Abstract
A writer can close a manuscript on a device without knowing whether the intended boundary around that manuscript has been established. Physical possession of the device, account or profile state, browser session, display and notification surfaces, local or synchronized file location, physical handoff, and recovery route may be different conditions. Treating them as one condition—my file on my device—can make a present custody question disappear before it has been named.
This paper introduces the custody gap: the difference between a writer’s intended control of a manuscript and the people, accounts, sessions, displays, locations, and recovery routes that may mediate it during one shared-device interaction. Its instrument, the Shared-Device Manuscript Boundary Card, records device custody, account/profile condition, screen/notification exposure, browser/session state, manuscript class, local/synchronized location, physical handoff pattern, recovery route, collaboration/participation need, unresolved exposure, and a mandatory non-conclusion. The Card is not a risk score or a test of whether a person has acted correctly. It makes it possible to state an intended boundary, retain observed conditions, identify one unknown, and ask a proportionate next question before local presence is treated as privacy.
The central question is not whether shared devices should exist. Shared access can be a vital route to education, care, public service, collaboration, and writing itself. The question is: whose custody conditions stand between this manuscript and the boundary the writer intended?
Closed is not contained
The comment is closed. The boundary is not.
A community-college editor has used a family-shared laptop to add a margin comment to a student manuscript. The comment asks the writer to separate a firsthand observation from a claim drawn from a cited report. The editor saves the document, closes it, and steps away. A shared browser profile remains open. A recent-file trace may be visible. A lock screen may show a notification. Or no visible trace may remain. The editor does not know. Later, at a public-library terminal, the editor tries to continue the same comment. The problem is no longer merely where the manuscript is stored. The problem is which custody conditions stood between the manuscript and the boundary the editor intended.
The scene is constructed. It does not report a real student, editor, family, library, browser, notification, account, or exposure. It does not say that another person reads the manuscript, that a library terminal retains it, or that a shared device has been compromised. Its purpose is to make a quiet distinction teachable: closing a file is an action; privacy is a boundary condition.
The shorthand my file on my device compresses several relations into one phrase. Who physically has the device? Which account or profile is active? Is a browser session present? What might appear on a display, in a notification, or on a lock surface? Is the manuscript locally present, browser-accessed, synchronized, copied elsewhere, or unknown? Is the device about to be handed back, reserved by someone else, left at a shared desk, or returned to an institution? How can the writer recover the manuscript or learn what condition existed? A person may know one answer and not the others. Local presence does not finish the custody question.
Public computing makes this difference visible, but the difference is not confined to public computing. The American Library Association’s guidelines for public-access computers note that use of a computer or network can create activity records and that documents, email, and other files containing private information can be left on a device. The guidelines separately address display screens visible to nearby people, browser data, access-control records, monitoring, and technological removal of individual-use traces. [1] This does not tell us what the library terminal in the scene actually retains. It shows why “the computer is public” is too broad to be a useful account. A screen, a session, a local file, a reservation record, and an institutional procedure are not one custody condition.
The same is true of a family-shared laptop or a classroom device. The United Nations Office of Information and Communications Technology distinguishes account sign-in, remembered state, browser history/cache/cookies, unattended use, and visible keyboard input when it discusses public or shared computers. [2] This paper does not turn that guide into individualized safety instructions. Its importance is conceptual. A document can be closed while an account, browser, or interface state remains a separate question. The writer needs words for the question before a confident assurance or broad warning becomes an answer.
Custody is not one relation
A manuscript’s custody is often spoken of as though it belongs to a single person or a single place. That language can be useful when it names an intended boundary. It becomes misleading when it erases the routes through which that boundary is mediated. The custody gap begins where intent and condition diverge: a writer intends a comment to remain within a particular editorial relation, but the device is shared; a writer intends a draft to be private, but the active profile is unknown; a writer intends to resume a note later, but the recovery route depends on an institutional procedure or another person.
The custody gap is not a claim that the boundary has failed. It is a map of what is and is not known. Seven surfaces help keep the map precise.
Device custody
Device custody asks who possesses, reserves, lends, returns, maintains, or may next use the hardware. This is a physical relation. It matters because the next person at a device may not be the person associated with an account, browser, or file location. It does not identify that next person as hostile, curious, or interested in the manuscript. The Card’s task is to record the handoff condition—family-shared desk, public reservation ending, shared workroom, classroom checkout, staff maintenance, or unknown—not to infer a motive.
Shared access can be socially meaningful. Ahmed and colleagues’ qualitative study of family mobile-phone sharing in Bangladesh reports 72 participants and describes sharing shaped by economic need as well as social and cultural practice. [3] That evidence does not describe the community-college editor’s laptop. It stops the paper from treating a shared device as proof that a person has failed to arrange a private life. A device can be shared because it provides care, communication, education, access, or participation. The question is not whether sharing should be eliminated. It is what the sharing condition means for this manuscript interaction.
