HR & Team

Growing a Business With Digital Privacy as a Priority with Paul Jarvis

How Paul and his partner Jack Ellis navigate the balance of promoting, marketing, and growing a company while still staying true to keeping data secure and while being respectful of individual's data AND transparent about what they're doing.

Susan Boles
February 2, 2021
Quote: "There's all this free software, we can do pretty much everything for free. But what has that cost us? The more people who come to the conclusion and realize that digital privacy is important, the better." - Paul Jarvis

Last summer, I started really thinking about values. What values do I have that I want to make sure I'm building into the DNA of my business? When it came right down to it, I realized that my core value—the one I wanted to make sure lived in every essence of my business—was safety.  

The work I do with clients requires trust and vulnerability. It’s intimate. Money is a touchy, uncomfortable subject for most of us, especially when we're talking in specific numbers. There's SO much shame and guilt and inadequacy for most of us when it comes to handling our finances. Talking about what's not working behind the scenes in your business requires you to admit that everything isn't perfect.

And that can’t happen if people don’t feel safe—both in the real, physical world and psychologically. So, I asked myself: if I want to build a company with the core value of safety, how do I actually go about doing that?

In the last seven months or so, I embarked on this experiment in privacy-focused marketing and data security. It’s been a big part of every marketing and operational decision I’ve made.

All this month, we’re talking about privacy and security on the podcast. It'll be part behind-the-scenes with me sharing some of the actual steps I've taken and how I thought through these decisions for myself. I’ll also be interviewing some of the experts that helped me educate myself along the way.

One of the first things I did was remove Google Analytics from my website and replaced it with a tool called Fathom. It’s a really simple, lightweight privacy-first alternative to Google Analytics.

My guest today is one of the founders of Fathom, Paul Jarvis. Paul and his cofounder, Jack Ellis, are two of my go-to experts on both digital privacy AND on the logistics of how to build that ethos into the DNA of your company. It's a core value for them as well, so they have to navigate the balance of promoting, marketing, and growing a company while still staying true to keeping data secure and while being respectful of individual's data AND transparent about what they're doing.

Listen to the full episode to hear:

  • Why we should care about data privacy—even when we have nothing to hide
  • Balancing privacy with marketing and promoting needs of a growing company while still keeping everyone’s data private
  • Why I decided to swap Google Analytics for Fathom
  • My background in Security Forces for the Air Force and how that informs my approach to safety and security in my business

Learn more about Paul Jarvis:

Episode Transcript

Paul Jarvis (00:00):

If you're not storing and collecting data in the first place, there's no way that that could be breached or hacked or whatever, it's just a safer way to do business. And that data is not needed. Especially when we're talking about website analytics, that data is not needed. We've been running a privacy focus company and it hasn't hurt our business, it hasn't impeded our ability to grow as a company or anything negative.

Susan Boles (00:26):

Last summer, I really started thinking about values. What values do I have that I want to make sure I'm building into the DNA of my business? And when it came right down to it, I realized that my core value, the one I wanted to make sure lived in every essence of my business was safety. I'm Susan Boles, and you're listening to Break the Ceiling, the show where we break down unconventional strategies you can use to save time, boost your profit and increase your operational capacity.

Susan Boles (00:58):

Most of my work with clients is intimate. Money is a touchy, uncomfortable subject for most of us, especially when we're talking in specific numbers. I've had people tell me they'd rather be naked in front of a stranger than show them their business books. And there's so much shame and guilt and inadequacy for most of us when it comes to handling our finances. Letting someone into that requires vulnerability. Talking about what's not working behind the scenes in your business requires you to admit that everything isn't perfect. And in an Instagram world where we're expected to project that we're all fabulously okay every day, that's just uncomfortable.

Susan Boles (01:40):

I think that's probably one of my favorite silver linings to come out of all of the crap that was 2020, that it's starting to be okay to admit that we're not all okay. But the point here is that the work I do with clients requires trust and vulnerability, and that can't happen if they don't feel safe, both in the real physical world and psychologically safe. So, if I want to build a company with the core value of safety, how do I actually go about doing that?

Susan Boles (02:11):

Now, you may or may not know this about me, but both my undergrad and my first master's degrees are actually in criminal justice. I started my career out as an Air Force security forces officer, and then later served as one of the senior anti-terrorism advisors to a base commander when I was a civilian. It's been quite a while since I've used those degrees professionally, but the training and the awareness of safety, of security is something that I honestly just can't turn off. It's something that's always running in the back of my mind. And during my work as an anti-terrorism advisor, we focused on prevention, making sure that troops didn't accidentally make themselves target, and we tried to help them keep themselves safe by encouraging awareness of the risks.

