Growing a Business With Digital Privacy as a Priority with Paul Jarvis

Paul and his cofounder, Jack Ellis, are two of my go-to experts on both digital privacy AND on the logistics of how to build that ethos into the DNA of your company. It's a core value for them as well, so they have to navigate the balance of promoting, marketing, and growing a company while still staying true to keeping data secure and while being respectful of individual's data AND transparent about what they're doing.

Key Takeaways:

- Why we should care about data privacy—even when we have nothing to hide
- Balancing privacy with marketing and promoting needs of a growing company while still keeping everyone’s data private
- Why I decided to swap Google Analytics for Fathom
- My background in Security Forces for the Air Force and how that informs my approach to safety and security in my business

Show Notes

Last summer, I started really thinking about values. What values do I have that I want to make sure I'm building into the DNA of my business? When it came right down to it, I realized that my core value—the one I wanted to make sure lived in every essence of my business—was safety.  

The work I do with clients requires trust and vulnerability. It’s intimate. Money is a touchy, uncomfortable subject for most of us, especially when we're talking in specific numbers. There's SO much shame and guilt and inadequacy for most of us when it comes to handling our finances. Talking about what's not working behind the scenes in your business requires you to admit that everything isn't perfect. 

And that can’t happen if people don’t feel safe—both in the real, physical world and psychologically. So, I asked myself: if I want to build a company with the core value of safety, how do I actually go about doing that?

In the last seven months or so, I embarked on this experiment in privacy-focused marketing and data security. It’s been a big part of every marketing and operational decision I’ve made. 

All this month, we’re talking about privacy and security on the podcast. It'll be part behind-the-scenes with me sharing some of the actual steps I've taken and how I thought through these decisions for myself. I’ll also be interviewing some of the experts that helped me educate myself along the way. 

One of the first things I did was remove Google Analytics from my website and replaced it with a tool called Fathom. It’s a really simple, lightweight privacy-first alternative to Google Analytics. 

My guest today is one of the founders of Fathom, Paul Jarvis. Paul and his cofounder, Jack Ellis, are two of my go-to experts on both digital privacy AND on the logistics of how to build that ethos into the DNA of your company. It's a core value for them as well, so they have to navigate the balance of promoting, marketing, and growing a company while still staying true to keeping data secure and while being respectful of individual's data AND transparent about what they're doing. 

Listen to the full episode to hear:

• Why we should care about data privacy—even when we have nothing to hide
• Balancing privacy with marketing and promoting needs of a growing company while still keeping everyone’s data private
• Why I decided to swap Google Analytics for Fathom
• My background in Security Forces for the Air Force and how that informs my approach to safety and security in my business

Learn more about Paul Jarvis:

• Fathom
• pjrvs.com

Learn more about Susan:

• Think Like A CFO
• Scalespark Action Plan
• ScaleSpark

Grab the Calm Service Design + Delivery Swipe File here

Creators and Guests

Host

Susan Boles

Speaker, Podcaster & Consultant at Beyond Margins | 15+ years of experience as both a CFO and COO

What is Engineering Calmer Agencies & Consulting Firms: Calm is the New KPI?

Can you build a business based on… “calm?” Host Susan Boles looks beyond the usual metrics of success to help you build a business where calm is the new KPI. With over 15 years of experience as an entrepreneur, CFO, and COO, Susan shares the business strategies that lead to a business with comfortable margins—financial, emotional, energetic, and scheduling margins. Join her and her guests as they counter the prevailing “wisdom” about business growth, productivity, and success to provide a framework for making choices that align with your values and true goals. Episode by episode, you’ll get a look at the team management, operations, financials, product development, and marketing of a calmer business.

Paul: 00:00

If you're not storing and collecting data in the 1st place, then there's no way that that can be breached or hacked or whatever. It's just a safer way to do business. And that data is not needed, especially when we're talking about website analytics. That data is not needed. Like, we've been running, a privacy focused company, and it hasn't hurt our business.

Paul: 00:16

It hasn't impeded our ability to grow as a company or anything negative.

Susan: 00:26

Last summer, I really started thinking about values. What values realized that my core value, the one I wanted to make sure lived in every essence of my business was safety. I'm Susan Boles, and you're listening to Break the Ceiling, the show where we break down unconventional strategies you can use to save time, boost your profit, and increase your operational capacity. Most of my work with clients is intimate. Money is a touchy, uncomfortable subject for most of us, especially when we're talking in specific numbers.

Susan: 01:08

I've had people tell me they'd rather be naked in front of a stranger than show them their business books. And there's so much shame and guilt and inadequacy for most of us when it comes to handling our finances. Letting someone into that requires vulnerability. Talking about what's not working behind the scenes in your business requires you to admit that everything isn't perfect. And in an Instagram world where we're expected to project that we're all fabulously okay every day, that's just uncomfortable.

Susan: 01:40

I think that's probably one of my favorite silver linings to come out of all of the crap that was 2020, that it's starting to be okay to admit that we're not all okay. But the point here is that the work I do with clients requires trust and vulnerability. And that can't happen if they don't feel safe, both in the real physical world and psychologically safe. So if I want to build a company with the core value of safety, how do I actually go about doing that? Now you may or may not know this about me, but both my undergrad and my first master's degrees are actually in criminal justice.

