Honest & Calm. Software people are glad they used.

Warm-up: what do you already notice?

Before we name anything, test your instincts. You have spent years on the receiving end of these designs: the subscription that would not die, the cookie banner with one big green button, the app that pings you at 9:47 pm with "You have new activity!". You already know a lot. The goal of this guide is to turn that vague irritation into precise vocabulary and, more importantly, into design decisions you make on purpose in your own product.

How to study this guide: read one Part per sitting. Do the quizzes before reading the explanation. Do at least the exercises marked "on your own product", because ethics you have not applied to your own work is just opinion. The four Parts build on each other: honesty (not tricking people), calm (not exhausting them), trust (not exploiting their data or their future), and responsibility (not harming them or others).

An honest product shows what it is, does what it says, and costs what it claims. Every gap between what the interface implies and what is true is a lie, even if no sentence in it is false.

Rams wrote his ten principles of good design while he was head of design at Braun. Two of them frame this whole guide. The sixth: good design is honest. In the version Vitsœ publishes, it does not make a product appear more innovative, powerful or valuable than it really is, and it does not try to manipulate the consumer with promises that cannot be kept. The seventh: good design is long-lasting. It avoids being fashionable, and therefore never appears antiquated. We come back to longevity in Part 3. Here, honesty.

For a physical object, honesty is mostly about form. A radio should not pretend to be a piece of furniture; a plastic part should not be painted to look like metal. Software has no material, so its honesty lives somewhere else: in the relationship between what the interface signals and what the system actually does. Norman would call this the gap between the conceptual model the user forms and the real model underneath. Normally we try to close that gap so people are not confused. A deceptive pattern opens the gap on purpose, so that people act on a false model in a way that benefits the business.

Four places software can lie

When you audit your product for honesty, you are looking in four places. Each has its own common lies.

1. Signals. What visual weight, color and position imply. A green, huge "Accept" next to a gray, tiny "Settings" says "this is the normal choice" even if nobody wrote that.
2. Words. What labels, headlines and microcopy state or imply. "Free" that turns into a charge, "Only 2 left" that is always 2, "Continue" that actually means "subscribe".
3. Defaults. What happens if the person does nothing. Pre-ticked boxes, opt-outs buried in settings, auto-renewal with no reminder.
4. Effort. How hard each path is. Sign-up in one tap, cancel by phone during office hours. The asymmetry is itself a message: we will make leaving painful.

Why honesty is also the better business for you

Deception works in a narrow, measurable way: it raises a short-term number (sign-ups, add-ons, retention this month). It costs in ways that are slower and harder to measure: refunds, chargebacks (payment processors penalize merchants with high chargeback rates), support load, angry reviews, app store rejection, legal risk, and, worst for a small product, the death of word of mouth. A large company can absorb that. A one-person product lives on recommendations from people who trust it. Your honesty is your marketing budget.

There is also a quieter argument. Kenya Hara writes about design as a way of making people perceive things clearly, of "awakening" them to what is already there. Deception is the precise opposite: it designs for a person's inattention. If you want to be the kind of designer who makes things people see clearly, you cannot also be the kind who relies on them not seeing.

In the wild

• Braun product lineDieter Rams era, 1960s–90s
  Controls look like what they do; materials are not disguised. Rams formulated "honest" as a principle partly against products dressed up to seem more than they were. Software equivalent: a button looks like what it does and does what it says.
• Basecamp pricing37signals
  Basecamp has long published simple, flat pricing on a single page and made a point of explaining it plainly rather than through tiers designed to confuse. Simple pricing is itself an honesty signal.
• Apple subscriptionsApp Store, since 2010s
  Subscriptions bought through the App Store can all be seen and cancelled in one system place (Settings, your name, Subscriptions), and the store requires free-trial terms to be disclosed before purchase. Platforms are pushing a baseline of honesty; meet it on the web too.

A deceptive pattern is an interface that exploits a predictable shortcut in human thinking to make people do something they did not intend. Learn the shortcuts and you can recognize any pattern, including new ones nobody has named yet.

Harry Brignull, a UX designer with a PhD in cognitive science, coined the term "dark patterns" in 2010 and started a website cataloguing them. He later renamed the site deceptive.design and, in 2023, published the book Deceptive Patterns. The names changed over the years (for example "roach motel" became "hard to cancel", "sneak into basket" became part of "sneaking", "privacy zuckering" was retired as a name), so you will see both old and new labels. This guide uses whichever name is clearest and mentions the other.

In 2019 a Princeton team led by Arunesh Mathur crawled around 11,000 shopping websites and found dark patterns on roughly one in ten of them, including fake countdown timers and fake "someone just bought this" messages, some generated by third-party plug-ins sold for that purpose. The point for you: these patterns are not rare and not only in big companies. They often arrive in your product through a template, a plug-in or a growth tutorial.

The engine underneath: shortcuts in thinking

Kahneman's distinction between fast, automatic thinking (System 1) and slow, deliberate thinking (System 2) explains why these patterns work. People using an app are almost always in System 1: skimming, tapping the obvious button, trusting defaults. Deceptive patterns are built to be correct for System 2 and misleading for System 1. The full information is there for a careful reader. Almost nobody is a careful reader at a checkout. (See The Human Mind for the full treatment of attention and bias.)

Three families you will meet

To keep the catalogue usable, this guide groups the common patterns into three families, each with its own chapter. The grouping is ours, made for designers; it is not an official taxonomy.

A test you can run on any design: the four questions

When a pattern does not have a name, run these four questions. If any answer is "yes", you are probably looking at a deceptive pattern.

1. Would it stop working if users understood it? Honest persuasion survives being explained. "Annual plan saves 30%" still works when you know why it is there. A fake countdown does not.
2. Is the effort asymmetric? Count the taps and the reading needed for each option. Yes in one tap and no in six is a tell.
3. Would you be embarrassed to show it on stage? Imagine a slide at a design conference titled "How we got 12% more add-ons". Would you show the screenshot?
4. Would the user be glad, a week later? This is the test we will reuse for habits and notifications in Part 2.

Deceptive patterns are not a design problem a designer can always fix alone; they are usually a business decision expressed in pixels.Paraphrasing a theme of Harry Brignull, Deceptive Patterns, 2023

In the wild

• deceptive.designHarry Brignull, since 2010
  The reference site: a type list with definitions, a "hall of shame" of real examples, and a summary of relevant laws and cases. Bookmark it and read the hall of shame once a quarter; it trains your eye.
• Princeton shopping-site studyMathur et al., 2019
  Automated crawl of about 11K shopping sites; found 1,818 dark pattern instances on 1,254 sites, and third-party services openly selling fake urgency and fake activity widgets. Patterns arrive through tools, not only through intent.

