Nym: Multi-Country UX Research for Censorship-Resilient Privacy Tools
2023
Abstract
Shipping privacy tools into high-censorship regions meant balancing safety, speed, and local signal conditions. I conducted and executed end-to-end user research across rapid agile sprints, transitioning from discovery to delivery using a range of methods, including exploratory interviews, contextual inquiries, journey mapping, concept and usability tests, and a comparative protocol performance study. I also designed and executed a multi-country survey, alongside remote moderated user tests in 12 countries – including China, Russia, Belarus, Turkey, and Kazakhstan – to identify onboarding pain points and reliability issues on unstable networks. Throughout, I closely aligned with design, security, and network engineering teams via daily stand-ups and asynchronous updates, ensuring that GDPR-compliant consent and user safety measures were implemented at every step.

The Challenge
Nym builds a decentralised VPN service on top of its global mixnet, meaning there is no single provider logging user traffic that governments or data brokers could co-opt. The mixnet is secured and incentivised by a blockchain layer, and its packet-mixing and variable timing defences are designed to defeat modern traffic analysis (including AI-assisted correlation attacks). These technical features shaped how I framed threat models and research questions, focusing on real-world adversaries, such as state-level censors, and how everyday users perceive privacy and performance under those conditions.
A core workstream of this project translated perceived reliability issues into measurable criteria under hostile network conditions (like deep-packet inspection and throttling). Working with R&D, I evaluated several families of censorship-circumvention protocols, including obfuscated variants of WireGuard, OpenVPN, Shadowsocks, V2Ray, and Tor (with bridges), to compare their behaviour in the wild. We focused on metrics such as connection success rates, time to first connection, frequency of drops and reconnections, and detectability risks (e.g. distinctive handshakes or DPI triggers). This comparative study revealed key reliability trade-offs and informed concrete product decisions. Notably, we changed the default “Fast Mode” transport to an obfuscation-first protocol in sensitive markets, simplified the fallback ladder and error messaging for clarity, and optimised connection handling to boost user trust. We also slimmed down the app install package to ease distribution in places where app store access is blocked. These changes improved first-connection success and overall resilience for users in environments with heavy censorship.
Behind the scenes, I owned the research plan, participant screeners, and moderator guides, setting success criteria that directly informed product and engineering decisions. The mixed-methods design combined remote one-on-one sessions across the 12 countries with a structured survey and targeted network experiments under adverse conditions. To support research participants in censored zones, I introduced low-bandwidth testing protocols, strengthened consent and data security practices, and enforced strict data minimisation to protect participant anonymity. These operational safeguards ensured we could gather rich insights ethically, even under high-risk conditions.
Conclusion
I documented the research operations end-to-end, from participant safety guidelines to redacted findings for internal sharing, to maintain transparency and reproducibility. I translated our insights into actionable outputs: design recommendations and UX copy guidelines for unreliable connectivity scenarios, QA checklists for low-bandwidth and offline resiliency, and a risk-aware rollout plan for the new connection protocol. This work directly underpinned the Fast Mode update and subsequent usability improvements. In the end, our research not only strengthened Nym’s product for censorship-heavy markets but also demonstrated Nym’s leadership in privacy tech, delivering a tool robust against both traditional surveillance and emerging AI-driven traffic analysis threats.