Susan: 02:18

And I started my career out as an Air Force Security Forces officer and then later served as one of the senior antiterrorism advisors to a base commander when I was a civilian. And it's been quite a while since I've used those degrees professionally, but the training and the awareness of safety, of security is something that I honestly just can't turn off. It's something that's always running in the back of my mind. And during my work as an anti terrorism adviser, we focused on prevention, making sure that troops didn't accidentally make themselves target. And we tried to help them keep themselves safe by encouraging awareness of the risks.

Susan: 02:59

So thinking about safety from a security perspective feels pretty logical to me. And so part of creating a safe environment means creating a secure environment for all of the data and the information that I handle. I work with financial data, bank accounts, and confidential business plans. And the bare minimum level of safety for my clients is to feel confident that I can keep that information secure. Now at the same time I was thinking about all of this, this, I was also starting to really think about all of our personal data that lives out on the Internet.

Susan: 03:34

This was happening at about the same time that the Stop Hate for Profit campaign was gaining ground, which is a campaign to convince social media companies to take more action to moderate online hate groups and hate speech. And we were also talking about TikTok being banned because of privacy concerns. I was starting to get more curious and concerned about how my own data was being used and tracked by Facebook, Google, Amazon, and I was getting a lot less comfortable with using social media to grow my own business. I even did an episode with Nancy Jane Smith and Bonnie Gillespie back in September. It's episode 48 if you wanna go check it out.

Susan: 04:11

Exploring this idea of how to ethically use social media or if you even needed to use social media in your business. So all of this kind of led up to me asking the question, if I were to market and operate my business with a deep respect for individual data privacy as the first step towards building safety and security into the DNA of ScaleSpark, what does that actually look like? So I embarked on this experiment in privacy focused marketing and data security. And for the last 7 months or so, that's been a big part of every marketing and operational decision that I've made. And I wanted to share my journey with you.

Susan: 04:50

So this month, we're talking all about privacy and security. It'll be part behind the scenes with me sharing some of the actual steps I've taken and how I thought through these decisions for myself and also interviews with some of the experts that helped me educate myself along the way. I'm kicking off the theme where I kicked off my experiment with removing Google Analytics from my website and replacing it with a tool called Fathom. Fathom is a really simple, lightweight, privacy first alternative to Google Analytics. And I started here because, honestly, it was the easiest step for me.

Susan: 05:24

It took about 10 minutes. I removed the Google Analytics tracking code, replaced it with the Fathom code, and bam. No more personal tracking on my website. As an added bonus, because of the way Fathom does tracking, I could also take the cookie notice down from my website because I wasn't invading anyone's digital privacy anymore, so I didn't need to notify them that I was. So one last pop up to have to deal with.

Susan: 05:47

Throughout this experiment and my research into data privacy, the Fathom blog has also been a fantastic resource to explain the often complex world of digital privacy in a really human way. My guest today is one of the founders of Fathom, Paul Jarvis. And Paul and his cofounder Jack Ellis are 2 of my go to experts on both digital privacy and on the logistics of how to build that ethos into the DNA of your company. It's a core value for them as well. So they have to navigate the balance of promoting, marketing, and growing a company while still staying true to keeping data secure and also being respectful of people's individual data and being transparent about what they're doing.

Susan: 06:34

Paul and I talk about why you should care about digital privacy even if you have nothing to hide, and we talk about how to balance the marketing and promotion needs of a growing company while still keeping everybody's data private. Hey, Paul. Thanks for being here.

Paul: 06:49

Yeah. Thanks so much for having me on the

Susan: 06:51

show, Susan. So Fathom is a privacy focused company, but a lot of my audience isn't necessarily familiar with kind of what that means. So what does being privacy focused as a company mean to you?

Paul: 07:03

Yeah. So I guess the long and short of our business model is selling software and not selling data. And, I guess, I'll start there because a lot of the software that we use on the Internet like like, social media or or even things like Google Analytics are free because their business model isn't charging customers money for that software. It's making money off of people in other ways. So we charge a fair price for our software.

Paul: 07:34

Meaning, we don't need to sell data. We don't need to collect data. It's it's basically I think it's a more upfront business model. We we have fair price software that people pay us to use. We also don't show any personal information about visitors for, the analytics software that we provide.

Paul: 07:53

Right? So you can see information about your website without learning a ton about the actual individuals who are visiting your site, which I think is kind of invasive. And I guess the last point about being privacy focused is that we comply with privacy laws. And I think privacy laws are actually a good thing even though they can get a little in the weed. So things like GDPR, CPPA, PECR, all of the, I guess, 4 letter acronym privacy laws our software complies with because we don't show personal data in our software.

Paul: 08:30

Yeah. I guess that's that's all the things that that privacy focus means.

Susan: 08:35

Yeah. Basically, though, the way I always like

Susan: 08:38

to think about it is if you're not paying for the product, you are the product.

Paul: 08:42

Exactly.

