Privacy settings

Searching pain points

I collaborated with our Sales and Support teams to gather context around user complaints and quantify the business impact of lost deals. I first developed a structured interview script for sales reps regarding churned prospects. Then, I extracted customer support tickets from the last six months from Jira and Zendesk, using Claude to categorize the requests. This quantitative and qualitative analysis quickly revealed clear usage patterns and core user pain points.

Stages

After the concept was approved, I developed new components for the design system and assembled an interactive prototype. Using this prototype, I conducted a hallway usability test with 12 colleagues from related teams to test the main hypotheses. The tests confirmed the correctness of the chosen design vector.

Conceptual problem

The same document was shared with board members, partners, and the public without any differentiation in access levels. Furthermore, subscription tiers lacked tiered access controls, even though enterprise clients were willing to pay up to 3x the base price for advanced security features.

Market analysis

I set up trial accounts in DocSend, Pitch, Notion, and Flipsnack. For the latter two, I had to request corporate demo accounts because enterprise settings are locked behind sales walls.

In each tool, I created test documents, configured permissions, sent links to myself, attempted to forward them to colleagues, and tested vulnerability to access bypasses.

I documented every settings screen in Figma and consolidated a comparative matrix in Notion across four areas: role models, reader verification, link-sharing flexibility, and pricing tier limitations.

Notion

Notion utilizes a highly sophisticated permission structure: Guest, Member, Admin, with rights configurable at the individual page block level. While technically impressive, this is overengineering for flipbooks. Our users need to decide who can see a document in under 10 seconds. A complex permission matrix is simply overkill for this context.

DocSend & Pitch

This is where I found the most elegant pattern. A viewer opens a link, enters their email, receives an OTP code, and only then accesses the document. The email acts as the access key while simultaneously providing the document owner with viewer analytics.

Flipsnack

Their privacy settings were limited to password protection and unlisted links. They lacked email verification or SSO integrations, despite these features being table stakes for the enterprise market.

Key insight

Our analysis revealed that enterprise users need dynamic control over the context of document distribution. A static password is just one tool and is far from sufficient for enterprise clients. They need to differentiate access based on use case: from a public SEO-indexed catalog to a private draft, or a secure embed restricted to a corporate intranet URL.

Job statement

Based on the internal audit and market research, I defined the core user requirement: “When sharing sensitive documents (financials, pitches, proposals), I want to delegate data protection to the product, so I can eliminate human error and confidently ensure document security.”

Hypotheses

1. Replacing manual password setup with clear, predefined privacy presets will encourage users to configure security settings more frequently. We can validate this by tracking the growth in the percentage of protected files in our database.
2. Designing five progressively secure privacy levels will reduce cognitive load. Users will intuitively select the appropriate security tier without relying on documentation, as validated by a zero-rate of critical setup errors during testing.
3. Showcasing advanced modes on lower subscription tiers will drive a Product-Led Growth (PLG) effect. Users will see the solution to their security pain points and initiate self-serve upgrades directly from the Privacy settings. Growth in upgrades originating from the Privacy panel will confirm this.

Validation process

I mapped out user flows and logical diagrams for each scenario, aligned with the PM and CEO, and prioritized features using the RICE framework. We then reviewed these schemas with the engineering team to discuss technical feasibility and complexity. This allowed us to quickly define the MVP scope.

MVP scope

The first release included five primary privacy levels. We deliberately postponed complex verification mechanisms (Email verification and SSO) to Phase 2 to quickly validate the updated architecture’s value with real users.

Technical constraints

During planning, we hit backend hurdles. Implementing a full Restricted Access feature with OTP emails required mail server reconfigurations and threatened to delay the release. Corporate SSO integration was even more resource-intensive. However, Sales confirmed they could close early deals without SSO if we provided robust baseline protection against document copying.

Product decision

We made a strategic trade-off to launch faster. Instead of complex email verification, we shipped a “Protected Embed” mode in the MVP. Restricting document rendering to specific host URLs was significantly easier to build. This single feature addressed 80% of B2B needs—specifically securing documents shared via corporate intranets against external leaks.

Email and SSO authorization were moved to the backlog as plan-of-record items for Phase 2.

UI workaround

To avoid blocking the release, we introduced a minor UI compromise. We allowed users to set password protection as both a standalone mode and an optional modifier on top of Protected Embed. While slightly inconsistent from a pure information architecture perspective, it enabled the frontend team to reuse our legacy password logic. This saved weeks of dev effort and accelerated our MVP time-to-market.

Outcome

Collaborating closely with engineering saved months of costly backend development. We delivered a functional MVP in just 3 months, successfully reducing B2B customer churn and saving high-value sales deals.

We shelved the email verification and SSO backlog items, returning to them once the foundational system proved successful and was ready to scale.

Review and approval

I iterated on the information architecture and transition logic six times. Working closely with the PM, we refined the UX, while the CEO actively reviewed every prototype. The initial drafts were rejected, pushing us to simplify the flows until the logic was clear and intuitive for everyone.

Cross-functional alignment

I presented the final designs at a comprehensive cross-functional sync involving lead engineers, sales directors, and support managers. In our collaborative culture, collecting input from all departments was essential to ensure alignment before development.

When finalized, naming conventions were backed by market research. Together with the CEO, we agreed on working titles that met both user experience and marketing criteria.

