Private by default: why every PaddleScout paddle starts hidden

Four location points are enough to pick you out of one and a half million people. A 2013 study in Scientific Reports put the figure at 95%, and even two points identify more than half of us. Where you paddle, logged a few times, is not anonymous. That one fact decides how a paddle-tracking app should treat your data, and it is why every paddle you upload to PaddleScout starts private.

The study, 'Unique in the Crowd,' analysed fifteen months of movement for 1.5 million people. Its finding was blunt: 'four spatio-temporal points are enough to uniquely identify 95% of the individuals.' Your movements are a fingerprint.

A paddle log is that kind of data. You put in from the same few launches, most of them near home, week after week. In 2023, researchers at North Carolina State University turned the theory into an address. Crawling Strava's public heatmap and checking it against voter records, they showed that a fairly active user, one posting around 300 activities, had a 37.5% chance of having their home pinpointed. The lead author started the work after a friend was stalked. We tell that story in full in our post on the Strava heatmap. Here the point is narrower: data like this identifies people, so the default that decides who sees it matters more than any other setting.

Most apps make your activity public and leave you to lock it down. Almost nobody does. When Gross and Acquisti studied privacy settings on a large social network, they found 'only a vanishingly small number of users change the (permissive) default privacy preferences.' A permissive default becomes the setting for almost everyone, because almost no one touches it.

European law drew the obvious conclusion years ago. GDPR Article 25 is titled 'Data protection by design and by default,' and it requires that, by default, personal data 'are not made accessible without the individual's intervention to an indefinite number of natural persons.' The safe state should be the starting state, and going public should take a deliberate act. An app that ships the opposite has decided your exposure for you.

In PaddleScout, every paddle you upload inherits your account's visibility setting, and that setting starts private. Nothing you record is exposed unless you decide to share it. The private default is not something the sign-up form can flip; it is set in the database, not in the request that creates your account.

Private also means private on our servers, not hidden in the app. If someone guesses the address of your paddle and asks for it directly, the server checks whether the trip belongs to them and returns a flat refusal when it does not. We do not hide a button and hope; the check runs on the server, every request. Your paddles, your pins, your photos and your launch points are yours to release, one at a time.

When you want to show a paddle to someone, you choose from three. Keep it private, and it has no shareable link at all. Make it unlisted, and PaddleScout mints a single unguessable link you can send to one person; the paddle stays out of search and off every public page, reachable only through that link. Or make it public, readable by anyone.

None of this relies on you finding a settings page. PaddleScout never builds a heatmap of everyone's launches. There is no page that pools paddlers' start points into one map; the trip planner and your dashboard only ever show your own spots, and the private feed shows the paddles your friends chose to share, not a stream of strangers.

We built it this way because the people most exposed by public-by-default tracking are often the ones who most need to feel safe on the water, which we cover in our post on fitness apps, safety and women paddlers. European law calls it privacy by default. On PaddleScout, it is the default.