Susan: 08:43

And at least for me, so, one of one of the things

Susan: 08:45

I did at Scalespark this year was try

Susan: 08:47

and kind of embark on this, I guess, attempt to see if it's possible to grow and market a business without, still being respectful of privacy and the privacy of my clients and the people that work with me. And Fathom was the the easiest part of that to implement was just to kill Google Analytics and install Fathom. But the kind of the idea around digital privacy and paying attention to who has our information, paying attention to what they're doing with that information, was an important part of what I was trying to accomplish with my business. But why do you think we should care about digital privacy? Why why should we care what people are doing with our data?

Paul: 09:34

Yeah. I mean, I for me, I think it's it's really important. And even if you look at the the news. Right? Like, the company Cambridge Analytica shut down because it wouldn't release the data of a single person.

Paul: 09:46

Like, that's how important invading people's privacy was to them. So I think it if your listeners are new to digital privacy, or if they think, oh, maybe this doesn't matter. Maybe and this is kind of the common thing. Right? Maybe maybe you think if you're listening, well, I have nothing to hide.

Paul: 10:04

Right? Because you're a law abiding wonderful citizen of the Internet. I can certainly understand the reasoning of if you're not doing anything wrong, you shouldn't have anything to hide. But that logic can be uninformed, and it can actually be dangerous. So research have researchers have coined this term called social cooling, kind of like the opposite of global warming, but relating to how we act as human beings to describe what happens when we feel like we're constantly being watched, right?

Paul: 10:35

Like, even if we're doing nothing wrong, there's a change in our behavior that happens when there's just vast amounts of data being collected about us at all times. So, how social cooling works is that since all of our data is constantly being watched and collected and mined and stored and turned into scores and data points and targeted ads, it makes us change, right, because we don't want, those things to impact us. We know that if we say something wrong, say, on social media, that we could get fired or or something worse. And so all of this data kind of that's collected about us creates this sort of digital reputation, right, that could potentially limit our opportunities in life and work and social situations, and even things like if you return goods to a store, you're at higher risk of being considered a fraudster. Right?

Paul: 11:30

So, all of this data is being collected at all times and that could affect things like applying for a loan in the future. And so because we know that we're being graded and judged, it it changes how we interact and what we do and what we say. And this creates pressure to not have, opinions that rock the boat or or dissent. And it breeds this kind of culture of conformity where we're less likely to take risks. We're less likely to think outside the box.

Paul: 11:59

We're kind of just it makes it so we act different. It's just like people on the show The Bachelor. Right? Like, they're not acting like real human beings. They're acting like people who know that they're on camera.

Paul: 12:12

So thinking about digital privacy means that we don't want all of this data collected about us and socially cool how we act, on the Internet, right? So saying that we have nothing to hide and this is like such a soapbox for me. But, like, saying that we have nothing to hide can also be a bit of a privileged statement, and view as well because a lot of us who who feel that way are lucky enough to live in, like, democratic countries. And so in other countries, and this is kind of data that corporations get data that, governments get data, that corporations get that that they then sell to governments. So, minorities need privacy in some countries to shield themselves from social government re repercussions.

Paul: 13:00

Right? So, people with different sexual orientations, religious minorities, even people who just question political leaders where it's illegal to do that need digital privacy and without privacy, nefarious governments or corporations could basically round up everyone who feels a certain way or votes a certain way or talks about things a certain way and do lasting damage to them. So I think for for all of those reasons and more, that's why digital privacy is important even if you're, just a normal law abiding Internet human being.

Susan: 13:37

Yeah. That totally makes sense. It's it's interesting that you bring up kind of the the safety issue, because that's actually what led me to, focus on privacy marketing was, this idea that one of my core values, because I deal with a lot of financial stuff, was that people needed to be able to trust me. And that trust needed to be held and cherished. And one of the ways that I wanted to respect that was, respecting their digital privacy and not tracking what they did on the website or what they were doing.

Susan: 14:14

And so it's interesting that you bring that up because that was actually the trigger for for me to kind of head down this path was, wanting people to feel safe when they were dealing with me.

Paul: 14:24

Interesting. And that's really valid too. Right? And I think I think the point of data, existing on the Internet isn't a matter of, like, oh, if it could be hacked or if it could be released. It's It's almost a matter of when.

Paul: 14:37

Right? Like, there's so many if you punch your email address into services, like have I been pwned, then you can see. Like, if I punch my email address in there now, that email address is associated with, I think, 237 breaches of data. So I think if you're not storing and collecting data in the first place, then there's no way that that can be breached or hacked or whatever. It's just it's way safer.

Paul: 15:02

It's just a safer way to do business. And that data is not needed, especially when we're talking about website analytics. That data is not needed. Like, we've been running, a privacy focused company and and using, Fathom for for years now. Right?

Paul: 15:17

And it it hasn't hurt our business. We talk about marketing. I know you want to. But that hasn't hurt our business. It hasn't impeded our ability to grow as a company or or anything negative.

Paul: 15:29

We know everything we need to know about our website. We just don't know the things that aren't useful to us about the people who are visiting it. And same with all our customers that use Fathom as well. It's the same thing.