Susan Boles (02:59):

So, thinking about safety from a security perspective feels pretty logical to me. And so, part of creating a safe environment means creating a secure environment for all of the data and the information that I handle. I work with financial data, bank accounts and confidential business plans, and the bare minimum level of safety for my clients is to feel confident that I can keep that information secure. Now, at the same time I was thinking about all of this, I was also starting to really think about all of our personal data that lives out on the internet.

Susan Boles (03:34):

This was happening at about the same time that the Stop Hate For Profit campaign was gaining ground, which is a campaign to convince social media companies to take more action to moderate online hate groups and hate speech. And we were also talking about TikTok being banned because of privacy concerns. I was starting to get more curious and concerned about how my own data was being used and tracked by Facebook, Google, Amazon, and I was getting a lot less comfortable with using social media to grow my own business. I even did an episode with Nancy Jane Smith and Bonnie Gillespie back in September, it's episode 48 if you want to go check it out, exploring this idea of how to ethically use social media, or if you even needed to use social media in your business.

Susan Boles (04:19):

So all of this kind of led up to me asking the question, if I were to market and operate my business with a deep respect for individual data privacy as the first step towards building safety and security into the DNA of ScaleSpark, what does that actually look like? So I embarked on this experiment in privacy focused marketing and data security and for the last seven months or so, that's been a big part of every marketing and operational decision that I've made, and I wanted to share my journey with you.

Susan Boles (04:50):

So this month we're talking all about privacy and security. It will be part behind the scenes with me sharing some of the actual steps I've taken and how I thought through these decisions for myself and also interviews with some of the experts that helped me educate myself along the way. I'm kicking off the theme where I kicked off my experiment with removing Google Analytics from my website and replacing it with a tool called Fathom. Fathom is a really simple, lightweight, privacy first alternative to Google Analytics.

Susan Boles (05:21):

I started here because honestly it was the easiest step for me. It took about 10 minutes. I removed the Google Analytics tracking code, replaced it with the Fathom code and bam, no more personal tracking on my website. As an added bonus, because of the way Fathom does tracking, I could also take the cookie notice down from my website because I wasn't invading anyone's digital privacy anymore, so I didn't need to notify them that I was. So one less pop-up to have to deal with. Throughout this experiment and my research into data privacy, the Fathom blog has also been a fantastic resource to explain the often complex world of digital privacy in a really human way.

Susan Boles (06:01):

My guest today is one of the founders of Fathom, Paul Jarvis. Paul and his co-founder, Jack Ellis, are two of my go-to experts on both digital privacy and on the logistics of how to build that ethos into the DNA of your company. It's a core value for them as well. So they have to navigate the balance of promoting, marketing and growing a company while still staying true to keeping data secure and also being respectful of people's individual data and being transparent about what they're doing. Paul and I talk about why you should care about digital privacy, even if you have nothing to hide, and we talk about how to balance the marketing and promotion needs of a growing company while still keeping everybody's data private.

Susan Boles (06:48):

Hey Paul, thanks for being here.

Paul Jarvis (06:49):

Yeah, thanks so much for having me on the show, Susan.

Susan Boles (06:52):

Fathom is a privacy focus company, but a lot of my audience isn't necessarily familiar with kind of what that means. What does being privacy-focused as a company mean to you?

Paul Jarvis (07:04):

I guess the long and short of our business model is selling software and not selling data. And I guess I'll start there because a lot of the software that we use on the internet like social media or even things like Google Analytics are free because their business model isn't charging customers money for that software, it's making money off of people in other ways. So we charge a fair price for our software, meaning we don't need to sell data, we don't need to collect data. Basically I think it's a more upfront business model. We have a fair priced software that people pay us to use.

Paul Jarvis (07:46):

We also don't show any personal information about visitors for the analytics software that we provide. So you can see information about your website without learning a ton about the actual individuals who are visiting your site, which I think is kind of invasive. And I guess the last point about being privacy focused is that we comply with privacy laws. And I think privacy laws are actually a good thing even though they can get a little in the weeds. So things like GDPR, CCPA, PECR, all of the I guess four letter acronym privacy laws, our software complies with because we don't show personal data in our software. Yeah, I guess that's all the things that privacy focused means.

Susan Boles (08:35):

Yeah, basically the way I always like to think about it is if you're not paying for the product, you are the product.

Paul Jarvis (08:42):


Susan Boles (08:43):

At least for me, one of the things I did at ScaleSpark this year was trying to kind of embark on this, I guess, attempt to see if it's possible to grow a marketer business still being respectful of privacy and the privacy of my clients and the people that work with me, and Fathom was the easiest part of that to implement, was just to kill Google Analytics and install Fathom. But kind of the idea around digital privacy and paying attention to who has our information, paying attention to what they're doing with that information was an important part of what I was trying to accomplish with my business. But why do you think we should care about digital privacy? Why should we care what people are doing with our data?

