A message can remain unreadable while its surrounding pattern remains surprisingly informative. The Strava heatmap case made that lesson visible: aggregate activity revealed sensitive locations and routes without publishing anyone's private conversation.
The Strava lesson
Reporting on Strava's global heatmap showed how publicly contributed activity data could expose patterns around military sites. Wired's account makes the principle clear: aggregation and the absence of message text do not automatically prevent sensitive inference.
Patterns can identify people
Frequency, timing, relationships, and unusual combinations can be meaningful even when a single record looks harmless. A person considering a private journal should therefore ask not only “Can the service read my entry?” but also “What trace exists around the entry, and who can query it?”
Journal metadata has a boundary
Protected Memory text, links, and file bytes are encrypted in the browser. The service still needs identifiers, timestamps, protection state, record relationships, and storage references to operate. The end-to-end encryption threat model lists the current boundary rather than treating metadata as an afterthought.
Tags deserve deliberate names
Hashtags are intentionally outside the protected field set. A tag such as #medical-leave, #address-change, or a person's full name can reveal more than a neutral organizing label. This is not a reason to avoid tags; it is a reason to choose names that support recall without unnecessarily describing sensitive circumstances.
Files add operational clues
Encrypted file bytes do not erase every surrounding clue. A service may retain a file's attachment relationship, size, or count, and a user may also expose information through filenames before choosing protection. The encrypted file upload note separates opaque bytes from those remaining side channels.
Make the remaining risk legible
The responsible pattern is not to promise perfect secrecy. It is to encrypt what can be protected, minimize and document the metadata that remains, and keep public sharing separate from protected writing. That lets a writer make a decision based on a real boundary rather than a vague reassurance.