Account and profile custody
Account and profile custody asks under whose identity context a manuscript is opened, saved, accessed, or left. A profile name can look like a boundary because it resembles a person’s name. The resemblance is not a complete account. A device might be used through a distinct account, a shared profile, a guest state, a borrowed session, an institutional identity, a browser-only route, or a condition the observer cannot identify. Each situation may shape what a writer can reasonably ask next, but none is a guarantee of privacy.
Household research makes the complexity visible. Mazurek and colleagues conducted semi-structured, in-situ interviews with 33 people in 15 households and report that people formed ad-hoc access-control mechanisms that did not always work. Their study also describes ideal policies as complex and multi-dimensional and finds that a policy specified in advance may be insufficient. [5] The study does not prescribe a manuscript practice or explain a particular family. It provides a limit on simple declarations. “Only I should see this draft” may be a clear intention while the account, device, purpose, relationship, timing, and recovery conditions needed to express that intention remain more complicated.
A profile can be a useful counterpoint without becoming the answer. Egelman, Brush, and Inkpen describe a family-account model studied with 16 families, eight using individual profiles and eight using a shared profile. In that model, the possibility of switching profiles with little interruption was used when privacy or personalization was needed. [7] The result does not describe contemporary systems, and it does not show that a profile resolves every custody surface. It does show why a Card should record profile condition instead of assuming that a single device is either wholly shared or wholly personal.
Browser and session custody
Browser and session custody concerns the route through which a manuscript is reached rather than the manuscript file alone. A manuscript may be opened through a browser, a document application, a campus service, an email attachment, a local folder, or a combination of routes. An active session, an open window, remembered state, account context, and sign-out state are distinct things to observe or mark unknown. The Card does not need to state what a particular browser does. It needs to make a question visible: What route was active when the writer stepped away, and do we know whether it changed?
This is where the constructed editor’s closed file is especially instructive. “The file was closed” tells us something. It does not tell us whether the editor was in a shared account, whether the browser route remained active, whether an earlier session persisted, or whether the next device user could encounter the same editorial service. A responsible analysis should not fill these blanks with imagination. It should preserve them as unknowns and state the appropriate next inquiry: perhaps an institutional support question, a shared-device practice question, a collaboration boundary, or no further conclusion.
Display and notification custody
Display and notification custody concerns information that may be encountered without opening a manuscript file. A title, author name, comment preview, message subject, recent document label, or account indicator can exist on a surface different from local storage. The American Library Association’s public-access guidance notes that screens may be visible to nearby people and that no screen configuration makes a display completely invisible. [1] The guidance is institutional and cannot establish what any real person saw. It nevertheless justifies treating the display as a condition in its own right.
Notifications supply a related but separate reason for precision. Verma and Patil’s study of smartphone notifications reports 206 participants’ preferences and practices, considers sensitive notification content, and examines experiences including unwanted information disclosure, intimacy breach, and inopportune intrusion. [4] The study concerns smartphones, not the laptop or library terminal in the constructed scene. Its contribution is methodological: a notification is not merely a property of a stored file. It is an independent surface through which information can be presented, withheld, or left unobserved. A Card can therefore say “possible notification surface; outcome not observed” without converting possibility into a disclosure claim.
Location and recovery custody
Location custody asks where the manuscript is during this interaction: locally present, browser-accessed, synchronized, copied to a removable location, transferred to a collaborator, stored on an institution-managed device, or unknown. The field is not a test of whether a storage location is good. It separates physical device custody from file location. A manuscript may be on a device that another person uses; a manuscript may be reached through an account that follows the writer to another device; a manuscript may be inaccessible to its author while still existing somewhere. These are different conditions.
Recovery custody asks how the writer expects to return to the material or determine what happened at a handoff. The answer might be an own account, a collaborator, a library procedure, an institutional support channel, a local copy, a next reservation, or unknown. Recovery deserves its own field because a writer’s ability to return is not the same as the question of who else may encounter the manuscript. The Card does not promise recovery. It records the path that is known and keeps the rest unresolved.
Participation custody
The final surface is participation custody. It asks what shared access enables. Without this field, a custody map can quietly assume that private ownership is always the solution and that shared infrastructure is merely a problem. Al-Ameen and colleagues’ cross-cultural qualitative study of 59 participants in Bangladesh, Turkey, and the United States investigates sharing of computers, phones, and online accounts across personal, social, and professional settings. [6] Their research does not tell us whether a specific manuscript is accessible to another person. It keeps the paper from universalizing the single-user device assumption. Sharing can make an education, a household arrangement, a public service, a working relationship, or a creative practice possible.
