Technical discovery, RFC and wireframes published

The research and preparation phase of the Privacy Project is done. The privacy audit and technical discovery report and the RFC are both published now.

In the last update I mentioned the privacy audit. We've now finished the full technical discovery around it and written everything up in one report. It covers how a default Mautic install handles every cookie, every call out to a third party and every place that can track a visitor or a contact, all checked against the code. You can read it here: Privacy audit and technical discovery report.

The RFC is through internal review and is now public: Mautic Privacy Project RFC. It follows the three areas from the last update. In short, Mautic should respect consent, you should be able to control who sees what, and all privacy settings should live in one place, with tracking off by default.

Have a look and tell us what you think, in the doc or here in the comments. If something doesn't fit how you use Mautic, it's much easier to change it now than after it's built. :)

Anderson has also published the wireframes for the Privacy Centre, based on his UX research: Privacy Centre wireframes. They show how the new privacy settings will look and how a new install will be walked through turning on only what it needs. Feedback on those is just as welcome.

A bit about how we've been working. Anderson and I split it between design and code, but most things go back and forth between us. He looks at how something should feel for the person using it, I check what the code actually does, and then we argue it out until both make sense.

The first changes are already merged, starting with a new Privacy Centre page and Gravatar switched off by default. Next up is cookieless forms, and we'll report on that in the next update. All the work is tracked in the open on GitHub, so you can see what's in progress and what's next.