The feedback button

I was testing Mune the way I test everything, I was using it for real and waiting for it to break.

It broke on the journal.

I'd written an entry the night before. Nothing important. A few lines about the day, the kind of thing I write to make sure the feature works on an actual person and not just on a script. I closed the laptop. The next morning, the entry was in the list with the correct date. I tapped it. The page opened empty. Title bar, timestamp, and below that, nothing.

My first instinct was the same as always. Pull the logs. Find the session. Trace the entry from save to render and see where the text fell out.

Then I stopped.

I couldn't do that. Not because the bug wasn't real. It was sitting right there, a blank page where my own words should have been. I couldn't do it because Mune is built so that I cannot see what happens on your end. The entry is encrypted on the device before it goes anywhere, and I don't hold the key. From where I sit, with full access to the database, your journal entry is a row, a timestamp, and a count of bytes. I can't tell you what it says. That morning, I couldn't tell you what mine said either.

That's the whole point. It's also the problem.

The same wall that keeps your writing yours keeps me blind to what breaks it. There's no script watching the page render. No error report tied to your account, because your account isn't supposed to be legible to me in the first place. When something fails for you, it fails behind glass I built specifically so I couldn't reach through it.

Most products solve this by watching everything. Session replay, event logs, a crash report with your user ID stapled to it, so that when the journal opens blank an engineer can pull up your exact session and watch it happen frame by frame. That tooling is useful. It's also the precise tooling I gave up the right to build the day I decided the server should never hold a key to a single word you write.

So I built a feedback button instead.

Not as an apology for the bug. Not as a patch over thin engineering. Because it's the only honest instrument left once you've taken privacy this far. You give up the ability to watch, and the only thing you get to put in its place is the ability to listen. The feedback button is what zero-knowledge looks like from the inside. It's me admitting I can't see you, and asking you to tell me what I'm missing.

Most products monitor everything and tell you nothing. Mune monitors nothing and has to ask.

Which makes the arrangement stranger than it usually is. If the journal opens blank for you the way it did for me, I will not know. No dashboard turns red. No alert fires at 3 AM. The only way the bug reaches me is if you stop, find the button, and spend thirty seconds telling a stranger that something he built didn't work. I am, in a real and slightly uncomfortable way, dependent on you choosing to speak.

I did find my own bug, a day later. The entry had saved a half-second before the key finished loading, so the encryption wrapped nothing and handed it back. A blank stored as a blank. Mundane, the way real bugs almost always are.

But I only found it because the blank entry was mine. If it had been yours, it would still be sitting there, and I would still be looking at a row, a timestamp, and a count of bytes, none the wiser.

I used to think building privately meant building in the open and being watched for it. It turned out to be the opposite. The more completely I made it so I couldn't see you, the more I had to trust you to talk back. That's the trade. I find out what's broken the oldest way there is. Someone decides to tell me.