The Card therefore requires an explicit participation or collaboration need. A public-library terminal may make a manuscript reachable when a personal device is not available. A family-shared laptop may make a student comment possible after a work shift. A community lab may make editorial software available. Stating that access gain does not cancel questions about display, account, session, or location. It makes the inquiry honest about what would be lost if the only conclusion were “do not share.”
The Shared-Device Manuscript Boundary Card
The Shared-Device Manuscript Boundary Card records one bounded interaction. It can be completed after an observed episode, used as a teaching prompt, adapted by an editor or instructor planning a shared-device practice, or used by a research team to design an interview or diary inquiry. It does not demand a technical diagnosis. An entry may contain “unknown,” “not observed,” or “not established.” The Card’s action is to turn a vague sense of privacy into a specific boundary statement and a specific unanswered question.
| Card field | What to record | What the field prevents |
|---|---|---|
| Device custody | Who possesses, reserves, lends, returns, or may next use the device; or “unknown.” | Treating physical possession as identical to account, session, or file custody. |
| Account / profile condition | Distinct account/profile, shared account/profile, guest/session state, account handoff, or unknown. | Assuming a profile label proves private access. |
| Screen / notification exposure | What is observed or potentially visible on a display, lock surface, preview, or notification; or “not observed.” | Declaring an exposure occurred without observation. |
| Browser / session state | Open session, remembered state, browser path, sign-out state, or unknown. | Assuming a closed file settles the active access route. |
| Manuscript class | Draft, margin comment, source note, proof, collaborator message, administrative material, or another bounded class. | Treating all writing as equally sensitive or requiring the same boundary. |
| Local / synchronized location | Locally present, browser-accessed, removable location, synchronized location, transferred copy, unknown, or another observed state. | Inferring a storage path or deletion outcome from device type. |
| Physical handoff pattern | Borrowed device, returned device, public reservation ending, unattended pause, shared desk, staff handoff, or unknown. | Treating a handoff as a breach or assuming it is avoidable. |
| Recovery route | Own account, collaborator, institutional procedure, local copy, support channel, next reservation, or unknown. | Promising a return path or confusing recovery with privacy. |
| Collaboration / participation need | What shared access makes possible: education, care, editing, public service, collaboration, access, or another stated need. | Making private ownership the unstated normative answer. |
| Unresolved exposure | The narrowest unknown: screen preview, profile state, browser session, file location, next user, retention, or another condition. | Calling an unknown a confirmed vulnerability or harm. |
| Boundary statement and non-conclusion | The intended boundary for this interaction and what the Card cannot establish. | Turning a present-custody map into an audit, verdict, or accusation. |
A useful Card starts with a manuscript class and an intended boundary. “Keep it private” is too broad for one shared-device interaction. “Keep this editorial margin comment inside the named student-editor exchange until the next scheduled review” is a boundary that can be checked against a profile, display, session, handoff, and recovery condition. The Card does not tell the reader that the boundary has been met. It tells the reader what needs to be known before that claim can be made.
The non-conclusion is not an administrative disclaimer. It is an active teaching field. It may read: “This record does not establish that the next user can view the comment.” Or: “This record does not establish that the library terminal retains this file.” Or: “This record does not establish that the shared profile is private.” Such sentences protect the reader from turning an incomplete map into an event that has not been observed.
Three custody readings, not three device types
The following readings are constructed. They are not portraits of families, libraries, students, schools, or public terminals. Each holds the manuscript purpose steady while changing the present custody condition.
| Reading | Present interaction and intended boundary | Observed custody condition | Participation gain and unresolved exposure | Permissible non-conclusion |
|---|---|---|---|---|
| A. Family-shared comment | An editor adds a margin comment on a family-shared laptop and intends the comment to remain within the student-editor exchange. | The device is shared; the browser profile is shared or unknown; the document is closed; a display/notification surface is not observed after the editor leaves. | Gain: the editor can provide feedback from the available household device. Question: what profile/session condition should be confirmed before the comment is called private? | The record does not show that a family member sees the comment, that the browser persists, or that the device is unsuitable for editing. |
| B. Public-library continuation | The editor opens a source note on a public-library terminal and intends to preserve a next-step question for the scheduled review. | The terminal is institutionally shared; screen visibility, browser route, local location, reservation ending, and restoration procedure are distinct conditions, several unknown. | Gain: the public terminal makes the source note reachable. Question: which institutional procedure, if any, describes session/file handling for this interaction? | The record does not show that the library retains the note, that staff monitor it, or that public access is incompatible with manuscript work. |
| C. Community-lab recovery | A writer returns to a community-lab device to locate a prior proof annotation and intends to recover the annotation without widening its audience. | A shared workstation and possible account handoff are known; the precise file location and prior session state are unknown; a staff support route exists. | Gain: the lab gives the writer access to tools and a recovery route. Question: which conditions need confirmation before the proof’s audience can be described? | The record does not show that the proof was exposed, that support staff can access it, or that the writer will recover it. |
These readings should not be ranked. Reading A may have an available device but an unknown browser condition. Reading B may have an institutional context that makes a procedural question possible. Reading C may have a support route while the file’s former location remains unknown. None is a simple success or failure. The Card makes a specific custody question available before a general conclusion becomes tempting.
