hookay notes — engineering and securityNotes is the public notebook of the teams building Hookay. Two tracks: what we learn from attacking our own systems, and what we learn from building them. Privacy engineering for queer platforms is too important to keep proprietary — so everything here is generalized, and free to reuse.https://www.hookay.eu/De-anonymizing the “anonymous”: how location aggregates leak identity, and how to design ones that don'thttps://www.hookay.eu/notes/location-aggregates-leak-identity/https://www.hookay.eu/notes/location-aggregates-leak-identity/Aggregated location stats feel safe — “31 people in this area this week” names nobody. Our internal red-teaming shows how cell size, update cadence, and cross-time correlation can still single out individuals, especially in low-density regions. We walk through the attack classes, then derive concrete design rules: minimum cohort thresholds, net-delta updates, and why suppression must fail closed.Wed, 10 Jun 2026 00:00:00 GMTsecurityresearchWhy we're writing this down before we launchhttps://www.hookay.eu/notes/why-we-write-before-we-launch/https://www.hookay.eu/notes/why-we-write-before-we-launch/Hookay isn't live yet. Starting the engineering notebook now — while the decisions are still warm and nothing is too embarrassing to admit — is itself one of those decisions. What this site is for, what we'll publish during the build, and the editorial rules we're committing to in public.Tue, 02 Jun 2026 00:00:00 GMTengineeringcultureWhy k-anonymity is a floor, not a featurehttps://www.hookay.eu/notes/k-anonymity-floor-not-feature/https://www.hookay.eu/notes/k-anonymity-floor-not-feature/“Each user is indistinguishable from k−1 others” sounds like a guarantee. It is a starting assumption — and treating it as a finished privacy property is how anonymized datasets keep getting de-anonymized. The primer we wish every product spec linked to.Thu, 14 May 2026 00:00:00 GMTsecurityresearchTesting a social app that has no users yethttps://www.hookay.eu/notes/testing-a-social-app-with-no-users/https://www.hookay.eu/notes/testing-a-social-app-with-no-users/Proximity discovery, feed ranking, k-threshold suppression — every core feature of Hookay depends on crowd behavior, and our crowd doesn't exist yet. How we build and test a location-based social product pre-launch: synthetic populations, simulated cities, and the bugs only fake people can find.Tue, 12 May 2026 00:00:00 GMTengineeringdeepdive