Paul Jarvis (09:34):

I mean, for me I think it's really important. And even if you look at the news, the company Cambridge Analytica has shut down because they wouldn't release the data of a single person. Like that's how important invading people's privacy was to them. So I think if your listeners are new to digital privacy or if they think, "Oh, maybe this doesn't matter," and this is kind of the common thing. Maybe you think, if you're listening, "Well, I have nothing to hide," because you're a law abiding, wonderful citizen of the internet.

Paul Jarvis (10:08):

I can certainly understand the reasoning of if you're not doing anything wrong you shouldn't have anything to hide, but that logic can be uninformed and it can actually be dangerous. Researchers have coined this term called social cooling, kind of like the opposite of global warming but relating to how we act as human beings to describe what happens when we feel like we're constantly being watched. Like even if we're doing nothing wrong, there's a change in our behavior that happens when there's just vast amounts of data being collected about us at all times.

Paul Jarvis (10:47):

How social cooling works is that since all of our data is constantly being watched and collected in mind and stored and turned into scores and data points and targeted ads, it makes us change because we don't want those things to impact us. We know that if we say something wrong, say on social media, that we could get fired or something worse. And so, all of this data that's collected about us creates this sort of digital reputation that could potentially limit our opportunities in life and work and social situations. And even things like if you return goods to a store, you're at higher risk of being considered a fraudster.

Paul Jarvis (11:29):

All of this data is being collected at all times, and that could affect things like applying for a loan in the future. And so, because we know that we're being graded and judged, it changes how we interact and what we do and what we say, and this creates pressure to not have opinions that rock the boat or dissent, and it breeds this kind culture of conformity where we're less likely to take risks, we're less likely to think outside the box, or kind of just it makes it so we act different. It's just like people on the show, The Bachelor. They're not acting like real human beings, they're acting like people who know that they're on camera.

Paul Jarvis (12:12):

So, thinking about digital privacy means that we don't want all of this data collected about us and socially cool how we act on the internet. So saying that we have nothing to hide, and this is such a soapbox for me, but saying that we have nothing to hide, it can also be a bit of a privileged statement and view as well because a lot of us who feel that way are lucky enough to live in democratic countries. And so in other countries, and this is kind of data that corporations get that they then sell to governments, minorities need privacy in some countries to shield themselves from social government repercussions.

Paul Jarvis (13:01):

So people with different sexual orientations, religious minorities, even people who just question political leaders where it's illegal to do that need safety and digital privacy. And without privacy, nefarious governments or corporations could basically round up everyone who feels a certain way or votes a certain way or talks about things a certain way, and do lasting damage to them. So I think for all of those reasons and more, that's why digital privacy is important, even if you're just a normal, law abiding internet human being.

Susan Boles (13:37):

Yeah. That totally makes sense. It's interesting that you bring up kind of the safety issue because that's actually what led me to focus on privacy marketing was this idea that one of my core values, because I deal with a lot of financial stuff, was that people needed to be able to trust me and that trust needed to be held and cherished. And one of the ways that I wanted to respect that was respecting their digital privacy and not tracking what they did on the website or what they were doing. And so, it's interesting that you bring that up because that was actually the trigger for me to kind of head down this path was wanting people to feel safe when they were dealing with me.

Paul Jarvis (14:24):

Interesting. And that's really valid too, right? I think that the point of data existing on the internet isn't a matter of like if it could be hacked or if it could be released. It's almost a matter of when. If you punch your email address into services like Have I Been Pwned, then you can see. If I punch my email address in there now, that email address is associated with I think 237 breaches of data. So, I think if you're not storing and collecting data in the first place, then there's no way that that can be breached or hacked or whatever. It's just, it's way safer. It's just a safer way to do business.

Paul Jarvis (15:05):

And that data's not need, especially when we're talking about website analytics, that data is not needed. We've been running a privacy focused company and using Fathom for years now and it hasn't hurt our business. When we talk about marketing, I know you want to, but that hasn't hurt our business, it hasn't impeded our ability to grow as a company or anything negative. We know everything we need to know about our website. We just don't know the things that aren't useful to us about the people who are visiting it, and same with all our customers that use Fathom as well, it's the same thing.

Susan Boles (15:39):

Yeah. I have no need to know who is hitting my content, but I do like being able to tell what content is more popular? Where are people showing up? What is drawing people in? And that's valuable information and it's actionable. I mean, I'm a data geek, I love data, but only data that you could actually do something with. Knowing the individual person isn't something that I want to know or want to act on necessarily.

Paul Jarvis (16:07):

And that's kind of the thesis of Fathom is that the data in aggregate in this case can be just as useful as like if you post this interview with me on your website and see that it becomes the most popular page on your site, then you'll have more nerds like me on your show and you can use that and that helps the podcast and everything else.