Pressure patterns push a decision by manufacturing emotion: shame, fear of missing out, herd instinct, or simple fatigue. The honest version gives the same true information and lets the person decide at their own pace.

Cialdini's Influence (1984) described the levers that make people say yes: reciprocity, commitment, social proof, liking, authority and scarcity. Every one of them is real and every one can be used honestly. A genuinely limited batch is scarce. A genuinely popular plan has social proof. Pressure patterns are what you get when the lever is pulled without the fact behind it, or with the fact exaggerated. Below are the five you will meet most, each with a drawn honest alternative.

Confirmshaming

The decline option is worded to make the person feel stupid, selfish or lazy for declining: "No thanks, I prefer to stay uninformed." It works because agreeing with an insulting sentence about yourself is uncomfortable, so a few people click yes to avoid the discomfort. The honest version names both options neutrally. If your offer only works when "no" is humiliating, the offer is weak.

Fake scarcity and fake urgency

Scarcity ("only 2 left") and urgency ("offer ends in 09:59") both trigger loss aversion: we weigh a loss more heavily than an equal gain, so the fear of missing out short-circuits comparison shopping. They are honest when true and specific. They become deceptive when the number is invented, the timer resets on reload, or "only 2 left" means "only 2 left at this price on this site in this minute". In 2019 the UK's Competition and Markets Authority secured commitments from several large hotel booking sites to stop misleading pressure selling such as false claims about how many rooms were left or how many people were looking.

Fake social proof

"Priya from Pune just bought this", "1,203 people are viewing", "4.9 from 10,000 reviews". Social proof works because, under uncertainty, we copy what others do. Faking it is now explicitly targeted by regulators: the US FTC finalized a rule in 2024 banning fake reviews and testimonials, including reviews by people who do not exist and buying positive reviews. For a small product the temptation is different: you have few users, so the numbers look thin. The honest response is to show the proof you really have (one detailed quote from a named user, with permission) rather than inflate it.

Nagging

The same request, repeated until the person gives in: "Turn on notifications?" with only "OK" and "Not now", asked every launch. "Not now" is not "no"; it is a promise to ask again. Nagging exploits fatigue: eventually, saying yes costs less than one more dismissal. The honest version accepts a "no" and remembers it, and asks again only when something meaningful changes (the user creates their first reminder, for example), at most once.

In the wild

• Hotel booking sitesUK CMA action, 2019
  After an investigation, several major booking sites committed to stop giving false impressions of room availability and popularity, and to stop hiding fees. Urgency claims are now an enforcement topic, not just a style choice.
• FTC fake reviews ruleUnited States, 2024
  Bans fake or AI-generated reviews attributed to people who do not exist, buying reviews, and some forms of review suppression. Inflated proof is a legal risk as well as an ethical one.
• Indie launchesCommon pattern
  Many indie apps run a launch discount with a stated end date and keep it, then mention in the changelog that it ended. Keeping a deadline you set is cheap credibility.

Sneaking patterns change the deal while the person is not looking: an item appears in the basket, a fee appears at the last step, an ad dresses up as a button, a question is worded to be misread, a box is already ticked. The honest version shows the whole deal, up front, in the words a skimmer will actually read.

Thaler and Sunstein's Nudge (2008) made "choice architecture" famous: the way options are arranged changes what people choose, and there is no neutral arrangement. They argued for nudges that are transparent and easy to opt out of, aimed at choices people would endorse. Sneaking patterns are the inverse, sometimes called "sludge" (a word Thaler later popularized for friction that works against people's interests). They rely on the fact that defaults stick and that skimmers read the first two words of a sentence.

Sneak into basket and preselection

An add-on ("Priority support, ₹199") is added to the cart or ticked by default, so the person has to notice and remove it. The default effect is powerful: most people keep whatever is preselected, partly from inertia and partly because a default looks like a recommendation. The EU's Consumer Rights Directive (2011) already bans pre-ticked boxes for extra payments, and the Court of Justice of the EU ruled in the Planet49 case (2019) that a pre-ticked box is not valid consent for cookies. The honest version: add-ons start unticked, and the total updates visibly when someone ticks one.

Hidden costs (drip pricing)

The advertised price is lower than the price you pay: a "convenience fee", "platform fee", tax or delivery charge appears only at the last step. By then, the person has invested time (sunk cost) and committed mentally to the purchase, so most continue. India's 2023 dark pattern guidelines call this drip pricing. In the US, the FTC finalized a rule in late 2024 requiring all-in prices for live-event tickets and short-term lodging. The honest version shows the total, including mandatory fees, from the first price the person sees.

Disguised ads

An advertisement styled to look like content or like part of the interface: a big green "Download" button on a file site that is actually an ad, a "recommended article" that is paid placement without a label. It exploits the learned meaning of interface elements. For you, the risk is subtler: cross-promotion of your own other app styled as a native feature, or affiliate links in a "recommendations" list without disclosure. The honest version labels ads and sponsorship clearly, in words ("Ad", "Sponsored", "Affiliate link"), and never styles them as controls.

Trick questions

A question worded so that a skimmer gives the opposite answer to the one they intend: double negatives, a switch between "tick to opt in" and "tick to opt out" in the same form, or a dropdown where the "no" option is hidden among normal ones. Brignull's best-known example is an airline checkout where the way to decline travel insurance was the option "Don't insure me", placed alphabetically inside a list of countries of residence. The honest version: one question, one meaning, phrased positively, with the same polarity for every checkbox.

In the wild

• Planet49 rulingCourt of Justice of the EU, 2019
  A pre-ticked checkbox does not constitute valid consent to store cookies. Preselection is legally not a choice in the EU.
• "Don't insure me"Airline checkout, catalogued by Brignull
  The opt-out from insurance was hidden inside a country dropdown. The classic trick question: the "no" disguised as an unrelated option.
• Food delivery feesIndia, 2020s
  Platform, packaging and "small order" fees often appear late in the order flow; drip pricing is one of the 13 patterns named in India's 2023 guidelines. Show the fee before the person invests effort.

Obstruction makes the choice the business dislikes harder than the one it likes: one tap to join, a maze to leave; one tap to share, five screens to keep things private. The honest rule is symmetry: leaving, refusing and deleting should take no more effort than joining, accepting and creating.