Susan: 15:39

Yeah. I have I have no need to know who is hitting my content, but I do like being able to tell what content is more popular, where are people showing up, what what is drawing people in, and that's valuable information and it's actionable. I mean, I'm a I'm a data geek. I love data, but only data that you could actually do something with. And knowing the individual person, isn't something I I I want to know or want to act on necessarily.

Paul: 16:06

And that's kind of the thesis of Fathom is that the data and aggregate, in this case can be just as useful. It's like if you post this interview with me on your website and see that it becomes the most popular page on your site, then you'll have more nerds like me on your show. And you can use that and that helps that helps the podcast and every and everything else. So

Susan: 16:26

I will say my my top episode, is super nerdy. Nice. Project management, nerd out on ClickUp versus Notion. So super nerdy, and people love that. Okay.

Susan: 16:40

Okay.

Susan: 16:41

So let's talk about kind of the the marketing aspect of this that I think comes up for most business owners, which is

Susan: 16:42

that, you know, being, are kind of common wisdom is that, you know, being, you know, being, are kind of common wisdom is that you need to be tracking people and personalizing information and active on social media to be able to grow your business. And, you know, you and Jack still needed to promote and grow Fathom, but pretty much all the organic tools you have at your disposal have tracking included in them, and they sell data that's built into their business model. So, talk to me a little bit about how you decided to promote or advertise Fathom when you were kind of balancing the need to grow your business, but you didn't wanna compromise your privacy first values?

Paul: 17:29

For sure. And that's a great question because the way that we run Fathom isn't like, privacy isn't just a marketing gimmick that we have. Privacy is baked into every single thing we do, every decision we make, since since day 1. Right? And we have grown about 600% this year alone, in case anybody didn't know, through a pandemic.

Paul: 17:53

So things things have definitely been going well. And we've done things, like, never buying targeted ads. Right? So I'll I'll walk you through, I guess, probably the the five things that that we do as a privacy focused company that still markets our product effectively, grows our business, and and gets our name out in front of people. Like, I'm not so, actually, let me ask you a question.

Paul: 18:14

How did you find out about Fathom?

Susan: 18:17

I think through your newsletter.

Susan: 18:20

Okay.

Susan: 18:21

Like, it's it's been a while. Yeah.

Susan: 18:22

But I'm

Susan: 18:23

I'm pretty sure it was through your newsletter.

Paul: 18:25

Okay. That's awesome. And so people do people are able to find us because we do things like, well, the newsletter that I used to have, Sunday dispatches, which was just my personal newsletter. Didn't wasn't really Fathom related, but that was one kind of distribution method that I had. Another thing is our podcast, Above Board, And we don't have sponsors of the show because our company is a sponsor.

Paul: 18:53

Right? And so we and the show is really just Jack and I nerding out about what it takes to run a business. The other thing we do is have, our blog on our website where we write articles both about our software and just about privacy and, dealing with having a software company like the article. I think our most popular article was Jack's article about our company being attacked, with the DDOS attack. We also have our Twitter account.

Paul: 19:24

So we are actually active on Twitter. Jack handles the the Twitter account. And it's not just pitching either. Like, it's not just us using social to tell people about Fathom. It's us interacting and engaging with a greater community who are interested in in software and privacy.

Paul: 19:44

We're also constantly releasing features. Right? So every time we release a feature, we talk about it on the blog. We put it on Twitter. We write an article about it.

Paul: 19:54

And that gives us something to talk about. And it also gives, our customers something to talk about and our audience something to talk about and our affiliates, which I guess is the 1 the 5th or 6th? 5th, I think, thing is that we our affiliate program has been a great way to grow our business and we pay 25% commissions for life. So if an affiliate refers a customer and that customer sticks around for 5 years, we pay the affiliate 25% of their bill for 5 years. If they stick around forever, then forever.

Paul: 20:28

And the final thing, is word-of-mouth. And that's not just a and I think this is where a lot of people get it wrong. Word-of-mouth, and and reputation isn't a passive thing. It's very much something you need to actively work on. So for us, it's having the best software on the market that's easy to use, makes sense, simple.

Paul: 20:49

You just get it. If you look at if you look at the demo, you just get it. The the second part of that is making sure that we're keeping our customers happy. So we spend a lot of time on support and support is me and Jack, like the 2. If you email support, you're going to get a co founder replying and we try to reply as quickly as possible.

Paul: 21:13

And so all of these things we try to do because it helps with word-of-mouth and it helps reduce churn. And I think that there was some study done where it costs 5 times more to get a new customer than to keep an existing customer. And because we're in a subscription business, it, it saves us so much money and time to just make sure that the people who are already paying for us are happy. So we do focus on acquisition, but we really, really focus on retention. And so all of those things are what's led us to some really good organic growth through the last couple of years, this year especially.

Paul: 21:54

It's been a tough year and we've still managed to to grow the business pretty steadily.

Susan: 22:00

You forgot about the cats. Yeah. Which I really appreciate that they have names now. I'm just I'm just saying. I like

Paul: 22:07

cat names. That's part of that's part of having a brand that has uniqueness. Right? So people people remember the cats we have, all over print cat hoodies that people treat. And we don't even sell those.