Susan Boles (16:26):

I will say my top episode is super nerdy. Project management nerd out on ClickUp versus Notion, so super nerdy, and people love that. So let's talk about kind of the marketing aspect of this that I think comes up for most business owners, which is that our kind of common wisdom is that you need to be tracking people and personalizing information and active on social media to be able to grow your business. You and Jack still needed to promote and grow Fathom, but pretty much all the organic tools you have at your disposal have tracking included in them and they sell data that's built into their business model. So, talk to me a little bit about how you decided to promote or advertise Fathom when you were kind of balancing the need to grow your business but you didn't want to compromise your privacy first values.

Paul Jarvis (17:29):

For sure, and that's a great question because the way that we run Fathom isn't... Privacy isn't just a marketing gimmick that we have. Privacy is baked into every single thing we do, every decision we make since day one. We have grown about 600% this year alone. And in case anybody didn't know, through a pandemic. So things have definitely been going well, and we've done things like never buying targeted ads, right? So I'll walk you through, I guess, probably the five things that we do as a privacy focused company that still markets our product effectively, grows our business and gets our name out in front of people. Actually, let me ask you a question. How do you find out about Fathom?

Susan Boles (18:15):

I think through your newsletter. It's been awhile. I'm pretty sure it was through your newsletter.

Paul Jarvis (18:25):

Okay. That's awesome. And so people are able to find us because we do things like, well, the newsletter that I used to have, Sunday Dispatches, which was just my personal newsletter, wasn't really Fathom unrelated, but that was one kind of distribution method that I had. Another thing is our podcast, Above Board. We don't have sponsors of the show because our company is a sponsor. The show was really just Jack and I nerding out about what it takes to run a business. The other thing we do is have a blog on our website where we write articles both about our software and just about privacy and dealing with having a software company. I think our most popular article was Jack's article about our company being attacked with the DDoS attack.

Paul Jarvis (19:23):

We also have our Twitter account. So we are actually active on Twitter. Jack handles the Twitter account. And it's not just pitching either. It's not just us using social to tell people about Fathom, it's us interacting and engaging with a greater community who are interested in software and privacy. We're also constantly releasing features. So every time we release a feature, we talk about it on the blog, we put it on Twitter, we write an article about it, and that gives us something to talk about and it also gives our customers something to talk about and our audience something to talk about and our affiliates, which I guess is the fifth or sixth.

Paul Jarvis (20:07):

Fifth, I think, thing is that our affiliate program has been a great way to grow our business and we pay 25% commissions for life. So, if an affiliate refers a customer and that customer sticks around for five years, we pay the affiliate 25% of their bill for five years. So if they stick around forever, then forever. And the final thing is word of mouth, and that's not just a... I think this is where a lot of people get it wrong. Word of mouth and reputation isn't a passive thing. It's very much something you need to actively work on. So for us, it's having the best software on the market that's easy to use, makes sense, simple, you just get it. If you look at the demo, you just get it.

Paul Jarvis (20:54):

The second part of that is making sure that we're keeping our customers happy. We spend a lot of time on support and support is me and Jack. If you email support, you're going to get a co-founder replying, and we try to reply as quickly as possible. And so, all of these things we try to do because it helps with word of mouth and it helps reduce churn. There was some study done where it costs five times more to get a new customer than to keep an existing customer. And because we're in a subscription business, it saves us so much money and time to just make sure that the people who are already paying for us are happy. So, we do focus on acquisition, but we really, really focus on retention.

Paul Jarvis (21:44):

And so, all of those things are what's led us to some really good organic growth through the last couple of years. This year especially, it's been a tough year and if we've still managed to grow the business pretty steadily.

Susan Boles (22:00):

You forgot about the cats, which I really appreciate that they have names now. I'm just saying, I like the cat names.

Paul Jarvis (22:08):

That's part of having a brand that has uniqueness. People remember the cats. We have all over print cat hoodies that people treat... And we don't even sell those, but we've... I mean, I have one, Jack has one and a couple people have got them, but people want those things and people will talk to us about them. People remember the photos that we posted of these silly cat hoodies on the internet, and is part of just building a memorable brand. Jack and I like to have fun. The reason we run our business is because we can just be real people running a business. There's no legal team that we have to run ideas past. We can just be normal human beings in how we connect with others and it works and it helps.

Susan Boles (22:56):

You all did something I think is pretty interesting when you decided to kind of start making YouTube videos. You had a really interesting episode of Above Board where you talked about it, but can you talk me through kind of the decision process that you went through to decide that YouTube was viable, and how you were going to balance the fact that YouTube tracks everybody in, there's no way to avoid that, and balancing respecting the privacy of your users and people that want to watch the videos.