Effort is a cost people pay in time and attention. When one option is cheap and the other is expensive, most people take the cheap one, even when they wanted the other. That is not a character flaw; it is how a limited attention budget works. Obstruction patterns turn that fact into revenue. They are also, today, the patterns most likely to get a company sued.

Roach motel (hard to cancel) and forced continuity

The name comes from an old US insect-trap advertising slogan: easy to get in, impossible to get out. Signing up takes a minute online; cancelling requires a phone call, a chat with a "retention specialist", a buried link under Help, a survey, three offers and a final confirmation email. Its partner is forced continuity: a free trial that silently becomes a paid subscription, with no reminder before the first charge.

In 2018 the Norwegian Consumer Council published "Deceived by Design", analyzing how large platforms steered users through privacy settings. In 2021 it followed with "You can log out, but you can never leave", documenting the many steps needed to cancel Amazon Prime. The US Federal Trade Commission sued Amazon in 2023 over Prime sign-up and cancellation flows; in September 2025 Amazon agreed to a settlement reported at $2.5 billion, including refunds to customers. Separately, the FTC adopted a "click-to-cancel" rule in 2024 requiring cancellation to be as easy as sign-up, but a federal appeals court vacated it in July 2025 on procedural grounds before it took effect, and the FTC has since reopened rulemaking on subscriptions with an advance notice of proposed rulemaking. Check the current status before you rely on it. Existing laws (like the US ROSCA act and several state laws, such as California's automatic renewal law) still require simple cancellation. Treat symmetry as the standard regardless of what any single rule says this year.

Obstruction in general

Cancellation is the famous case, but obstruction appears anywhere a business prefers one answer: deleting an account (no button, "email support"), exporting your data (only one export per 30 days, in a proprietary format), turning off personalization (hidden four levels deep), comparing plans (prices only shown after a demo call; this is sometimes called comparison prevention). The tell is always the same asymmetry.

Interface interference

Visual design used to hide or demote the option the business dislikes: the "Reject" button in light gray on white, the "Decline" link at 11 px under a 48 px green "Accept", the "Delete account" text styled as plain body copy. It works because people navigate by salience (see Visual Design on hierarchy). Hierarchy itself is not wrong: there is usually a recommended action. The line is crossed when the demoted option is a legitimate choice the person came to make, and when it is made hard to see, not just secondary.

Privacy zuckering

Brignull's old name (now retired on his site) for tricking people into sharing more personal data than they meant to: confusing privacy settings, "find your friends" flows that upload the whole address book and email every contact, defaults that make a profile public. In 2015 LinkedIn agreed to a $13 million settlement in a US class action over its "Add Connections" feature sending repeated invitation emails to users' contacts. The honest version: share nothing by default, ask for the narrowest data needed, and show exactly who will see or receive what before it happens. Part 3 goes deeper into privacy.

In the wild

• Amazon Prime cancellationFTC case 2023, settled 2025
  The FTC alleged a multi-step cancellation flow (internally nicknamed "Iliad", according to the complaint) and sign-up flows that enrolled people without clear consent. Even the largest companies are now held to symmetry.
• App Store subscriptionsApple
  System-level list of all subscriptions with a cancel button for each, independent of the app. The platform's baseline; your web billing should be at least this easy.
• Stripe customer portalStripe Billing
  A hosted page where customers can update cards, see invoices and cancel, configurable by the merchant. For a solo founder, honest cancellation can be a configuration, not a project.

Practice turns a vocabulary into an eye. Then learn the short version of the law: in the EU, the US and India, many deceptive patterns are no longer just bad manners but violations with real penalties.

First, play. The mock checkout below contains several deceptive elements mixed with honest ones. Tap anything that you think is deceptive. Each tap tells you what you found, or why the element is fine. Try to find them all before revealing the answers. Expect to miss one or two: the good ones are designed to be missed.

The law, in one page

You are not a lawyer and this is not legal advice. But a designer who ships to the world should know the shape of the rules, because they increasingly name specific interface patterns. The direction of travel is clear and global: regulators now judge the design, not only the terms.

In the wild

• CNIL decisionsFrance, January 2022
  Google and Facebook were fined because rejecting cookies required several clicks while accepting took one. Both changed their banners to add a one-click reject in France. Click-count asymmetry is now evidence.
• FTC v. Epic GamesUS, 2022–2023
  The FTC alleged confusing button layouts led players to make unwanted purchases with a single press. Button placement can be a legal issue.

Good technology lives mostly in the periphery of attention, where you can sense it without thinking about it, and moves to the center only when it matters, then back again. Calm is not the absence of information; it is information that does not demand.

Mark Weiser was chief technologist at Xerox PARC and coined "ubiquitous computing" (his 1991 Scientific American article "The Computer for the 21st Century" opens with the idea that the most profound technologies are those that disappear into everyday life). In 1995 he and John Seely Brown wrote a short paper, "Designing Calm Technology", arguing that if computers were going to be everywhere, they had better not shout. Their central point was a distinction between the center of attention (what you are consciously focused on) and the periphery (what you are aware of without attending to it, like the sound of traffic or the weather out of the corner of your eye).

They argued that calm technology does two things. It uses the periphery, so we can be aware of many things without being overburdened; and it lets things move easily between periphery and center, so we can take control when we need to. They wrote that a calm technology will move easily from the periphery of our attention, to the center, and back. The feeling this creates, they said, is of being "at home": attuned to what is around you, in control.

The Dangling String

Weiser and Brown's favorite example was an artwork by Natalie Jeremijenko at PARC: a length of plastic spaghetti-like string hanging from a small motor in the ceiling, wired to the office Ethernet. Each packet of network traffic made the motor twitch. A quiet network meant a gentle twitch every few seconds; a busy network made the string whirl and make a soft noise. Nobody needed to look at it. You heard and saw it at the edge of awareness, and you noticed when something was unusual. Information about the network was present, continuous and undemanding. That is the model: ambient, continuous, glanceable, and silent until it matters.

Translating it to screens

On a screen, the periphery is the edges: the status bar, the corner of a window, the color of a small dot, the length of a scroll bar, a gentle change in a title's weight. The center is anything that interrupts: modals, alerts, sounds, toasts that block content, badges demanding to be cleared. Calm software puts status in the edges and keeps the center for the person's own work.