Paul: 22:22

But we've, I mean, I have one. Jack has one and a couple people have got them. But people want those things and people talk to us about them. People remember the photos that we posted of these these silly cat hoodies, on the Internet. And as part of just building a a memorable brand, and Jack and I like to have fun.

Paul: 22:40

And so we don't the reason we run our is because we can just be real people running a business. We don't there's no legal team that we have to run ideas past. We can just be normal human beings in how we connect with others, and and it works and it helps.

Susan: 22:55

So you all did something I think is pretty interesting. So when you decided to kind of start making YouTube videos, you had a really interesting episode of Above Board where you talked about it. But, can you talk talk me through kind of the decision process that you went through to decide that YouTube was viable and how you were gonna balance the fact that YouTube tracks everybody and there's no way to avoid that. Mhmm. And balancing, respecting the privacy of your users and people that wanna watch the videos.

Paul: 23:29

For sure. And, I mean, YouTube's part of Google, and Google is, I guess, our our marketing nemesis. So the so the the kind of the thought process we had was, 1, we wanted to make videos, both in terms of, like, technical support videos. Like, if I can walk somebody through, doing something in Fathom and they can see my screen and see what I'm clicking on and see what I'm typing, fastest way to teach anybody how to use something on the Internet. Like, I mean, I've taught courses for years.

Paul: 24:02

I 100% know and get this. And the other side of it is videos are fun. Both Jack and I have, like to like to do things like that. And YouTube is a place where people go to watch videos, like it or not. Right?

Paul: 24:15

So, like, we could put our videos on Vimeo. Nobody would find them. And it wouldn't be a marketing channel because the only people that would find the videos if we put them anywhere other than YouTube was people who are already on our website. Right? So we wanted to use videos as a channel for brand awareness and and getting new people.

Paul: 24:37

YouTube's the only place to do it whether or not you like them. So what we did and I guess at the same time, we were like, well, we don't like, Facebook having, collecting all of this data that tracks you across the Internet. So we made these, I guess, kinda landing pages. So if we link to a YouTube video from our Twitter, from our website, from anywhere, it doesn't go straight to YouTube. It goes to a landing page on our site, which then connects to YouTube, and it strips all of the personal data.

Paul: 25:09

So all YouTube can do is track you on YouTube, which isn't actually like, tracking somebody in a thing that they're using is far less evil than tracking somebody across the entire Internet. Right? So we made these pages, and we're always trying to think of things like this where, okay, we we do care about privacy and privacy is is our top priority, but we also exist in the real world where YouTube's kind of a big deal. And YouTube is the place where people go to find videos, not just watch videos. So that's kind of what we did where, yeah, you're still using YouTube.

Paul: 25:45

But if you're using YouTube anyways, then you're already on their platform. But we didn't wanna give YouTube additional information about people we were sending their way. So we made these landing pages, instead, and that feels like, a good way and a good balance to, share YouTube videos and get discovered on YouTube, but also try to do what we can on our end to protect, the privacy, of people who wanna watch our videos.

Susan: 26:14

Yeah. I love the idea that, you

Susan: 26:16

know, you guys you still exist in the real world, and you still exist in the world of the Internet that is controlled by, you know, pretty big companies that it's really hard to work around. It's hard to find alternatives to a lot of these services like YouTube. There there isn't an there there isn't a a fathom version of YouTube.

Paul: 26:39

Exactly. And not one that has the the the 100 of 1,000,000 or 1,000,000,000 of users too. Right? So yeah. It's it's it's part of balancing.

Paul: 26:49

Like, we don't wanna be so private that it doesn't make sense in the real world. But anything we can do to be more private that keeps things actually usable and doable and not something that you have to go to, like, the terminal command line to type in some code. We just wanna make things easy. So if we can make the easy thing as as private as possible, then we're all for it.

Susan: 27:14

Hey, there. It's Susan. If you've been listening to this interview and it's making you think about some of these issues and ideas and you wish you could talk to some other real live business owners about it, I wanted to invite you to my free monthly roundtable Dollars and Decisions. Once a month, I get together live with a group of amazing business owners just like you to geek out on money and operations and workflow and software, all that stuff that you hear me talk about here. The roundtable is kind of like a live interactive version of the podcast, so I would love to have you join me.

Susan: 27:49

To sign up for the next roundtable, head to scalespark.c0/dollarsanddecisions, no spaces, no hyphens, or you can just click the link in the show notes. Hope to see you there.

Susan: 28:04

So Fathom, you guys recently survived a DDoS attack, which is basically like a spam attack on your service where they overwhelm your servers with a bunch of traffic. Yeah. And you and Jack run a very small company, pretty much just the 2 of you.

Paul: 28:19

It is just Jack and then.

Susan: 28:20

Yeah. So there's not a lot of surge capacity to handle something like that. So can you talk me through a little bit about how you all handled the attack and how you decided to move forward to give yourselves that capacity to surge without scaling up the size of your company.

Paul: 28:36

Yeah. And and BoJack and I are kind of on the same page with running a small and lean company. I mean, I I wrote a whole book called company of 1 that talks about the the methodology of of running a small company that questions growth. But it also doesn't mean that we're against growth. And kind of what I mean by that in this situation is that because the company is just Jack and I, neither of us want to be on call to handle server spikes.

