Persistence scope must match privacy expectations
Aliases: what should not remain · shared device · leftover local state
What it is
What is kept has to match who people think still lives in the data on this device. Search terms, drafts, a login session, location, a paste from the clipboard — the deeper they persist, the more likely they are still there when the next person opens it. Persistence scope matching privacy expectation means: what the user treats as private or one-shot must not become a visible leftover across sessions, accounts, or devices; what they treat as “my work” must not be lost to over-cleaning.
Scope is a list, not “it is encrypted so everything may stay”. Encryption answers a stolen disk. Expectation answers a roommate, a colleague, a demo on a projector, a phone lent to a child.
Why it happens
Privacy expectation comes from situation: my phone versus a counter tablet, this account versus a browser that has been inside a work inbox. People grade data by situation — passwords almost never as plaintext, a cart on their own phone should stay, a checkout screen a clerk can see should not. A persistence layer that only “stores what it can” writes the most sensitive and the least into the same local store. The first glance of the next session becomes a leak channel: an email autofilled, a private chat still open, a search suggestion of a diagnosis.
A second layer is the account boundary. Sign out or switch account in the same browser: if persistence follows the device and not the identity, the next user inherits the last draft. Follow identity but not device, and “remember me” on a public computer does the work for the next stranger on shift. Scope has to write “who” and “which machine” as separate lines.
Where it stops holding
Accessibility state (type size, contrast, input habits) kept across sessions usually matches expectation even on a shared device — the next person can change it; they should not be forced to reset every time. Legally required audit logs are not user-visible state and may live where the user cannot clear them, but that place must not be rendered as a user draft. Persistence for a minor or a supervised account may be required visible to a guardian, which conflicts with the subject’s expectation; the conflict has to be spoken in the product, not silently under-kept for the subject or silently over-kept for the guardian. Anonymous mode’s contract is burn-on-session-end; cross-session keep is itself a breach.
Applying it
- Bucket by sensitivity: secrets and ID numbers not kept by default; drafts and filters kept on one’s own device, cleared on sign-out; display preferences may stay.
- On sign-out, account switch, or “this is a public device”, list what will vanish and what will remain, rather than only clearing cookie names.
- At the start of projection or remote assist, pause leaky autocomplete and unread previews.
- How to check: log in on a browser, write a private draft sentence, search a sensitive term, open a private mail. Sign out, open the same product as another account. If the draft, search suggestions, or mail preview remain, scope crossed the identity boundary. Then, still signed in, mark the device “public”, quit the browser, reopen: session and drafts should be gone, theme preference may stay — to confirm bucketing rather than a single wipe.