In the wild

• Kindle reading progressAmazon
  Progress is a small line of text or a thin bar at the bottom, and can be hidden while reading. Status at the edge, content in the center.
• iA WriterInformation Architects, 2010–
  The editor hides almost all chrome while you type; counts and options appear at the edges or on demand. Writing is the center; everything else waits.
• macOS menu barApple
  Battery, Wi-Fi and time live in a thin strip at the top edge: glanceable and silent until a low-battery warning. The classic peripheral display on a computer.

Amber Case turned Weiser and Brown's idea into eight working principles. Each one is a question you can ask of any feature: how little attention can this need, and what happens when it fails?

Amber Case is a designer and researcher who wrote Calm Technology: Principles and Patterns for Non-Intrusive Design (O'Reilly, 2015). She frames technology as something that should inform without overburdening, and her principles are deliberately practical. Here they are, each with a software example drawn below. Read the list, then study the drawings: each shows one concrete way to apply the principle in a small app.

1. Technology should require the smallest possible amount of attention. It should create ambient awareness through different senses and communicate without taking you out of your world.
2. Technology should inform and create calm. Its job is to give you what you need to know so you can stop worrying, not to give you something new to worry about.
3. Technology should make use of the periphery. It should move easily from the periphery to the center and back.
4. Technology should amplify the best of technology and the best of humanity. Machines should not act like humans, and humans should not act like machines; give each the work it is good at.
5. Technology can communicate, but doesn't need to speak. A tone, a light, a vibration can carry status without words or a voice.
6. Technology should work even when it fails. A broken escalator becomes stairs. Design a sensible default state for failure.
7. The right amount of technology is the minimum needed to solve the problem. Every added feature, sensor or connection adds a way to fail and a demand on attention.
8. Technology should respect social norms. Introduce new behavior gradually, and consider the people around the user, not only the user.

How to use the eight as a review

The principles overlap, which is fine: use them as eight lenses during a review, not as a scoring rubric. In practice, three of them do most of the work for a small software product. Principle 6 (work when it fails) forces you to design offline, error and empty states, which most apps skip. Principle 7 (minimum technology) is your best defense against feature creep. Principle 8 (social norms) is the one most often forgotten: the person next to your user (on a call, on a train, in a shared document) also experiences your product.

In the wild

• iOS camera and mic indicatorsApple, iOS 14, 2020
  A colored dot in the status bar whenever an app uses the camera or microphone. Principle 8 as a system feature; tiny, peripheral, always there.
• Things 3Cultured Code
  Completing a to-do is a small checkbox animation and the item quietly moves away; there are no congratulation dialogs. Principle 5: routine success without words.
• Google Docs offlineGoogle
  Docs can be enabled for offline editing and sync later. Principle 6: a failure that still lets you work.

Emptiness is not a lack. An empty vessel is useful because it can receive anything. A calm product leaves room for the person's own content, intention and pace, instead of filling every gap with suggestions, prompts and promotion.

Kenya Hara, art director of MUJI since 2002, writes about emptiness as a design idea in Designing Design (2007) and White (2010). He distinguishes simplicity in the Western modernist sense (reducing to essentials for efficiency) from emptiness in a Japanese sense: a space that invites the viewer to bring their own meaning. His image is a vessel: its value comes from the empty space inside. MUJI's posters with a single horizon line and a tiny figure are, in his framing, empty containers that viewers fill with their own feelings.

Hara also describes MUJI's aim with a contrast between two Japanese phrases. "Kore ga ii" means roughly "this is what I want", the feeling of a product that excites a specific desire. "Kore de ii" means roughly "this will do", a quieter satisfaction: the product is good enough that you do not need to think about it further. MUJI aims for a confident version of the second. For software this is a surprisingly radical idea: build a product that people can stop thinking about.

Emptiness in software

The baseline guide covered whitespace as a visual tool (see also Visual Design). Here we care about emptiness as an ethical stance. An attention-maximizing product treats every empty moment as wasted inventory: an empty feed gets "suggested posts", an empty search gets "trending", a finished task gets "what's next?". A calm product treats empty moments as the user's to keep.

The empty vessel is useful precisely because it can hold anything; design that leaves room lets people bring their own meaning.Paraphrasing Kenya Hara, Designing Design, 2007

Four kinds of room to leave

1. Room in space. Empty canvas, generous margins, no promotional slot "because there was space".
2. Room in time. No autoplay, no "next" timer, no immediate follow-up prompt after completion.
3. Room in meaning. Let people name, organize and use things their own way; avoid forcing your categories (Fukasawa calls designs that fit unconscious behavior "without thought").
4. Room in commitment. Allow light use. Someone who opens your app once a month should not be punished with guilt, lost streaks or "we miss you" emails.

In the wild

• MUJIRyohin Keikaku, art direction by Kenya Hara since 2002
  Unbranded-looking goods, plain packaging, and campaign images built around emptiness and horizon lines. A product can be confident by asking for less attention.
• iA WriterInformation Architects
  Opens to a blank page and a cursor; no templates gallery, no onboarding tour. The empty page is the feature.
• Things 3 "Today"Cultured Code
  When you clear today's list, the view is simply empty and quiet, not filled with suggestions. Done means done.

When a business earns more the longer people stay, the product slowly learns to remove the moments when people would naturally stop. Calm design puts those stopping points back.

In 2013 Tristan Harris, then a design ethicist at Google, circulated an internal slide deck titled "A Call to Minimize Distraction & Respect Users' Attention". He argued that a handful of designers at a few companies were shaping how billions of people spend their time, mostly by optimizing for time-on-site. The idea grew into the "Time Well Spent" movement and, in 2018, the Center for Humane Technology, which he co-founded with Aza Raskin and Randima Fernando. Its argument is not that technology is bad, but that a business model built on capturing attention creates pressure to exploit human weaknesses.

How products remove stopping cues

Adam Alter, in Irresistible (2017), uses the phrase stopping cues for the natural signals that tell us we are done: the end of a chapter, the last page of a newspaper, the end of an episode. Many attention-optimized designs work by removing them. Natasha Dow Schüll's study of slot machines, Addiction by Design (2012), shows the same thing in gambling: machines are designed to keep players in a continuous "zone" with no natural pause.

Aza Raskin designed an early version of infinite scroll in 2006 and has since spoken publicly about regretting how it has been used. Loren Brichter, who invented pull-to-refresh for the Tweetie app, has also said in interviews that he has misgivings about it, since it can work like a slot machine lever. Neither invention is evil in itself. Infinite scroll is fine for a search result list you are actively scanning; it becomes a problem when combined with a feed engineered to be endless.