Paul: 29:02

We run, serverless business. So all of our all of our servers or sorry. All of our software runs on AWS, which is basically that powers almost the entire Internet from Amazon. Right. And so our servers scale as needed.

Paul: 29:18

So, I think it was 2 months ago, one of our customers was getting 10,000,000 page views a week or something like that. And our servers just kinda scale up. And as as it's needed, they just grow and then shrink back down. So it doesn't we don't have to spend time on on the server administration side because Jack is an amazing programmer but doesn't wanna deal with servers. It's kind of a different skill set, which he can do, but he'd rather not.

Paul: 29:49

And I don't blame him. Dealing with servers is annoying. So all of our stuff runs on enterprise level architecture as as far as, actual But it's also bad because when somebody it's really hard to do that. But it's also bad because when somebody it's really hard to hack companies nowadays unless they do stupid things, like save all of their passwords in a plain text file on their server. But it's really easy to just send gobs of traffic at a server to try to bring it down, which is what targeted DDoS attack is, is just sending as much traffic and volume at a server as possible in hopes that it'll take it down.

Paul: 30:31

And so because, like I said, ours scale as needed, ours just kept scaling up as the attack ramped up, which is good because it kept our customers online, but bad because it cost us a ton of money. Right. Like, a ton of money. And so we needed to figure out a way. And so the the attack, wall was targeted and malicious, against us.

Paul: 30:54

And, yeah, I mean, we're a tiny company. I don't know why. Well, I mean, I can't really talk about that, but it it's silly that that happened. But it was good because it helped us iterate and and make our software better because we've now been able to create ways that blocks these kind of attacks. And, yeah, it costs us money, but our software is now better and more resilient because we're able to, deal with these things in a much better way.

Paul: 31:26

So if it happens again in the future like, I was talking to and this probably started about 5, 6 weeks ago from you and I recording this. The attack happened again, I think, 3 weeks ago. And And the only reason we knew is because I asked Jack on Monday morning because the attacks always seem to happen on a Saturday. And I asked Jack, I'm like, hey. Did we get attacked on the weekend?

Paul: 31:46

And he was like, I don't know. Let me check. He's like, yeah. I guess we did. But because we had set up all of these protections and firewalls and all sorts of other nerdy stuff, We didn't even notice.

Paul: 31:58

So we were able to to make our software better. And that that's part of, existing on the Internet is having to deal with stuff like that. And and, yeah, it cost us a bunch of money, but it's also why it's good and healthy for a business to have margins. Right? Like, we we were able to absorb the costs and not dip into the red, in dealing with something unforeseen.

Paul: 32:22

So, yeah, it it was it it sucked that it happened, but we're we're better off for it and it ended up becoming, a positive because our software is more resilient. And it's still just Jack and I doing it. So we hired a we hired a specialist. It's like the a team at AWS. I think they're called, shield AWS shield.

Paul: 32:42

It totally sound like

Susan: 32:43

should be called the a team. Yeah. I feel like it would be better.

Paul: 32:46

I think that there's the I think they're kind of going for that superhero vibe. And that was just something we didn't need to hire a person full time to help us with this. We just needed to hire the best consultants on the planet to who deal with this on a regular basis to help us through that. So, yeah, that that's how we that's how we dealt with that.

Susan: 33:08

And you actually you

Susan: 33:09

did the same kind of strategy with your legal team too. Right? You have a legal consultant that you work with?

Paul: 33:16

Yeah. We have a a privacy officer, Rhee, who is, the smartest person we know, who deals with, European privacy law. Because Jack for some reason, Jack and I, that's not something we ever studied. Being in the software business. No.

Paul: 33:32

So, yeah, we we have her on contract, and she has she's yeah, the smartest person by GDPR we've ever met. But she also has she's not a lawyer, so she has legal resources that she can bring in. So we kind of we kind of scale and shrink our team as needed with, consultants. And we would rather pay somebody as a consultant who is the best in the business or the best in their field of expertise for help for a little bit and have to think about hiring somebody and dealing with, like all the things that come with having full time employees. It's not something that, we need at this moment.

Paul: 34:13

It could change. Like, we're not against it in the future, but we need to we would rather solve problems in the best way than just throw, growth or or more at the problem.

Susan: 34:25

So talk to me a little bit about digital privacy as a whole, where you see kind of the the industry or the concept going? You know, what do you what do you think the biggest challenges to digital privacy right now? And what should we, either as business owners or just as people, can it be looking out for?

Paul: 34:44

Yeah. I mean, 3 years ago, I would have said awareness. Right? Like, it was just the tinfoil hatters like myself who cared about this stuff. But it it has become part of, the normal conversation now, which I which I think is amazing.

Paul: 35:02

I think it's great that people that that it it's in the news every time Facebook and Google and whatever other big tech company CEO has to go in front of congress to testify about breaking, breaking social contracts with that with all of us and breaking our trust through, abusing privacy. So I think that now that we're all aware of it, that that's a great thing. That's a great first step. I think that the next thing, and like you said at the beginning, if if you're not paying for the product, you are the product. So I think we need to think about all of the things we trade for free software.