Paul Jarvis (23:29):

For sure. I mean, YouTube is part of Google and Google is I guess our marketing nemesis. So the kind of the thought process we had was, one, we wanted to make videos both in terms of technical support videos, like if I can walk somebody through doing something in Fathom and they can see my screen and see what I'm clicking on and see what I'm typing, fastest way to teach anybody how to use something on the internet. I've taught courses for years, I 100% know and get this. And the other side of it is videos are fun. Both Jack and I like to do things like that.

Paul Jarvis (24:12):

YouTube is a place where people go to watch videos, like it or not. We could put our videos on Vimeo, nobody would find them. It wouldn't be a marketing channel because the only people that would find the videos if we put them anywhere other than YouTube was people who were already on our website. So we wanted to use videos as a channel for brand awareness and getting new people. YouTube is the only place to do it, whether or not you like them.

Paul Jarvis (24:40):

So what we did, and I guess at the same time we were like, well, we don't like Facebook collecting all of this data that tracks you across the internet. So we made these I guess kind of landing pages. So if we link to a YouTube video from our Twitter, from our website, from anywhere, it doesn't go straight to YouTube. It goes to a landing page on our site which then connects to YouTube and it strips all of the personal data. So all YouTube can do is track you on YouTube, which isn't actually like tracking somebody in a thing that they're using is far less evil than tracking somebody across the entire internet.

Paul Jarvis (25:22):

So we made these pages and we're always trying to think of things like this where, okay, we do care about privacy and privacy is our top priority, but we also exist in the real world where YouTube is kind of a big deal. YouTube is the place where people go to find videos, not just watch videos. So that's kind of what we did where, yeah, you're still using YouTube. But if you're using YouTube anyways, then you're already on their platform. But we didn't want to give YouTube additional information about people we were sending their way. So we made these landing pages instead, and that feels like a good way and a good balance to share YouTube videos and get discovered on YouTube but also try to do what we can on our end to protect the privacy of people who want to watch our videos.

Susan Boles (26:14):

Yeah. I love the idea that you guys, you still exist in the real world and you still exist in the world of the internet that is controlled by pretty big companies that it's really hard to work around. It's hard to find alternatives to a lot of these services like YouTube. There isn't a Fathom version of YouTube.

Paul Jarvis (26:39):

Exactly. And not one that has the hundreds of millions or billions of users too. So, yeah, it's part of balancing. We don't want to be so private that it doesn't make sense in the real world, but anything we can do to be more private that keeps things actually usable and doable and not something that you have to go to the terminal command line to type in some co... We just want to make things easy. So if we can make the easy thing as private as possible, then we're all for it.

Susan Boles (27:15):

It's that time of year, time to set some new goals or consider your new year's resolution. And if you're like a lot of business owners I know, you might be thinking that this is the year you're going to get your shit together when it comes to your money. You're going to start reviewing that P&L statement you get every month, you're going to be more intentional about how you spend, and closely tracking the ROI you're getting. You're going to get clear on exactly how you're making money and how you can make more of it without working yourself into the ground. Now, if you're both nodding your head and feeling the anxiety rise in your chest as I describe these financial goals, I see you. We all have the best of intentions about how we're going to manage our business finances, but few people actually follow through on learning how to manage their business's money or execute the financial plans they create.

Susan Boles (28:09):

You want to feel like you're on top of your money stuff, but it's tough to climb over all the questions and reports and bank accounts and spreadsheets. That's where I come in. I help you Think Like A CFO. Working together, you'll learn the skills you need to confidently make database decisions about how to spend your money and how to structure your business so you make more. You'll build a more resilient business that's efficient and easy to run, and you'll create meaningful financial processes so you're never caught with your pants down again.

Susan Boles (28:42):

Think Like A CFO is a six-month accelerator online workshop and coaching program that will teach you to think about your business like a CFO would, will cover six core topics including risk and resilience, investing in your business, scaling sustainably, and your relationship with money. You'll also get dedicated implementation time and live support so you don't get stuck on the details or the execution, and you'll get a clear path to true small business financial literacy so you can connect your money to every other aspect of your work, from daily operations to long vacations. Think Like A CFO is enrolling right now and when you register before December 31st, you'll also get my course, Not Rocket Finance, which is the perfect primer for Think Like A CFO. To find out more about Think Like A CFO and finally get your business shit together, go to

Susan Boles (29:45):

Fathom, you guys recently survived a DDoS attack, which is basically like a spam attack on your service where they overwhelm your servers with a bunch of traffic. You and Jack run a very small company, pretty much just the two of you. So there's not a lot of surge capacity to handle something like that. So, can you talk me through a little bit about how you all handled the attack and how you decided to move forward to give yourselves that capacity to surge without scaling up the size of your company?