Healthy defaults

Defaults are the strongest design decision you make, because most people never change them (Chapter 4). That cuts both ways: a healthy default protects everyone who never opens Settings. Practical healthy defaults: autoplay off; notifications off except ones the user explicitly creates (a reminder they set); feed sorted chronologically or bounded; daily summary rather than real-time pings; no badge on the app icon for non-obligations; session end markers on.

In the wild

• Instagram "You're All Caught Up"Meta, 2018
  A marker in the feed after you have seen all new posts from the past two days. Below it, the app later added suggested posts. A stopping cue is easy to add, and easy to undermine with what comes after it.
• Netflix autoplay settingsNetflix, 2020
  Netflix added settings to turn off autoplay of previews and of the next episode. Even attention businesses have moved toward user control of autoplay.
• Reeder and RSS readersSilvio Rizzi and others
  Chronological unread lists that end; marking all as read gives a clean empty state. A feed can be bounded by design.

Habit-forming design is a tool, not a sin. The question is whose goal the habit serves. The test: a week later, would the person be glad they did it, and would they still choose it if they saw exactly how you designed it?

Nir Eyal's Hooked (2014) describes a four-step loop that many popular products share: a trigger (external, like a notification, then internal, like boredom or loneliness), an action (the simplest behavior done in anticipation of reward), a variable reward (of the tribe, the hunt, or the self), and an investment (the user puts something in, like data, content or followers, that makes the next loop more likely). The model drew on BJ Fogg's behavior model, which says a behavior happens when motivation, ability and a prompt converge at the same moment.

The book was widely used by startups, and widely criticized. Critics argued that it gave product teams a recipe for compulsion, especially the variable reward step, which borrows from the reinforcement schedules that make slot machines compelling. Eyal himself included an ethics section, the Manipulation Matrix, and later wrote Indistractable (2019), about how individuals can control their attention. That second book drew its own criticism: some argued it shifts responsibility for distraction from companies to users. You do not need to settle the debate to use its best part, which is the matrix.

The Manipulation Matrix

Eyal asks two questions of any habit-forming product: Would I use it myself? and Will it help users materially improve their lives? The four answers give four roles.

The streak debate, as a worked example

Duolingo is the best-known example of streaks in a useful product. A streak counts consecutive days of practice; the app reminds you to keep it and lets you buy or earn "streak freezes" to skip a day without losing it. Duolingo has said publicly that streaks are one of its most effective features for retention. For a language learner, daily practice genuinely helps, so the habit serves a real goal. Critics point at the edge cases: people doing a 30-second lesson at 11:58 pm just to save the number, anxiety about losing a 400-day streak, notifications with guilt-laden copy. The number, at some point, becomes the goal instead of the learning.

Work through it with the glad test. Would the person be glad, a week later, that they did today's lesson? Mostly yes. Would they be glad they did a token lesson at midnight purely to save the count? Probably not; that is the streak serving itself. So an ethical streak design would: reward real practice (not the minimum tap), forgive misses (rest days, weekly goals), keep reminder copy factual rather than guilt-based, and let people turn streaks off without losing their learning history.

Four questions for any habit feature

1. Whose goal is it? Did the user state this goal, or did you choose it for them?
2. Is the reward the value itself? Learning, a finished draft, a cleaner inbox, or a random hit of novelty?
3. Can they skip without punishment? Rest days, pause, forgiveness.
4. Can they leave with their investment? Export of history, notes, data.

In the wild

• Duolingo streaksDuolingo
  Daily streak with freezes, reminders, and a famously persistent owl mascot. Habit design that supports a real goal, with edges worth debating.
• Apple Fitness ringsApple Watch, 2015–
  Daily ring goals the user can adjust; in later versions Apple added the ability to pause rings for rest or illness. A forgiving mechanism added after years of rigid streaks.
• Tiny HabitsBJ Fogg, 2019
  Fogg's method anchors tiny behaviors to existing routines and celebrates them; it is aimed at the person designing their own habits. Habit design can be done with the user, not to them.

A notification spends someone else's attention. Decide in writing which events deserve that spend, at what level, at what time, and how often, before you write a single push. Then let the user tighten it further.

Every notification is an interruption, and interruptions have a cost beyond the seconds it takes to read them: the person loses their place in whatever they were doing and has to rebuild it. A notification that is useful pays that cost back. One that is promotional, vague or badly timed does not, and the person learns a lesson: this app's pings are noise. After enough of those they turn notifications off entirely, and now your genuinely important messages cannot reach them either. Notification abuse destroys the channel.

Step 1: classify every event

Before designing any push, list every event your system could notify about and put each in one of three classes. Be strict.

Step 2: batching, digests and quiet hours

Batching combines several useful events into one ("3 comments on 'Draft 2'") instead of three pings. A digest delivers all useful events at a predictable time the user chooses. Quiet hours hold everything except critical events during the user's night and focus times. Apple built two of these into the system in iOS 15 (2021): the Scheduled Summary, which collects non-urgent notifications into a summary at set times, and Focus modes, which filter notifications by context. Apps can mark notifications with an interruption level (passive, active, time-sensitive, critical), and the system respects the user's settings. Android has had notification channels since Android 8 (2017), so users can turn off one category without silencing the whole app.

Step 3: ask for permission at the right moment

On iOS the system permission prompt can be shown only once per app; if the user says "Don't Allow", only Settings can change it. On Android 13 and later, notifications also need a runtime permission. So when you ask matters enormously. Asking on first launch, before the person has any idea why you need it, wastes your one chance and trains a reflexive "no". Ask when the person does something that needs notifications (sets a reminder, follows a thread), and explain the value in one sentence first. iOS also offers provisional authorization (since iOS 12): your app can deliver notifications quietly to the notification center without asking, and the person can choose to keep or turn them off from the notification itself.

Step 4: write it down

Here is a policy template you can adapt. Keep it in your repository next to the notification code.

NOTIFICATION POLICY · Shelf (v1)
Critical  (push now): reminders the user set; payment failed;
          new sign-in from unknown device. Max ~1/day.
Useful    (digest 19:00, user can change): edits to shared notes,
          exports ready, comments. Batched. Silent delivery.
Promo     (never push): features, offers, tips → "What's new".
Quiet hours: 22:00–08:00 local; only reminders the user set.
Permission: ask when first reminder is set. Never on launch.
No: "we miss you", streak threats, vague "new activity".
Every push names the specific thing and opens it directly.

