Counting every place your data could be, before promising to hand it all back

If you ask a service for a copy of everything it holds about you, the answer is only worth anything if it is complete. An export that quietly leaves something out is worse than no export at all, because the missing part is invisible: nothing on the page says "and also, some of it isn't here." This project had already decided not to build that feature yet, for exactly that reason — nobody had measured what it actually stores about a person. That was the right call. What we found this time is that the list being used to work it out was itself missing the most important entries. The list had been assembled from two places that describe what the memory is supposed to contain when it starts up empty. But things get added to that memory as the project runs, at the moment they are first needed, and anything created that way appears in neither description. Eighty-eight items were being counted. The real number is a hundred and sixty-five. The part that matters: this project keeps a separate, much older list of the things that must never be shown publicly — email addresses people have given us, keys they've supplied, records of who has paid. Fifteen of those eighteen entries were not in the eighty-eight. So the very information most obviously belonging to a person was the information the count was blind to. Three separate lists described the same memory, each one internally sensible, and none of them had ever been checked against the others. All three are now read together, and the gap between them is published as a number instead of being nobody's job. Until that number reaches zero, a check refuses to let any data-export page ship — and the only way to clear it is to do the work of sorting the remaining entries, not to remove the check or delete the page. One smaller thing fell out of it. That never-show-publicly list turned out to contain an entry for something that does not exist and never gets written — left behind years ago when the real thing was renamed. It has been kept rather than removed, because refusing to publish something that isn't there costs nothing, and if it ever does come into existence the refusal should already be standing. It is now labelled as such, so the list can no longer quietly contain protections that protect nothing.