Paul Jarvis (30:17):

And both Jack and I are kind of on the same page with running a small and lean company. I mean, I wrote a whole book called Company of One that talks about the methodology of running a small company that questions growth, but it also doesn't mean that we're against growth, and kind of what I mean by that in this situation is that because the company is just Jack and I, neither of us want to be on call to handle server spikes. We run a serverless business. So all of our software runs on AWS, which is basically, that powers almost the entire internet from Amazon.

Paul Jarvis (30:55):

And so our servers scale as needed. I think it was two months ago one of our customers was getting 10 million page views a week or something like that, and our servers just kind of scale up. And as it's needed, they just grow and then shrink back down. So we don't have to spend time on the server administration side because Jack is an amazing programmer but doesn't want to deal with servers. It is kind of a different skillset, which he can do but he'd rather not, and I don't blame him, dealing with servers is annoying.

Paul Jarvis (31:32):

So all of our stuff runs on enterprise level architecture as far as the actual computers that power our software, which is good because like I said, it scales. But it's also bad because when somebody... It's really hard to hack companies nowadays unless they do stupid things like save all of their passwords in a plain text file on their server. But it's really easy to just send gobs of traffic at a server to try to bring it down, which is what a targeted DDoS attack is, is just sending as much traffic and volume at a server as possible in hopes that it'll take it down.

Paul Jarvis (32:11):

And so because, like I said, ours scale as needed, ours just kept scaling up as the attack ramped up, which is good because it kept our customers online, but bad because it caused us a ton of money, like a ton of money. And so we needed to figure out a way. And so the attack, while it was targeted and malicious against us and... I mean, we're a tiny company, I don't know why... Well, I mean, I can't really talk about that. But it's silly that that happened, but it was good because it helped us iterate and make our software better because we've now been able to create ways that blocks these kind of attacks. And yeah, it costed us money but our software is now better and more resilient because we're able to deal with these things in a much better way.

Paul Jarvis (33:06):

So if it happens again in the future, like I was talking to Jack, and this probably started about five, six weeks ago from you and I recording this. The attack happened again I think three weeks ago. And the only reason we knew is because I asked Jack on Monday morning because the attacks always seem to happen on a Saturday. And I asked Jack, I'm like, "Hey, did we get attacked on the weekend?" And he was like, "I don't know, let me check." He was like, "Yeah, I guess we did." But because we had set up all of these protections and firewalls and all sorts of other nerdy stuff, we didn't even notice. So we were able to make our software better.

Paul Jarvis (33:42):

That's part of existing on the internet is having to deal with stuff like that. And yeah, it cost us a bunch of money but it's also why it's good and healthy for a business to have margins. We were able to absorb the costs and not dip into the red in dealing with something unforeseen. So yeah, it sucked that it happened, but we're better off forward and it ended up becoming a positive because our software is more resilient, and it's still just Jack and I doing it. So we hired a specialist. It's like the A team at AWS. I think they're called AWS Shield. It totally sounds like-

Susan Boles (34:23):

I think they should be called the A team. I feel like it would be better.

Paul Jarvis (34:28):

I think they're kind of going for that superhero vibe. That was just something that we didn't need to hire a person full-time to help us with this, we just needed to hire the best consultants on the planet who deal with this on a regular basis to help us through that. So yeah, that's how we dealt with that.

Susan Boles (34:48):

And you actually, you did the same kind of strategy with your legal team too, right? You have a legal consultant that you work with?

Paul Jarvis (34:56):

Yeah. We have a privacy officer, Rie, who is the smartest person we know who deals with European privacy law because for some reason Jack and I, that's not something we ever studied, being in a software business.

Susan Boles (35:11):


Paul Jarvis (35:12):

No. So yeah, we have her on contract. She's the smartest person on GDPR we've ever met, but she also has... She's not a lawyer, so she has legal resources that she can bring in. So we kind of scale and shrink our team as needed with consultants, and we would rather pay somebody as a consultant who is the best in the business or the best in their field of expertise for help for a little bit than have to think about hiring somebody and dealing with all the things that come with having full-time employees. It's not something that we need at this moment. It could change, like we're not against it in the future, but we would rather solve problems in the best way than just throw growth or more at the problem.

Susan Boles (36:06):

Talk to me a little bit about digital privacy as a whole, where you see kind of the industry or the concept going. What do you think the biggest challenge is to digital privacy right now and what should we, either as business owners or just as people, going to be looking out for?

Paul Jarvis (36:25):

I mean, three years ago, I would've said awareness. Like it was just the tinfoil hatters like myself who cared about this stuff. But it has become part of the normal conversation now, which I think is amazing. I think it's great that it's in the news every time Facebook and Google and whatever other big tech company's CEO has to go in front of Congress and testify about breaking social contracts with all of us and breaking our trust through abusing privacy. So I think that now that we're all aware of it, that's a great thing, that's a great first step.