Deliverables

I completed production-ready mockups for all core service areas and handed them over to engineering with extensive logic notes and edge-case documentation. During implementation, I oversaw the quality through structured design reviews.

UI logic

I designed a modular privacy settings panel built around a vertical stack of large radio-style cards. Clicking a card reveals inline settings inside the main panel, avoiding disruptive modal transitions or secondary screens.

Reducing cognitive load

The vertical layout functions as a progressive security scale. Users naturally scan down the list, moving from public access to strict privacy. This modular structure also made it easy to slot in complex future settings (like Restricted Access) without re-architecting the panel layout.

While password protection remained a standalone option, we also enabled it as an optional layer on top of other setups (Protected Embed, and later, Restricted Access). This technical trade-off retained a familiar flow for existing users while giving enterprise clients immediate configuration flexibility.

Product-Led Growth

Instead of hiding advanced settings or offering a stripped-down menu to lower-tier plans, we displayed all options with clear locked states. Users discover advanced product capabilities exactly when they need them—the moment they try to toggle a restricted mode.

Component design

I paid close attention to designing locked states for entry-level plans. I designed and added global system-locked states to our UI kit. This established a standardized visual design language for paywalls, which was then reused across other areas of the product.

Self upgrade

Interacting with a locked option triggers a contextual tooltip. We populated this tooltip with a brief value proposition for the business, a link to the help center, and a direct Upgrade button. This effectively embedded our self-serve sales funnel directly into the feature.

Future-proofing

The upsell mechanics proved most effective during Phase 2 when we launched Restricted Access. These advanced settings became the primary upgrade trigger for B2B accounts on entry-level plans, prompting them to move to Team or Enterprise tiers straight from the Privacy panel.

Results

What was once a utility menu became a powerful tool for Product-Led Growth. Analytics showed that the locked states and contextual tooltips delivered a ~20% increase in self-serve upgrades initiated inside the portal, entirely bypassing the sales team.

Prototyping

I built an interactive Figma prototype using advanced variables and conditional logic. It simulated the live app experience: users could toggle between the five core privacy modes, configure inline properties on cards, and interact with the locked states. This allowed us to validate key flows before writing any code.

Testing scope

I moderated 12 usability testing sessions via Zoom, complete with screen recording. The participant pool included 4 enterprise B2B customers, 4 lower-tier B2C users, and 4 colleagues from cross-functional teams. Segmenting the group was crucial to verify how advanced security settings affect the user experience of distinct audiences.

User tasks

1. Restrict document access so it can only be opened when embedded on the company’s corporate website.
2. In half of the sessions, users had to overlay a password on top of the embed restriction to test our most complex configuration scenario.
3. Revoke all access, making the flipbook completely private (Draft state).

Metrics

Success Rate, Time on Task, and the count of critical, unassisted errors.

Test findings

All 12 participants successfully completed the tasks with a median Time on Task of ~35 seconds. The tests confirmed that users instantly understood the vertical safety hierarchy, and stacking a password over Protected Embed felt intuitive. Validating this concept at the interactive prototype stage eliminated coding errors and saved valuable engineering resources.

Post-MVP insights

Post-launch metrics indicated a ~15% bump in B2B retention. While Protected Embed satisfied immediate business requirements, ongoing support feedback and feedback from high-value prospects made it clear we needed to deliver deeper capabilities.

Designing Restricted Access

In late 2024, we returned to our backlog to design the long-awaited Restricted Access mode.

From a UI standpoint, we housed this new feature inside a single radio card within our existing modular panel. Inside the card, we designed two tabs for different reader authentication methods: Email/Domain verification and SSO login. This approach kept the customizer interface compact and avoided adding cognitive noise.

UX mechanics: access lists

The main UX challenge for the Email/Domain access list was handling large volumes of entries. Managers in enterprise companies rarely add users one by one; they copy lists containing hundreds of addresses. I designed an input field that parses pasted raw text from Excel or Slack in real time. The system automatically detects delimiters, validates formats, filters out duplicates, and immediately renders clean tag badges.

Viewer authentication scenarios

Beyond the author’s admin panel, I designed the complete end-to-end authentication experience for the end viewer attempting to access a secured flipbook. I mapped out and designed the user flows for two distinct entry pathways: single-sign-on (SSO) login and email-based one-time password (OTP) verification. I also crafted all critical edge cases, including error states for invalid codes, session expiration screens, and clear 'Access Denied' states for unauthorized users.

Business impact

This delivered a powerful high-leverage tool for the sales team to close high-value contracts. Crucially, our design system proved highly resilient to scaling: the modular radio card pattern accommodated complex backend configurations within the existing customization panel.

Launch

We launched the Privacy MVP in Q1 2022, embedding the new settings panel globally across all touchpoints to ensure a cohesive user experience.

Results

• Privacy-related support tickets dropped from ~50 to ~10 per month post-MVP release.
• Conducted a live stakeholder demo at our all-hands meeting, equipping sales representatives to leverage the new privacy panel as a key differentiator in sales calls.
• Over 70% of enterprise accounts configured two or more security modes concurrently in the first three months.
• Implementing in-app locked states yielded a ~20% increase in self-serve subscription upgrades via CTA click tracking.
• The Q2 2025 launch of advanced privacy tiers directly unlocked major enterprise deals in the following quarter.