Drink Buddy

Invisible by default, and visible only to people you accepted

Most apps make privacy a setting you have to find. Here it is the starting state: a user who never opens settings is already private. The interesting part is what that single decision pays for — five other design choices only make sense while it holds.

Invisible until someone is let in

Every object in the product starts invisible. A check-in, a reaction, a comment, a statistic, a location — none of them are reachable until an accepted, mutual, non-blocked friendship exists between two accounts.

That is not a default sitting on top of a public system. There is no public system underneath it: no follower model to switch off, no unlisted mode to misconfigure, and no share link to leak. Privacy here is the absence of the mechanisms rather than a configuration of them.

What a stranger can reach

This is the surface most products get wrong, usually through a preview or a profile page that renders for anyone.

A profile shows four fields to a non-friend.: Avatar, display name, username, and one action: ask to connect. Everything else on that screen is computed only for people who are already friends.
No web page renders your content.: App links do not fall back to a page that shows anything. No preview image, no username in the title, nothing for a crawler or a chat client to unfurl.
The authenticated surface is the only surface.: Aside from health, the legal documents and the deletion request page, nothing answers a request that does not carry a session.

Five other decisions that rest on this one

Each is defensible only while the audience is bounded and self-selected. The dependency is documented so that a future public feed cannot ship without revisiting them.

Decision	Why it holds only while the feed is friends-only
No automatic moderation of photographs	A stranger never sees the image; the audience is one the author chose
Coordinates stored and shown precisely, with no coarsening	A precise home location is visible only to accepted friends
No logging of who viewed a location	The viewer population is bounded and self-selected
A stranger sees only avatar, name and username	There is no public surface for anything more to leak through
No global leaderboard	There is no public ranking surface in the first place

What the feed refuses to do

Home is strictly reverse-chronological. There is no ranking, no algorithmic ordering and no discovery surface, and the tab is described as finite by design — it is meant to run out.

Your own check-ins appear in it alongside everyone else's, which is the cheapest possible confirmation that a publish actually worked.

With no friends yet, the empty state is your own check-ins and an invitation control. Suggested accounts, sample content and popular check-ins were considered and rejected. When friends are simply quiet, the app says so rather than manufacturing something to fill the space.

What this page leaves to others

Each of these has a page of its own, or deliberately no answer.

Exactly what a block does, how it differs from a mute, and what deletion removes.
Whether a coordinate is attached to a check-in at all, and which of four visibility modes applies.
What the statistics compute, and the longer list of what they refuse to compute.
Whether a public feed will ever exist. No such plan is recorded; what is recorded is the condition — five decisions reopened first.

Questions

Can someone who is not my friend see my check-ins?

No. Visibility comes only from an accepted, mutual, non-blocked friendship. A non-friend sees your avatar, display name, username and an add-friend action, and nothing else.

Is there a link I can share with someone outside the app?

No. There is no per-object share link and no web page that renders a check-in. App links carry no preview image, no title containing your username, and nothing for a chat client to unfurl.

Do the people in a group I join see my check-ins?

Only the ones you are already friends with. Group membership grants no visibility of its own — it tells you who else is in the group, and every figure the screen shows is filtered through the usual friendship check.

Can a friend of a friend see anything of mine?

Not your check-ins. They can see that you reacted or commented on a check-in they can already see, which reveals your username and avatar. That is disclosed in the privacy centre rather than denied.