I'm running a link shortener on shared hosting. No SSH, FTP-only deploys, no background workers, no Redis. Every time I wanted to add something "proper" — a job queue, a WebSocket, a cache layer — the hosting said no. So I didn't.

The result: click notifications go out via a cron job that hits a PHP endpoint once an hour. No queue, no retry logic, no worker process. It either sends or it doesn't, and I log the outcome. Six months in, it works fine.

If I'd had a VPS from day one I'd have built something I'd still be maintaining. The shared hosting said "you get a cron and a database" and that turned out to be enough.

  The interesting design question isn't "can we collect this" — it's "what do we lose by not collecting it."                                                                                
                 
  I run a small web tool. Early on I considered session recording, heatmaps, keystroke timing. Every one of those would have made the product slightly better to optimize. I didn't add any of them. Not because of regulation, but because I didn't want to be in the business of explaining to users what I was doing with their cursor path.                                             
                                                            

The part that bothers me most isn't the mouse movements. It's that there's no symmetry employees can't see what Meta does with their cursor data the same way Meta can see what the employee's cursor does.