Diagnose a Sudden Single-Day Wave of Slack Extension Uninstalls

You discover that, within a single day, 20% of the users of a Slack extension uninstalled it. Explain the assumptions you would make about the situation, then describe what you would look into, and in what order, to find the root cause. ```hint Who can press uninstall? A drop this large in one day rarely comes from a slow trend. Think about every actor or event that can remove the extension besides an individual user changing their mind, and about what changed on that specific day. ``` ### Clarifying Questions - What exactly is the "Slack extension": a browser or desktop add-on, one app installed into Slack workspaces, or third-party apps on the platform as a whole? Are we the team that builds it or the team that runs the platform it lives on? - How is the 20% measured: uninstalls by individual users or by workspaces, and against which active-user base? Could one administrator removing the app for a large organization account for most of it? - Did the uninstalls arrive in one burst or spread across the day, and is the elevated rate continuing? - Is the spike concentrated in a particular client (desktop, web, mobile), extension version, region or plan (free, paid, enterprise)? ### What a Strong Answer Covers - Explicit assumptions about what the extension is, who can remove it and how the 20% is calculated, stated before any diagnosis. - Verification that the spike is real rather than a logging, metric-definition or bulk-removal artifact. - Segmentation that localizes the spike, especially by who performed the uninstall and how concentrated it is across workspaces. - Internal and external hypotheses tested in a sensible order, each paired with the evidence that would confirm or rule it out. - A next step once the cause is found, including how to stop further losses. ### Follow-up Questions - The data show that most uninstalls came from a few large enterprise workspaces where administrators removed the app within the same hour. What do you do next? - Many of the users who uninstalled reinstalled the extension the next day. How does that change your diagnosis and the way you report the metric? - What monitoring would have caught this spike within hours instead of after a full day?