In the wild

• iOS Scheduled Summary and FocusApple, iOS 15, 2021
  System-level digests and context filters; apps declare interruption levels. Apple's guidelines say time-sensitive should be reserved for events that need attention now. The platform is designed for calm; don't fight it.
• Android notification channelsGoogle, Android 8, 2017
  Each app category becomes a separate switch the user controls. Design your categories so users can silence promotion without losing critical alerts.
• Slack notification scheduleSlack
  Users can set hours when notifications pause, and the app shows others that you are not being notified. Quiet hours can also be a social signal (principle 8).

The most private data is data you never collect. Collect the minimum, keep it for the shortest time, process it on the device when you can, explain it in plain words, and let people take it with them or delete it themselves.

Ann Cavoukian, then Information and Privacy Commissioner of Ontario, developed "Privacy by Design" in the 1990s and published its seven foundational principles in 2009. Among them: be proactive, not reactive; make privacy the default setting; embed it into the design; aim for full functionality (positive-sum, not privacy versus features); protect data through its whole life cycle; be visible and transparent; and keep it user-centric. The EU's GDPR made a version of this law in 2018 as "data protection by design and by default", alongside the principle of data minimization: collect only what is adequate, relevant and limited to what is necessary for the purpose.

Why should a solo creator care beyond compliance? Because every field of personal data you store is a liability: something to secure, back up, disclose in a breach, answer requests about, and explain. Data you never collect cannot leak. Minimization is the rare principle that is both more ethical and less work.

The data ladder

Clear permissions and honest sign-in

Ask for system permissions (contacts, location, photos, camera) only when a feature needs them, and ask for the narrowest version: "selected photos" rather than the whole library, "while using the app" rather than "always", approximate rather than precise location when that is enough. Both iOS and Android now offer these narrower choices; design your feature so it works with them. For sign-in, offer options that do not force more data than needed: email with a magic link, Sign in with Apple (which lets people hide their real email behind a relay address), or no account at all for a local app. Do not demand a phone number or social login to use a notes app.

Consent banners: the classic battleground

Cookie banners are where privacy and deceptive design meet most visibly. The honest move for most small products is to not need one: use privacy-friendly, cookieless analytics (or none), no ad trackers, and no third-party embeds that set cookies. If you do need consent, make it a real choice. Try both versions below with the same task.

Labels, export and delete

Since December 2020 Apple's App Store requires a "privacy nutrition label" for each app, summarizing what data is collected and whether it is linked to the user or used for tracking. Google Play added a similar Data safety section in 2022. Since iOS 14.5 (2021), App Tracking Transparency requires apps to ask before tracking users across other companies' apps and websites. Since mid-2022, Apple requires apps that let people create an account to also let them delete it from within the app. Treat these as a floor for the web too: publish a short, plain privacy page that matches your label, offer a self-serve export in an open format, and a self-serve delete that really deletes (after a short, stated grace period if you want one).

In the wild

• SignalSignal Foundation
  Designed to know as little as possible; Signal has published legal responses showing it could provide only very limited account metadata, such as when an account was created and last connected. Minimization as architecture, not policy.
• Plausible and FathomPrivacy-focused analytics
  Cookieless web analytics that count visits without personal profiles, which typically lets a site avoid a cookie banner for analytics. The best banner is no banner.
• Sign in with AppleApple, 2019
  Offers "Hide My Email", a relay address unique to each app. Honest sign-in options let people share less.
• Apple PhotosApple
  Recognizes people and objects in photos on the device itself. On-device processing gives a smart feature without sending private data to a server.

In local-first software the primary copy of your data lives on your own device, and the cloud is a helper for sync and backup, not the owner. It is the strongest structural form of respect: the app stays fast, works offline, and keeps working even if the company disappears.

In 2019 the research lab Ink & Switch published an essay, "Local-first software: You own your data, in spite of the cloud". The authors observed that cloud apps (like Google Docs) made collaboration easy but took away ownership: if the service goes down, changes its terms or shuts down, your work goes with it. Old-fashioned desktop apps with files gave you ownership but made collaboration hard. They proposed a goal that combines both, and described it with seven ideals.

You don't have to go all the way

Full local-first with real-time collaboration is still hard engineering (libraries such as Automerge, from Ink & Switch, and Yjs help). But you can take most of the benefit with simpler moves: store user documents as plain files the user can see (Markdown, JSON, SQLite); cache everything locally and render from cache; queue writes offline; sync files through a service the user already owns (iCloud Drive, Dropbox); and make export a first-class feature. Each move climbs toward ownership.

In the wild

• ObsidianDynalist Inc., 2020–
  Notes are a folder of Markdown files on your disk; sync is an optional paid service, and you can use your own. The file system as a promise: you can leave any day with everything.
• iA WriterInformation Architects
  Works on plain text Markdown files in folders you choose, synced through services like iCloud or Dropbox. A writing app that does not own your writing.
• Actual BudgetOpen source, local-first
  A personal budgeting app built local-first, with optional sync and the option to self-host. Local-first works for serious, everyday tools, not only research demos.

Trust is built in small, repeated moments: a progress bar that tells the truth, a price that does not change, a change log that admits what broke, a feature retired with notice and an export. None of these are hard. All of them are noticed.

Honest progress

Brad Myers showed in 1985 that people prefer having a progress indicator during long waits. Progress bars are among the most common "small lies" in software: a bar that races to 90% and then sits there, a fake multi-step "Analyzing your profile…" animation for something that took 50 ms, a spinner with no end. Some deliberate slowdowns are defended as making a result feel more valuable ("labor illusion"). The honest line: a waiting indicator should reflect real work. If you know the steps, show them. If you do not know the duration, say what is happening instead of faking a percentage. If the work is instant, show the result instantly.

Fair pricing and easy cancellation

Chapter 5 covered cancellation. Fair pricing is its twin: prices that are easy to compare, renewal terms visible before purchase, reminders before renewal, no surprise price rises (announce them in advance and honor the old price until renewal at least), and a plain refund policy. Many indie products also offer a lifetime or one-time purchase option, or "pay once for this version" models, which remove subscription anxiety entirely (see Identity & Launch for pricing pages).

Transparent changes: changelogs

A changelog is a trust device. It shows the product is alive, admits fixes ("Fixed a bug where search skipped notes with emoji titles"), and warns of changes before they surprise people. Good changelogs are dated, specific, written for users not developers, and honest about removals and regressions. Bad ones say "Bug fixes and performance improvements" every time, which tells the user nothing and, over the years, reads as concealment.

