Also worth noting that I think regular internal privacy conventions should overlap with external API conventions as much as possible