What a survey panel knows about you, and what we do not

People think about message privacy in terms of content: the embarrassing text, the private detail. Content is the smaller half of the problem.

Here is what is inferable from a messaging app, roughly in order of how obvious it is.

From content

The easy tier. Anything you wrote is available: your plans, opinions, relationships, health, finances, the tone you take with different people.

This is what encryption debates focus on, and it is the part most services genuinely do protect, at least in transit.

From metadata

No message content required. Just who, when and how often.

• Your social graph, weighted. Not merely who you know, but who matters, measurable from frequency, response latency and conversation length.
• Your sleep schedule, precisely. First and last message of each day, tracked over weeks, is more accurate than most sleep apps.
• Your working pattern. When work messages start and stop, whether they continue at weekends, whether that changed in March.
• Relationship changes. A contact whose daily frequency drops to zero in a week tells a clear story. So does a new contact appearing at high frequency.
• Your timezone and travel. Message timing shifts when you move.

Metadata is rarely encrypted, is cheap to store, and is far more analysable than text because it is already structured.

From behaviour

The tier almost nobody considers, available to any app you have installed.

• Which conversations you open and how quickly, a direct measure of who you prioritise
• What you typed and deleted before sending, if drafts are synced
• How long you spend reading a particular thread
• When you check the app and how often, which correlates with anxiety and boredom in ways that are commercially interesting
• Whether you read a message and did not reply, and for how long

None of this requires reading a single word you wrote.

From derived data

Then there is what an AI-powered inbox produces on top of your messages. Search indexes. Embeddings. Extracted appointments, invoices, contacts. Summaries. Textly builds the index and extracts the cards; embeddings and summaries belong to the apps that run a model.

This tier is worth calling out because it is more concentrated than the raw data. An index of your messages by meaning is a more efficient way to answer questions about you than the messages themselves. If it sits on a server, it is the single most valuable file in the building.

What a panel asks for

Now put the other list beside it. To answer surveys for money the usual way, you make an account, and the account is the product. Name, email, date of birth, household size, income bracket, employment, the brands you buy. That profile is what makes your answer sellable, and it is kept, enriched and matched against the next study.

None of it is sinister. It is simply the price of the arrangement: they cannot pay you for an opinion without knowing whose opinion it is.

We took a different route, and it constrains what we can sell. A poll answer from Textly comes with the market it was answered in and nothing else attached to it. No profile behind it, because there is no profile. That makes some research impossible for us to do, and we would rather say so than pretend the constraint is a feature with no cost.

What we decided

Textly could collect every tier above. Any messaging app can. We collect none of it, and the mechanism matters more than the intention.

Your messages never reach our server. There is one, and it holds what paying people requires: a verified number, a balance, which polls were answered, and a heartbeat every fifteen minutes saying whether Textly is still your default messaging app. Message content, metadata, behaviour and derived data stay on your device, because the server has nowhere to put them and no way to ask for them.

There is no analytics SDK. No Firebase, no Crashlytics, no advertising identifier, no telemetry. This is a decision with a real cost: we genuinely do not know how many people use search, or where a flow is confusing. We find out by being told, which is slower and worse.

There is no account. No email, no phone verification, no identifier tying the app to a person. We could not build a profile of you if we wanted to, because there is nothing to attach it to.

The derived data never leaves either. Your search index and extracted items sit beside the messages they came from, encrypted on your device, and are deleted with them.

The uncomfortable part

This costs us things, and pretending otherwise would be exactly the kind of marketing this post is arguing against.

We cannot tell you how many people use Textly. We cannot A/B test. We cannot detect that a feature is broken on a specific device model until someone emails us. We ship improvements more slowly than a company with a telemetry pipeline, and we sometimes fix the wrong thing because we guessed.

We think that is worth it. But it is a trade, not a free lunch, and you should be suspicious of anyone who tells you their privacy position costs them nothing.