Last week, I published a blog post describing how Stripe recorded visitor behavior on their customers’ websites. In short, Stripe’s JavaScript library collected information about URLs users visited and telemetry about their mouse movements, even when the site never displayed any Stripe payment forms. I suspected that most Stripe customers were unaware of this and argued that Stripe should disclose their data gathering practices more prominently and in greater detail.

The post generated a lively discussion on Hacker News, including several comments from Patrick Collison, Stripe’s co-founder and CEO. In his top comment, he said:

After dragging myself out of what I’m dubbing the quarantine slump (namely, playing 100+ hours of Animal Crossing, re-watching Children of Men, and concluding that I’m probably not inside a simulation), I finally published @mlent/gatsby-theme-help-center. It’s the first time I’ve published my own npm package, not connected to work! Well, it’s kind of connected to work because I built this theme because I needed it for my own SaaS product. But you know what I mean.

I’ve read thousands of resumes and CVs during my 3+ years as a hiring manager at a high-growth tech startup. It’s the same at many companies: Most applications land in the bin at the stage where your resume or CV is all the company knows about you. The reason for this is more or less mathematical: It’s simply impossible to speak to every single applicant. The time of hiring managers, tech recruiters, and everyone involved in any given hiring process is finite.

Among startups and tech companies, Stripe seems to be the near-universal favorite for payment processing. When I needed paid subscription functionality for my new web app, Stripe felt like the natural choice. After integration, however, I discovered that Stripe’s official JavaScript library records all browsing activity on my site and reports it back to Stripe. This data includes:

1. Every URL the user visits on my site, including pages that never display Stripe payment forms
2. Telemetry about how the user moves their mouse cursor while browsing my site
3. Unique identifiers that allow Stripe to correlate visitors to my site against other sites that accept payment via Stripe

This post shares what I found, who else it affects, and how you can limit Stripe’s data collection in your web applications.

Highlights

• My loved ones and I are safe and healthy.
• WanderJest is on hiatus due to the nationwide shutdown.
• I’m working on a product to help investors rebalance their portfolios.

COVID-19 and me

Obviously, the most relevant thing to happen in the last month has been the global spread of COVID-19. It has been a difficult and rapidly-changing time for all of us, and I hope that we can all return to normal life quickly when it’s safe to do so.