The readings also show why the participation field belongs beside the unresolved exposure field. The household laptop enables feedback. The public terminal makes a source note reachable. The community lab supports access to a proof and perhaps a question about recovery. Removing shared infrastructure from the story would remove those gains. Treating access as the only fact would remove the custody conditions. The framework’s job is to hold both in one record.
Action without a recipe
A practical framework can suggest a checklist of universal controls. This paper offers something narrower. After a Card is completed, a reader can take one of four proportionate editorial actions: state, confirm, preserve, or defer.
To state is to write the intended boundary in relation to one manuscript class and one interaction. “Only the author should ever see this device” is not a boundary the Card can investigate. “The unfinished peer-edit comment should remain within the named review exchange until the next meeting” is. To state a boundary does not make it true. It provides a relation against which observed custody conditions can be compared.
To confirm is to identify the smallest unknown that needs a source outside the Card: an institutional policy, a device-reservation practice, an account owner, a collaborator, a support channel, or a condition that cannot be observed. Confirming is not a demand that every unknown be resolved immediately. It prevents a reader from treating an unknown session or location as settled because the file was closed.
To preserve is to retain the observation and its non-conclusion. A record that says “screen exposure not observed; next user unknown; access gain: library terminal enabled source comparison” can be more responsible than an unfounded assurance or an inflated threat claim. Preservation is particularly important when the writer needs a later editor, instructor, support worker, or researcher to understand what was known at the handoff.
To defer is to refuse a privacy conclusion when the relevant condition cannot yet be named. Deferral is not inaction. It is an explicit boundary against overclaiming. The paper does not tell a reader to transfer a file, create an account, change a setting, stop collaborating, leave a public terminal, or acquire a private device. Those choices depend on the actual institution, relationship, device, material, and consequences. The Card gives a person a way to see which of those conditions needs to enter the conversation.
Conclusion: whose custody conditions stand between the manuscript and the intended boundary?
The community-college editor can eventually return to the comment. A library procedure may be known. A profile condition may be clarified. A recovery route may become visible. None of those possibilities changes the central lesson. The fact that a manuscript is locally closed does not show that the conditions mediating its intended boundary have been named.
The custody gap is not an accusation against a family member, library worker, student, institution, or writer. It is a way to distinguish intent from the current conditions of device possession, profile/account use, session state, display/notification surface, location, handoff, recovery, and participation. The Shared-Device Manuscript Boundary Card turns that distinction into a present action: state the boundary, record the condition, name the access gain, identify the unresolved exposure, and stop where the evidence stops.
Only then can the reader ask the question that local presence had hidden: whose custody conditions stand between this manuscript and the boundary the writer intended?
References
[1] American Library Association. Library Privacy Guidelines for Public Access Computers and Networks, amended 2020.
[2] United Nations Office of Information and Communications Technology. “Safety Tips When Using a Public or Shared Computer.”
[3] Ahmed, Syed Ishtiaque, Md. Romael Haque, Jay Chen, and Nicola Dell. 2017. “Digital Privacy Challenges with Shared Mobile Phone Use in Bangladesh.” Proceedings of the ACM on Human-Computer Interaction 1(CSCW): Article 17.
[4] Verma, Priyanka, and Sameer Patil. 2021. “Exploring Privacy Aspects of Smartphone Notifications.” Proceedings of the 23rd International Conference on Mobile Human-Computer Interaction.
[5] Mazurek, Michelle L., et al. 2010. “Access Control for Home Data Sharing.” Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.
[6] Al-Ameen, Mahdi Nasrullah, Huzeyfe Kocabas, Swapnil Nandy, and Tanjina Tamanna. 2021. “We, three brothers have always known everything of each other”: A Cross-cultural Study of Sharing Digital Devices and Online Accounts. Proceedings on Privacy Enhancing Technologies 2021(4): 203–224.
[7] Egelman, Serge, A. J. Brush, and Kori Inkpen. 2008. “Family Accounts: A New Paradigm for User Accounts Within the Home Environment.” CSCW.