Paul Jarvis (37:09):

I think that the next thing, and like you said at the beginning, if you're not paying for the product, you are the product. So I think we need to think about all of the things we trade for free software, because we trade data for free software. We trade our privacy for free software. We trade protection for free software. Is it worth it? I mean, maybe it is sometimes, but I definitely don't think always. So I think thinking about, okay, well, maybe I want to market my business somewhere other than Facebook, or maybe I want to have website analytics that aren't part of big tech.

Paul Jarvis (37:50):

Google doesn't offer analytics for free because they're nice and they like you. That would be cool, but I mean, they're a multi-billion dollar company. They offer free products because they make more money off of us in other ways that they just don't tell us. And so I think we've kind of got, and this is kind of why the internet exploded is because there's all this free software. We can do pretty much everything for free. But it's like, okay, well, what has that cost us? And I think that the more people who are kind of coming to that conclusion and kind of realizing why digital privacy is important, the better.

Paul Jarvis (38:29):

And then seeing that there are other options, like whether it's Fathom, whether it's something else, whether it's Fastmail instead of Gmail for email, I think is important. And then on the consumer side of things, I think finding ways to hide or obfuscate our personal details when we're using the internet is really good. And these things luckily have become so much easier nowadays. So things like using a VPN, super straightforward, things like using a password manager, like 1Password or LastPass, whatever it is, doesn't matter, but like a password manager, super easy.

Paul Jarvis (39:08):

Using a privacy-focused browser, i.e., not Chrome, like Brave or Firefly, even Safari is better. Using ad blockers. So all of these things can help kind of hide your data as best as possible from big tech trying to make money off of all of us without telling us. And this is, I guess, kind of the thing. Jack and I aren't anti-capitalism. We love making money. We love growth. We love having a healthy business, but we'd rather just be upfront about how we make money. It's just like, you want to use our software, you pay us for it.

Susan Boles (39:44):

It's a very straightforward transaction instead of trying to figure out how the company is profiting off of you; because if you're not paying for it, there's a way they're making money still. They still exist as a company. But trying to figure out what their business model is and how exactly, and what data they're exposing of yours in order to make the money that they're making can sometimes be really difficult to figure out.

Paul Jarvis (40:11):

Yeah. But I think the main thing there is if you're having trouble figuring out how this company makes money, you should be worried about that. If you don't see their revenue model, and revenue models should be pretty straight forward for businesses, if you can't see that pretty quickly, then be scared and think about, well, maybe there's an alternative to this.

Susan Boles (40:35):

Is there anything you think we should talk about either with regard to marketing or privacy-focused marketing, or just privacy in general, that we haven't talked about yet that you think we should?

Paul Jarvis (40:45):

I don't think so. You've asked some really great questions and brought up, I think, all of the key points that I would want to talk about. So yeah, I think that's good.

Susan Boles (40:56):

I just thought of another one.

Paul Jarvis (40:57):


Susan Boles (40:58):

Can we talk a little bit about kind of the dynamic between wanting data for a feedback loop and not wanting to track people's data? So I'm thinking specifically with regards to like email newsletters. We all want data to say that was good content, that wasn't good content, people paid attention to that, or not; and when we decide to lean in the direction of privacy, we inherently give up a little bit of that data that could be valuable, actionable data. I know you ended up, before you kind of killed the newsletter, you weren't tracking in that but can you talk me through a little bit of kind of the decision process you went through to decide that you could give up that level of data.

Paul Jarvis (41:54):

Yeah. So for my newsletter, it was me sending out, I guess, plain text articles. I didn't need to see what people clicked on or see where they were in the world. There wasn't a data point that helped my business make money. And if it is, then maybe you collect that. And I think it comes down to awareness and consent. So, I don't think tracking is wrong if somebody knows about it and consents to it. If Google told us all of the ways that they collected data about us or Facebook told us all the ways they collected data about us, and then use that to make money, they would be much less evil in my opinion.

Susan Boles (42:37):

They'd probably be a lot less popular.

Paul Jarvis (42:39):

Yes. Well, they might be less profitable too, but you never know. So if they did that, that would be a good first step, the awareness, and then if they gave us a way to opt out of that. And maybe it's, well, if you don't want targeted ads, you have to pay us a buck a month or something like that. Like if I didn't see another ad on Twitter, I would pay for Twitter. It's just like I pay for YouTube because I don't want to see ads in videos. I watch a ton of eBike videos on YouTube and I pay them. I would rather pay. And I know they're still tracking me, I'm not naive in that way. But it's just like if there was an option, that would be good. And if there was awareness, that would be good as well.

Paul Jarvis (43:20):

So for my newsletter, I decided that these metrics weren't useful. And I think this is kind of what GDPR is trying to get at is these annoying cookie notices, is they just want people to be aware of how they are being tracked on the internet. And one of the reasons why Fathom exists is because if we don't show any of this information on our dashboard, we're GDPR compliant without consent because we're not showing all of this stuff about individuals across the internet on our dashboard.