Sunsetting features (and products) responsibly

Every product eventually removes things. How you do it says everything about you. Google Reader's shutdown in 2013 is the classic case: announced in March, closed on 1 July, with an export through Google Takeout. People were upset, but they could leave with their subscriptions in a standard format (OPML), which is why a new generation of RSS readers could import them. A responsible sunset has five parts.

1. Notice. Announce early (months, not days), in the app and by email, with a date.
2. Reason. Say why, briefly and truthfully.
3. Export. Provide a full export in an open format, and keep it working until after the shutdown date.
4. Alternatives. Point to replacements, including competitors if needed.
5. Money. Refund unused prepaid time, pro rata.

In the wild

• Google Reader shutdownGoogle, 2013
  About three and a half months' notice, with export via Takeout in OPML. An open export format turned a shutdown into a migration.
• Linear changelogLinear
  A frequent, specific, illustrated public changelog. A changelog can be a calm, steady trust signal and a marketing asset.
• Sketch and other "keep this version" licensesVarious indie and pro apps
  Some apps let you keep using the last version you paid for when a subscription or update license lapses. Fair pricing can leave people with something when they stop paying.

Long-lasting design avoids fashion, keeps people's work readable for decades, runs on the devices they already own, and wastes neither energy nor attention. Maintenance is a form of respect: it says "I am still here, and your trust is still safe."

Rams's seventh principle says good design is long-lasting: it avoids being fashionable and therefore never appears antiquated. His ninth says good design is environmentally friendly: it conserves resources and minimizes physical and visual pollution through the product's life. Braun products he designed in the 1960s still look current and many still work. Software decays faster, but not by necessity. Most software rot comes from three choices: trendy styling, closed formats, and growing weight that pushes older devices out.

1 · Files that outlive the app

The single most important longevity decision is the format of the user's work. A plain text file from 1975 opens today on any computer. A document in a proprietary format from a dead app from 2010 may not open anywhere. Open, documented, widely implemented formats outlive companies.

2 · Style that does not date

Trends in UI come in waves: heavy skeuomorphism, then extreme flat, then neumorphism, glassmorphism, gradient blobs, and whatever is fashionable this year. Each looks fresh for a year or two and then marks the product as "from that year". Timeless interfaces lean on typography, spacing, clear hierarchy and system conventions rather than surface effects. You can still have personality, but put it where it ages well: in words, in a well-chosen typeface, in a single accent color, in thoughtful details.

3 · Light pages and the energy of software

Digital products use energy: in data centers, networks and especially in the devices that download and run them. Heavier pages and apps cost energy, data plans (a real expense for many users in India and elsewhere) and battery, and they push older devices out sooner. The HTTP Archive's measurements show the median web page has grown to over 2 MB. A text-centric product rarely needs more than a fraction of that. Practical moves: compress and size images, avoid autoplaying video, use system fonts or a small number of subsetted webfonts, ship less JavaScript, cache well, and lazy-load what is below the fold.

4 · Support older devices

Every time an app drops support for an older OS or a slower phone, some people are pushed to buy new hardware or lose access. Hardware manufacturing is where much of a device's lifetime carbon footprint comes from, so keeping old devices useful is one of the most effective environmental moves software can make. Check your analytics for the oldest OS versions and slowest devices in real use, test on a cheap or old phone regularly, and drop support only with notice and a reason.

5 · Finished software and maintenance as respect

There is a quiet tradition of software that is allowed to be finished. Donald Knuth froze TeX's features decades ago; new versions only fix bugs, and the version number converges toward π (3.14159265…), a joke that is also a philosophy. Many small Unix tools have done one job unchanged for decades. "Finished" does not mean abandoned: it means feature-complete, with ongoing maintenance (security fixes, OS compatibility, bug fixes). For a solo creator, deciding that your product's core is finished can be the most respectful thing you do: users get stability instead of churn, and you get time to maintain it well.

In the wild

• Low-tech MagazineSolar-powered website, 2018–
  A site served from a small solar-powered server, with dithered images and a static design to keep pages tiny; it can go offline in long cloudy spells. A vivid demonstration of how small a good reading page can be.
• TeXDonald Knuth, 1978–
  Feature-frozen for decades, still maintained, with documents from the 1980s still compiling. Finished software, maintained, is a gift to users.
• CraigslistSince 1995
  Barely changed visually in decades and fast on any device. You don't have to copy its look; notice that people never had to relearn it.

Every feature that connects people, shares data or shows location can be used to hurt someone. Design for the abuser as a user persona, make the safe choice the default, and give the person at risk the tools to see and stop what is happening.

Eva PenzeyMoog's Design for Safety (2021) starts from a hard fact: technology is routinely used in domestic abuse, through shared accounts, location sharing, smart home devices, shared calendars, and access to someone's phone. Most product teams design only for well-meaning users and treat abuse as an edge case. PenzeyMoog's method is to add an abuser persona and a survivor persona to your design process and walk every feature through their eyes. Australia's eSafety Commissioner promotes a similar "Safety by Design" approach built on three principles: service provider responsibility, user empowerment and autonomy, and transparency and accountability.

Abuse vectors in ordinary features

Moderation for small apps

If your product lets people send anything to other people (comments, messages, shared links, public profiles), you are running a small moderation operation whether you planned to or not. Big platforms have teams; you have yourself. So design to reduce how much moderation you need. Prefer private and invite-only spaces over public ones. Slow down new accounts (rate limits on messages and invites). Make block and report one tap away, and make block mean the blocked person cannot see or contact the blocker. Write short, plain community rules. Keep a simple review queue, and decide in advance how you will handle illegal content (in many countries you must act on reports and, for some content like child sexual abuse material, report it to authorities). Consider not building the social feature at all: a sharing link that the user sends through their own messaging app avoids an entire category of harm.

Children

Children are in your audience if your product is likely to be used by them, even if it is "not for kids". The UK's Age Appropriate Design Code (the "Children's code", in force since 2021) sets 15 standards for online services likely to be accessed by children, including high-privacy defaults, location off by default, no nudge techniques that encourage children to weaken privacy, and minimal data collection. In the US, COPPA requires verifiable parental consent before collecting personal information from children under 13. India's DPDP Act, 2023 treats anyone under 18 as a child and requires verifiable parental consent for processing their data, and bars tracking and targeted advertising directed at children. The design response is the same everywhere: high-privacy defaults for everyone, no dark patterns, no public profiles by default, and no engagement mechanics designed to keep young people hooked.

