to pay or delete the account.

04 · DECISIONS

Four choices that made the account keep its word.

DECISION 01

Every setting is checked on the server, so asking directly gives the same answer as the screen.

why

“Hide contributor names” was saved, then ignored. “Hide amounts raised” was never saved at all. A setting that only hides things on screen still gives the data to anyone who asks the server.

why

“Hide contributor names” was saved, then ignored. “Hide amounts raised” was never saved at all. A setting that only hides things on screen still gives the data to anyone who asks the server.

what it cost

Two database changes and a rewritten public lookup. None of it shows up in Figma, only when someone asks the server directly.

what it cost

Two database changes and a rewritten public lookup. None of it shows up in Figma, only when someone asks the server directly.

Screen says “hidden”

Before: the server still sent the data.

Screen says “hidden”

Before: the server still sent the data.

Server says “hidden”

Now: a direct request gets nothing extra.

Server says “hidden”

Now: a direct request gets nothing extra.

worldofdado.com

Preferences as launched: who can see your contact info, and how DADO reaches you.

DECISION 02

Connection profiles now read what members actually save, so family, dates and birthdays stop showing blank.

why

Family and Occasions were blank for every connection, because the profile read fields nothing ever wrote to. Preferences showed only 6 of 10 fields. Anchal built the profile screens and tabs; I built the data that fills them.

why

what it cost

Eleven database changes in the first pass. One shared list of family relations now drives the grid, the family screen and who can see what.

what it cost

Eleven database changes in the first pass. One shared list of family relations now drives the grid, the family screen and who can see what.

WHAT MEMBERS ENTER

Family form

saves each family member

Occasions form

saves each dated occasion

→

WHAT THE PROFILE READ

an old spouse field

an old anniversary field

empty for everyone

→

WHAT THE PROFILE SHOWS

CONNECTION

FAMILYOCCASIONSPREFERENCES

Nothing here yet

PREFERENCE FIELDS SHOWN6 of 10

A birthday is shared only when the member’s own setting allows it.

DECISION 03

Every notification says who caused it, and a thank-you became a card with its own page.

why

Notifications only saved who received them, so the bell showed an icon and nothing else. Now each one records who caused it, through a small lookup that returns just four safe details.

why

Notifications only saved who received them, so the bell showed an icon and nothing else. Now each one records who caused it, through a small lookup that returns just four safe details.

what it cost

My first version showed whole profiles to anyone named in a notification. I reversed it the same day, so one change became two.

what it cost

My first version showed whole profiles to anyone named in a notification. I reversed it the same day, so one change became two.

TWO KINDS OF NOTIFICATION

From DADO

No person behind it. It shows its type icon.

Caused by a person

The server records who did it, and shows only four safe details, like their name and photo.

Faces are blurred here.

Notifications

ALL4MENTIONS2UNREAD2

TODAY

Thank you

sent you a thank-you card. Open it to view and download.

Your concierge request is underway

Our team has started on it.

Occasion accepted

addedto their calendar.

Similar occasions found

Review them in Occasions and events.

The bell as launched, and a thank-you sent on a phone: pick a card, write a note, and it opens on its own page. Names blurred.

DECISION 04

Five data leaks closed the afternoon I found them, and two-factor moved from the browser to the server.

why

A testing pass turned into a security pass. The leaks ranged from phone numbers and shipping addresses to anyone being able to write payment records. I confirmed each leak on the live database before fixing it, and checked each fix the same way.

why

what it cost

None of the 38 users had two-factor on, so I checked live that the change locked nobody out. Very old sessions now see an error, logged as a follow-up.

what it cost

None of the 38 users had two-factor on, so I checked live that the change locked nobody out. Very old sessions now see an error, logged as a follow-up.

Five leaks, and the fix

ALL CLOSED

Connection profile

Anyone signed in, by adding themselves as a contact

Needs a connection both people accepted

Personal details

Full name, phone and birthday on a public wish

A lookup that returns only four safe fields

Invite lookup

The whole wish, shipping address included

A fixed list of safe fields only

Explore page

Recipient addresses to anonymous visitors

Only safe fields, never the whole record

Transactions

Any user could write payment records

Only the payment processor can now

Every fix was confirmed by engineers on the team. There has been no outside audit.

05 · ALSO DECIDED

Smaller choices that shaped the account.

Birthdays

Shown on both connection views, behind the one “important dates” setting the member controls.

Birthdays

Shown on both connection views, behind the one “important dates” setting the member controls.

Thank-you cards

Saved, the giver is notified, and the card opens from a private link, no account needed.

Thank-you cards

Saved, the giver is notified, and the card opens from a private link, no account needed.

Two-factor for big actions

Paying, adding a card and deleting the account all need two-factor checked on the server.

Two-factor for big actions

Paying, adding a card and deleting the account all need two-factor checked on the server.

No half-saves

Setting a default card or address happens in one step that can’t half-fail. Deleting a card also removes it at Stripe.

No half-saves

Setting a default card or address happens in one step that can’t half-fail. Deleting a card also removes it at Stripe.

Honest switches

If a notification setting fails to save, you see a message and it flips back, no silent failures.

Honest switches

If a notification setting fails to save, you see a message and it flips back, no silent failures.

Real deactivate & delete

Deletion is scheduled, and signing back in cancels it.

Real deactivate & delete

Deletion is scheduled, and signing back in cancels it.

06 · OUTCOME

Live in the beta. Measured by what can no longer go wrong.

The beta is private, so we haven’t measured how members use the account yet, and there has been no outside security audit.

privacy settings that now do what they promise

live data leaks closed and checked

preference fields on a connection, up from 6

members locked out when two-factor moved

07 · REFLECTION

Check the data before the screens.

what I found

Reading the logic behind each screen found all six broken promises. None of them showed up in Figma. The team’s 307-case test sheet, run by twelve people, caught two of the five leaks on its own.

what I found

Reading the logic behind each screen found all six broken promises. None of them showed up in Figma. The team’s 307-case test sheet, run by twelve people, caught two of the five leaks on its own.

what I’d do differently

The profile was redesigned first, then its tabs turned out empty because of the data. Next time I’d fix the data first, then the screens.

what I’d do differently

The profile was redesigned first, then its tabs turned out empty because of the data. Next time I’d fix the data first, then the screens.