Paul: 35:41

Right? Because we trade data for free software. We trade our privacy for free software. We trade protection for free software. And is it is it worth it?

Paul: 35:50

I mean, maybe it is sometimes, but I definitely don't think always. So I think thinking about, okay. Well, maybe I maybe I want to market my business somewhere other than Facebook or maybe I want to have, website analytics that aren't part of big tech. Right? Like, Google doesn't offer analytics for free because they're nice and they like you.

Paul: 36:14

That would be cool. But, mean, they're a multibillion dollar company. They offer free products because they make more money off of us in other ways that they just don't tell us. Right? Like, I I would rather and so I think we've kind of got and this is kind of why the Internet exploded is because there's all this free software.

Paul: 36:32

We can do pretty much everything for free. But it's like, okay, well, what has that cost us? Right? And I think the more people who are kind of coming that conclusion and kind of realizing why digital privacy is important, the better. And then seeing that there are other options, like whether it's Fathom, whether it's something else, whether it's, like, Fastmail instead of, Gmail for email, I think is important.

Paul: 36:59

And then on the on the consumer side of things, I think finding ways to to hide or obfuscate our our personal details when we're using the Internet, is really good. So things like using and and these things luckily have become so much easier nowadays. So things like using a VPN, super straightforward. Things like using, a password manager, like 1 password or last pass, whatever it is, doesn't matter. But, like, a password manager, super easy.

Paul: 37:28

Using a privacy focused browser, I. E. Not Chrome, like Brave or Firefox. Even Safari is better using, ad blockers. So all of these things can help, kind of hide your data as best as possible from big tech trying to make money off of all of us without telling us.

Paul: 37:50

Like, and and this is, I guess, kind of the thing. Like, Jack And so, you know, we're not going to be able to do it. We're not going to be able to do it. We're not going to be able to do it.

Susan: 37:57

We're not going to

Paul: 37:57

be able to do it. Money. Right? It's just like you wanna use our software, you pay us for it. That's a

Susan: 38:04

long story. Straightforward transaction instead of trying to figure out Yes. How the company is profiting off of you. Because if you're not paying for it, there's a way they're making money still. They still exist as a company.

Susan: 38:18

Yeah. But trying to figure out,

Susan: 38:19

you know, what their what their business model is and how exactly and what data they're exposing of yours in order to make the money that they're making can sometimes be really difficult to figure out.

Paul: 38:31

Yeah. But I think I think the main thing there is if you're having trouble figuring out how this company makes money, you should be worried about that. Like, if you don't see the revenue model and revenue model should be pretty straightforward for for businesses, if you can't see that pretty quickly, then be scared and think about, well, maybe there's an alternative to this.

Susan: 38:55

Is there anything you think we should talk about, either with

Paul: 39:06

some some really great questions and and brought up, I think, all the the key points that I that I would want to talk about. So, yeah, I think that's good.

Susan: 39:15

Can we talk I just thought of another one.

Susan: 39:17

Sure. So can we talk a little bit about,

Susan: 39:21

kind of the dynamic between wanting data for a feedback loop and, not wanting to track people's data. So I'm thinking specifically with regards to, like, email newsletters. You know, we all want data to say that was good content, that wasn't good content, people paid attention to that or not. And when we decide to lean in the direction of privacy, we inherently give up a little bit of that data that could be valuable, actionable data. So I know you ended up before you kinda killed the newsletter, you weren't tracking in that.

Susan: 40:03

But can you talk me through a little bit of kind of the decision process you went through

Susan: 40:08

to decide that you could give up that level of

Paul: 40:13

data? Yeah. So for my newsletter, it was me sending out, I guess, plain text articles. I didn't need to see what people clicked on or or see where they were in the world. That wasn't a data point that helped my business make money.

Paul: 40:30

Right? And if it is, then maybe you collect that. And I think it comes down to awareness and consent. Right? So, I don't think tracking is wrong if somebody knows about it and consents to it.

Paul: 40:42

Right? Like, if Google told us all of the ways that they collected data about us or Facebook told us all the ways they collected data about us, and then use that to make money, they would be they would be much less evil, in my opinion. If they

Susan: 40:57

They'd probably be a lot less popular. Yes.

Paul: 41:00

Well, they they might be less profitable too, but you never know.

Susan: 41:03

Also.

Paul: 41:04

So if if they did that, that would be a good first step, the the awareness. And then if they gave us a way to opt out of that, and maybe it's well, if you don't want targeted ads, you have to pay us a buck a month or something like that. Like, if I didn't see another ad on Twitter, I would pay for Twitter. It's just like I pay for YouTube because I don't wanna see ads and videos. I watch a I watch a ton of e bike videos on YouTube.

Paul: 41:29

And I pay the I would I would rather pay. And I know they're still tracking me. Like, I'm not naive in that way, but it's just, like, if there was an option, that would be good. And if there was awareness, that would be good as well. So for my newsletter, I I decided that these metrics weren't useful.

