I have a confession to make: I love Vocaloid music.

It's not that I'm terribly bothered to admit it. I've got a small "Hatsune Miku" cassette tape keychain I got from a dacha machine sitting on my desk at work, if anyone looked hard enough to notice. But the difference is I can hide that, choose when to share or when to reveal. I don't necessarily want that to be the first thing someone learns about me.

I started poking at atradio.fm recently and turned on Radio Vocaloid, wanting to see if the mix was any good. I approved and went to click the little heart on the station, only to pause. What... did that button do?

See, atradio.fm is connected to the AT protocol, which means that if I am logged in, certain things are recorded to my account. So was that button to make a public record of my love of Radio Vocaloid? Or was that the purpose of the emoji reaction button right next to it, and the heart was a more private way of recording favorite stations?

Determined to find out, I turned to aturi.to, my preferred tool for viewing my records (and pruning unwanted records). What I found was the below:

  • fm.atradio.favorite — Heart button - timestamp and full station details (name, country, language, genre tags, stream URL)

  • fm.atradio.reaction — emoji reaction - same station details + the emoji picked

  • fm.atradio.actor.status — "now playing" station + exact time you hit play. Only keeps the latest, so self-erasing — but every update goes out live, and anything or anyone listening can keep a history.

  • fm.atradio.audio.settings — EQ, bass, treble. Probably harmless, but indicative of how many things end up public.

That's a lot, and I had to know to look for it to be aware it was on there. Reading the atradio.fm repo's readme didn't give me any of that.

Now, to be clear, I'm not trying to pick on atradio.fm here. This is something I've thought about several times looking at new ATProto apps; atradio.fm just provided the instance I was willing to test. But all these apps generally have the same issue: I don't know when signing up what is being recorded to my PDS, and I often don't want to deal with the trial-and-error to find out.

Haven't we been here before?

I can't help but get this wary feeling of deja vu for the "quantified self" era. There was a whole industry built around data aggregators (like Exist or Gyroscope) that started pulling in data from across your digital accounts. Foursquare check-ins, Spotify playlists, Twitter posts, Fitbit runs... you logged everything, and the aggregator would process it into a pretty dashboard. The data was private, they promised, but of course you were trusting it to corporations. And quietly the advertisements you were shown would... adjust.

As single sign-ons like Google started cropping up, that centralization of data became easier. Personally, I've got three Google accounts: a personal one, a professional one, and a gaming/fandom one with a fake name and details to better distance myself from it. This was my solution to get some control over what data different organizations had on me, but it isn't perfect. Those accounts share computers. It's not impossible to trace them all back to me.

The point of the AT Protocol is, of course, to put the data back into the hands of individuals. You can control what is in your PDS, and I've gone in to delete records before. But that doesn't change the fact that "control" has now come at the cost of privacy. Everything in my PDS is public. I can search for any user on aturi.to and see what's in their record. A single point data alone may be harmless, but that builds into an image. And if I were to tie that to my legal face and name?

Imagine a politician's PDS being scraped and finding they listened to Radio Vocaloid. A very normal, human thing to do, listening to music, but judgements come fast and freely.

"So make a separate account for your private matters" some may say. I've talked before about my frustration about fragmenting my identity across accounts. If this is the only solution, we've just reinvented the wheel.

I'm aware that ATProto Spaces is going to help with this to some degree, making certain data unavailable to the public. But in some ways, that muddies the water further. What records are contained to the Space? What stays public? I need the developers to tell me or must resort to trial and error.

And so, a proposal for the ATProto community

I am not a developer of fancy apps; I'm a tinkerer at best. But I make a lot of websites and think a lot about user experience, and I would like to put out a suggestion to the developers in the ATProto community for a new standard.

If a user's PDS is their digital self, then they need to understand easily what is going into it. They need a nutrition label. That is, they need a page where they can easily understand exactly what aspects of your application log data to their PDS, what that data is, and if that data is public or private to the Space as that becomes an option. Silver star if core functionality can be done without logging in. Gold star if you offer a link to how to remove that content from their PDS, should they choose to later on.

This page needs to be in an easily labeled and located place. Ideally your onboarding process highlights it, so users can view the information before connecting their ATProto account. Putting the information in your repo isn't necessarily a solution either; plenty of people don't understand the concept of a repo, let alone how to navigate one.

I hope that, going forward, this sort of thing might become the norm. In the meantime, I'll be listening to atradio.fm without logging in, just so no one can happen upon my other odd musical preferences.

More content related to this post lives in this Semble collection.