Why an exact location stops at the server, and what is shown instead

The question, and who it is for

When you write an anonymous message on fisfis you are asked one optional question: whether to send your rough location with it. Two buttons, neither of them pre-pressed, and the message sends either way.

It exists for a narrow reason. Somebody receiving anonymous messages occasionally needs to weigh whether a sender is who they are implying they are, a message claiming to be from someone in the same city as them reads differently if it arrived from the other side of the world. Sharing is how a sender can settle that in their own favour, voluntarily.

The question has always been optional and always will be. What changed recently is not the question. It is what gets drawn from the answer.

What changed

A phone that answers a location prompt does not answer it vaguely. It returns a reading good to a few metres, which, for most people most of the time, is their home. Anything built on top of that reading inherits its sharpness, including anything drawn on a screen.

We now stop that reading at the server. It is used for the checks it was always used for and it is not passed onward, and what the person receiving your message is shown instead is an area: a box roughly a kilometre across that you were somewhere inside, drawn as a rectangle on a map rather than as a pin.

The technique is an ordinary one, a published, decades-old scheme for naming a grid square rather than a spot, sometimes called a geohash, and we are not claiming to have invented anything. What we changed is where in the journey it is applied: before the display rather than after it, so there is no screen anywhere in the product that draws a point.

Why an area and not a point

The reasoning is easier to follow as a question about who the extra precision serves.

Read down that table and the case makes itself. Everything a receiver legitimately needs is answered in the first two rows. The rows below add nothing to the question being asked and add a great deal to a question nobody was invited to ask, and the person carrying that risk is the one who was trying to be helpful by sharing at all.

Sharing should not be a trap

A sender pressing “share” is being cooperative. If the result of cooperating is a marker on their roof in a stranger’s browser, then the cautious answer to a fair question was the correct one all along, and the feature has quietly taught people not to use it. An area keeps the cooperative answer safe to give.

The safest data is the data that was never handed on

Anything shown on a screen can be screenshotted, forwarded, or kept long after the reason for looking at it has gone. Narrowing what is displayed narrows every one of those downstream copies at once, which no policy about how the copies should be treated can do.

It costs the reader nothing they were using

This is the part that made the decision straightforward rather than a trade. Nobody receiving an anonymous message was using metre-level precision for anything. The question in their head is whether the story holds together, and an area answers it.

What declining does and does not do

Here is the line we will not blur, including in a post whose subject is how careful we are being.

Any service that told you otherwise would be telling you something pleasant instead of something true, and pleasant beats true right up until the moment somebody relies on it. The useful comparison is not “traced or not traced”. It is how much resolution exists, who can see it, and how long it stays.

• Not shared. The rough area a network gives away is all there is, and the sharper reading was never taken.
• Shared. The reading is used at the server, and an area about a kilometre across is what anyone is shown.
• Either way. Records are trimmed on a schedule, and the precise part is among the first things to go.

What this costs the person receiving

Very little, and it is worth being specific rather than reassuring. An inbox owner still gets the thing they had before: a sense of whether a message came from anywhere near where it claims, alongside the network and device details that were already on the page.

What they no longer get is a spot on a map they were never able to act on responsibly anyway. Nothing about moderation got weaker: the controls that decide what reaches an inbox are the same controls, and none of them was ever a coordinate.

The same principle governs an anonymous voice call: the sound is relayed rather than sent directly, so neither person learns the other’s address, and a call never raises the location question at all.

What to ask of any service

Whether or not you use this one, these are the questions worth putting to anything that asks for your location alongside an anonymous message.

• Is the question optional, and is the message sent either way? A prompt you cannot decline is not a question.
• What precision is displayed? Not stored, displayed. The screen is where information escapes.
• Is the decline honestly described? A service claiming that declining makes you untraceable is either mistaken or hoping you are.
• How long is it kept? There should be an answer, in words, on a page anybody can read.

Ours are on the about page, in plain sentences and not in a table of legal definitions. If you are weighing up the wider question, what a good inbox owes the person holding it is the companion to this post.