Paul Jarvis (43:56):

But I do think those cookie notices, if you are, are useful because I think people just want to be aware of what data they're giving up. And then if there is a way to opt out or an option to opt out of that, then that can be good. So none of these things are right. I don't think targeted advertising is wrong or email newsletters that have this spy pixels in them are wrong. I just think that, well, maybe it's worth noting that you do that or that you collect information and put that in like the footer of your newsletter. If I hadn't turned them off, that's probably what I would have done is said, "Hey, there's a tracking pixel in this newsletter. I use that data to do X," and that's it.

Paul Jarvis (44:42):

And if you don't like it, turn off images. Or if you don't like it, use Fastmail who proxies, and I just learned this because we interviewed Fastmail on our podcast. Fastmail proxies all remote images and loads them on their servers. So if I open an email in Fastmail, the sender of the email doesn't see where I am in Canada, they just see that it was loaded on a server, I don't know wherever their servers are for Fastmail, or if I use HEY, Basecamp's answer to email, those things are also proxied. So I think, yeah, the awareness and giving people an option to opt in to these things instead of having really obscure ways to opt out if it's even possible.

Susan Boles (45:31):

No, I like that. All right. I think that's a great place to go ahead and wrap up on. Where can our listeners find, I know, not you but Fathom if they want to connect and learn more about Fathom or read more about privacy stuff.

Paul Jarvis (45:47):

Exactly. So I don't really exist on the internet anymore. But Fathom luckily does. Our website is Our Twitter is @UseFathom. Our podcast, Above Board, is... If you're listening to this podcast, just look for Above Board and add that as well to your podcast feeds.

Susan Boles (46:06):

It's fantastic. It's one of my favorites.

Paul Jarvis (46:08):

Thank you very much. Yeah, Jack and I have fun. We try to make it entertaining.

Susan Boles (46:13):

It is. And even though it's about software, ostensibly it's I think much more universal than just two guys talking about their software company.

Paul Jarvis (46:23):

Yeah. I think Jack and I, we have a flair for the dramatic, which I think is kind of fun. So yeah, our website, our Twitter and our podcast. And if you search for, I guess, Fathom Analytics on YouTube, you'll probably find a couple of videos. I've got to make some more, but I think there's a few videos right now.

Susan Boles (46:44):

Awesome. Well, thank you so much for coming and talking to me about this. It was really fun.

Paul Jarvis (46:49):

Yeah. Thanks Susan. I appreciate it. Yeah, this was great.

Susan Boles (46:53):

For me, the impact of the switch from Google Analytics to Fathom was pretty easy with really no downside. I realized that I didn't need to see anyone's personally identifiable information in order to have actionable data about what pages were performing well on my site or what my website traffic looked like. With Fathom, I ended up with a really easy to interpret data picture, and I got all the information I needed. I realized I wasn't actually using any of that extra stuff that Google Analytics was providing. So this switch was at least for me a no-brainer.

Susan Boles (47:26):

But that was only because I was already in this experiment. I knew I wanted to prioritize privacy and I knew Fathom existed because I happened to be on Paul's newsletter, so I was aware of this kind of alternative option. But for a lot of people, having Google Analytics installed on your site is the default. There's an integration and a place for you to plug in that tracking code in just about every app you use in your business, which creates this underlying assumption that you should be tracking everyone, even if you never look at the data that the tracking code produces. But whether or not you use the data you're collecting, you can be darn sure that Google sure does.

Susan Boles (48:05):

Now, you heard Paul and I mention in the interview that if you're not paying for the product, you are the product. And this is one of those instances. And I am very happy to pay a pretty minimal cost to stop being a product and stop my clients and potential customers from unknowingly being a product through me. And as a bonus, I get to work with this company where I really believe in what they're doing and I get to support that.

Susan Boles (48:30):

So, part of my motivation in producing the series is to help you realize that there are alternative options to these default assumptions we have about how data tracking and marketing your business are supposed to work. I'm a big believer that we need to examine the default decisions we make in our business. And when it comes to digital privacy, data tracking and marketing strategies, we've been told that there's this playbook we're supposed to follow. But hopefully this episode and the ones that are coming up can help provide some other options so you can make an informed choice for yourself, your clients and your business.

Susan Boles (49:07):

Next week we're diving into a different aspect of privacy and security. I'm talking to Jessica Robinson about cybersecurity and what we need to be thinking about as business owners to keep us safe from data breaches. So hit subscribe in your favorite podcast player so you don't miss it. Break the Ceiling is produced by Yellow House Media. Our executive producer is Sean McMillan, our production coordinator is Lou Blaser. This episode was edited by Marty Seefeldt with production assistance by Kristin Runvik.


HR & Team