Paul: 41:46

And I think this is kind of what GDPR, is trying to get at is these annoying cookie notices is they just want people to be aware of how they are being tracked on the Internet. Right? And one of the reasons why Fathom exists is because if we don't we don't show any of this information on our dashboard, we're GDPR compliant without consent because there is we're not showing all of this stuff about individuals across the Internet, on our dashboard. So I think but I do think those cookie notices, if you are, are useful because I think people just wanna be aware of, what data they're giving up. And then if there is a way to opt out or an option to opt out of that, then then that can be good.

Paul: 42:32

So none of these things are wrong. I don't think targeted advertising is wrong or email newsletters that have that have the spy pixels in them are wrong. I just think that, well, maybe it's worth noting that that that you do that or that you collect information, and put that in, like, the photo of your newsletter. I think that would be if I hadn't turned them off, that's probably what I would have done. It said, hey.

Paul: 42:56

There's a tracking pixel in this newsletter. I use that data to do x. Mhmm. And that's it. And if you don't like it, turn

Susan: 43:01

off images. Or if you don't

Paul: 43:01

like it, use Fastmail who proxies proxies and I just learned this because we interviewed, Fastmail on our podcast. Fastmail proxies all remote images and loads them on their servers. So if I open an email in fast mail, that the the sender of the email doesn't see where I am in Canada. They just see that it was loaded on a server. I don't know wherever their servers are for Fastmail.

Paul: 43:31

Or if I use, hey, Basecamp's email answer to email, those things are also proxied. So I think, yeah, the the awareness and and giving people, an option to opt in to these things instead of having, really obscure ways to opt out if it's even possible.

Susan: 43:51

No. I like that. Alright. I think that's a great place to go ahead and wrap up on. So where can our listeners find, I know not you, but Fathom, if they want to connect and learn more about Fathom or read more about privacy stuff.

Paul: 44:07

Exactly. So I don't really exist on the Internet anymore, but FATH and luckily does. So our website is usefathom.com. Our Twitter is at usefathom. Our podcast aboveboard is if you're listening to this podcast, just look for Above Board and add that as well to your your podcast feed.

Susan: 44:26

It's fantastic. It's one of my favorites.

Paul: 44:27

Thank you very much. Yeah. Jack and I have fun. We try to we try to make it entertaining. So

Susan: 44:33

It is. And even even

Susan: 44:34

though it's about software, ostensibly, it's, I think, much more universal than just 22 guys talking about their software company.

Paul: 44:43

Yeah. I think Jack and I would, we have a flair for the dramatic, which I think is kind of fun. So, yeah, our our website or Twitter and our podcast. And if you search for, I guess, Fathom Analytics on YouTube, yeah, you probably find a couple of videos. I've I've gotta make some more, but I think there's a few videos, right now.

Susan: 45:04

Awesome. Well, thank you so much for coming and talking to me about this. It was really fun.

Paul: 45:08

Yeah. Thanks, Susan. I appreciate it. And this was, yeah, this was great.

Susan: 45:12

For me, the impact of the switch from Google Analytics to Fathom was pretty easy with really no downside. I realized that I didn't need to see anyone's personally identifiable information in order to have actionable data about what pages were performing well on my site or what my website traffic looked like. With Fathom, I ended up with a really easy to interpret data picture, and I got all the information I needed. I realized I wasn't actually using any of that extra stuff that Google Analytics was providing. So this switch was, at least for me, a no brainer.

Susan: 45:46

But that was only because I was already in this experiment. I knew I wanted to prioritize privacy, and I knew Fathom existed because I happened to be on Pulse newsletter, so I was aware of this kind of alternative option. But for a lot of people, having Google Analytics installed on your site is the default. There's an integration and a place for you to plug in that tracking code in just about every app you use in your business, which creates this underlying assumption that you should be tracking everyone, even if you never look at the data that the tracking code produces. But whether or not you use the data you're collecting, you can be damn sure that Google sure does.

Susan: 46:25

Now you heard Paul and I mentioned in the interview that if you're not paying for the product, you are the product. And this is one of those instances. And I am very happy to pay a pretty minimal cost to stop being a product and stop my clients and potential customers from unknowingly being a product through me. And as a bonus, I get to work with this company where I really believe in what they're doing and I get to support that. So part of my motivation in producing this series is to help you realize that there are alternative options to these default assumptions we have about how data tracking and marketing your business are supposed to work.

Susan: 47:03

I'm a big believer that we need to examine the default decisions we make in our business. And when it comes to digital privacy, data tracking, and marketing strategies, we've been told that there's this playbook we're supposed to follow. But hopefully, this episode and the ones that are coming up can help provide some other options so you can make an informed choice for yourself, your clients, and your business. Next week, we're diving into a different aspect of privacy and security. I'm talking to Jessica Robinson about cybersecurity and what we need to be thinking about as business owners to keep us safe from data breaches.

Susan: 47:39

So hit subscribe in your favorite podcast player so you don't miss it. Break the Ceiling is produced by Yellow House Media. Our executive producer is Sean McMullen. Our production coordinator is Lou Blaser. This episode was edited by Marty Seefeld with production assistance by Kristen Runbeck.