In the wild

• AirTag unwanted tracking alertsApple, 2021–2024
  After reports of AirTags used for stalking, Apple added alerts for unknown trackers traveling with you and an Android app to scan for them; in 2024 Apple and Google shipped cross-platform alerts based on a shared specification. A safety layer added after harm; you can design it in from the start.
• Strava heatmap2018
  A public global heatmap of activities revealed the layout of sensitive military sites from soldiers' runs. Strava has offered privacy controls such as hiding the start and end of activities near home. Aggregated "harmless" data can expose people.
• Signal and WhatsApp group controlsMessaging apps
  Settings that control who can add you to groups, with invitations instead of automatic adds in some configurations. Consent before contact is a safety feature.

When you are the designer, the engineer and the business, nobody else will stand up for the user in the room, because the room is your head. Write your principles down while you are calm, turn them into a checklist, and run it before every release.

Mike Monteiro, a designer and co-founder of the studio Mule Design, has argued for years that designers are responsible for the work they put into the world, and that "I was just doing my job" is not a defense. His 2013 talk "How Designers Destroyed the World" and his 2019 book Ruined by Design make the case that design decisions have consequences at scale, and he published "A Designer's Code of Ethics" in 2017, which begins from the idea that a designer is first a human being, and only then a professional. In a team, the designer often plays the user's advocate against business pressure. Alone, you play both roles. That is harder than it sounds, because the business side of you always has a number to point at and the user side only has a feeling.

Write your oath

A design oath is a short list of commitments specific enough to decide real cases. "Be ethical" decides nothing. "Cancelling takes no more taps than subscribing" decides a lot. Write seven to ten lines, each a rule you could check. Here is an example drawn from this guide; adapt the wording, keep the specificity.

MY DESIGN OATH (Rohit, v1)
1. The first price a person sees is the price they pay.
2. Saying no, leaving and deleting take no more effort than
   saying yes, joining and creating.
3. Nothing optional is pre-selected.
4. I never show numbers, deadlines or reviews that are not true.
5. Pushes are for things a person asked for. Promotion never is.
6. Every list has an end. Every session can finish.
7. I collect the minimum, keep it short, and let people export
   and delete it themselves.
8. People's work lives in open formats they can open without me.
9. I walk every sharing feature through an abuser's eyes.
10. If I shut down, I give notice, export and refunds.

Saying no to features that harm

Some requests will come from users ("let me see when my partner reads my messages"), some from your own growth instincts ("import contacts to grow"), some from partners ("add our SDK"). For each, look for the legitimate need under the request, and design for that need without the harm. Often there is a version that gets most of the business value honestly.

Three habits that keep you honest

1. The pre-ship checklist. Run the checklist below before every release that touches money, data, notifications or sharing. It takes ten minutes.
2. The decision log. When you choose between business and user interests, write one paragraph: the options, what you chose and why. Re-read it after a month. It is surprisingly good at revealing rationalizations.
3. The stranger test. Before shipping a persuasive element, show it to someone outside tech and ask "what do you think happens if you tap this?". If their answer differs from reality, you have a gap.

In the wild

• Ruined by DesignMike Monteiro, 2019
  A blunt argument that designers share responsibility for the harms of the products they build. You are not neutral, even alone.
• Basecamp and HEY policies37signals
  HEY, its email service, blocks the tracking pixels that many marketing emails use to report when you open them, and the company publishes its policies plainly. Principles can be a product feature and a brand.
• Indie "values" pagesCommon practice
  Many small app makers publish short pages on privacy, pricing and longevity commitments. Publishing your oath makes it harder to break and easier to trust.

Wrap-up

Practice assignment for the next two weeks

1. Days 1 to 3: Honesty audit. Run Exercises 1.1, 4.1 and 5.1 on your product. Fix the largest gap and the worst asymmetry.
2. Days 4 to 5: Spot practice. Each day, find and screenshot three deceptive patterns in apps you use. Label each with its shortcut and sketch the honest version. Keep a swipe file.
3. Days 6 to 8: Calm pass. Exercises 7.1 and 10.1: center/periphery map and stopping cues. Write and implement your notification policy (12.1).
4. Days 9 to 10: Data and ownership. Data inventory (13.1), seven-ideals scorecard (14.1), and ship one export or delete improvement.
5. Days 11 to 12: Longevity and safety. Longevity audit (16.1) and abuser walkthrough (17.1).
6. Days 13 to 14: Oath. Write and publish your oath (18.1), run the pre-ship checklist, and write a one-page reflection: what did you change, what did it cost, what did you learn about yourself as the business and the advocate?

Reading list

• Deceptive Patterns (2023) and deceptive.design
  Harry Brignull · The definitive catalogue, with the cognitive science and legal cases behind each pattern.
• Designing Calm Technology (1995)
  Mark Weiser & John Seely Brown · A short paper; read it in twenty minutes and you will see "periphery" everywhere.
• Calm Technology (2015)
  Amber Case · The eight principles with practical patterns and examples.
• Designing Design (2007) and White (2010)
  Kenya Hara · Emptiness, receptivity and MUJI's "this will do" philosophy.
• Local-first software (2019)
  Ink & Switch (Kleppmann, Wiggins, van Hardenberg, McGranaghan) · The seven ideals and the engineering behind them.
• Hooked (2014) and Indistractable (2019)
  Nir Eyal · Read Hooked to recognize the loop and use the Manipulation Matrix; read the critics alongside it.
• Irresistible (2017)
  Adam Alter · The psychology of behavioral addiction and the idea of stopping cues.
• Addiction by Design (2012)
  Natasha Dow Schüll · An ethnography of slot machine design; uncomfortable parallels with feeds.
• Center for Humane Technology resources
  Tristan Harris, Aza Raskin and colleagues · Essays, a podcast ("Your Undivided Attention") and design guides on attention.
• Design for Safety (2021)
  Eva PenzeyMoog · Practical methods for designing against interpersonal abuse.
• Ruined by Design (2019)
  Mike Monteiro · A call to responsibility; read it before writing your oath.
• Nudge (2008)
  Richard Thaler & Cass Sunstein · Choice architecture, defaults and the line between nudge and sludge.
• Bringing Dark Patterns to Light (2022)
  US FTC staff report · How a regulator describes and classifies dark patterns.
• Guidelines for Prevention and Regulation of Dark Patterns, 2023
  India's Central Consumer Protection Authority · The 13 patterns, with illustrations, in the regulator's own words.

Next: The Solo Practice turns everything in the course into a working routine. For reference versions of this guide's checklists, see the Reference Library.