There's a quiet accounting error almost every consumer-app team makes in its first year. The dashboard says a million users. The instinct is to treat that as a million assets. It isn't. If those users reach a service through an embedded third-party web page, what you own is a hallway, not the rooms behind it.
Let me make the mechanism concrete, because the loss is technical, not rhetorical.
When you drop a third-party H5 into a webview, that page runs on the service provider's origin. Its cookies, its local storage, its session — all scoped to them, not to you. The identity your user establishes inside that flow belongs to the provider. The transaction data lands in the provider's systems. The post-purchase relationship — refunds, re-engagement, the next offer — lives there too. You captured the click. You captured nothing that compounds.
This is the difference between traffic and an asset, and most teams don't notice until they try to activate the audience a second time and find they can't.
What you actually own, side by side
| Dimension | Embedded third-party H5 | Mini-program runtime (host-owned) |
|---|---|---|
| Identity | Provider's origin owns the session | Host's own account system |
| Data ownership | Sits with the third party | Accumulates in host's store |
| Re-engagement | Cut off when the tab closes | Host messaging channel recalls |
| Relationship graph | Belongs to the embedded service | Host owns the user graph |
| Regulatory posture | Host may not be the data controller | Host is first-party controller |
| Portability | Locked to the third party | Host-controlled, portable |
The cost shows up in three places.
First, re-engagement. A webview session ends when the user closes it. You don't have a durable channel back to that person; the provider does. The next time you want to say "your order shipped" or "here's a perk," you're asking the provider's permission, or you're buying the audience back through ads you already paid to acquire once.
Second, the data graph. The relationship between a user and a service — what they bought, how often, what they abandoned — is the most valuable dataset a consumer business produces. In a third-party H5, that graph belongs to the embedded service. You see an aggregate you don't control. A host-owned runtime writes every event into the host's own store, so the graph compounds inside your business.
Third, and this is the one teams underweight, regulatory exposure. Under frameworks like the EU's GDPR, Brazil's LGPD, and India's DPDP Act of 2023, the question of who is the data controller or fiduciary is not academic. When a third party processes user data inside your app, you may not be the controller — which means you've handed off both the control and the liability for the most sensitive part of your operation, while still carrying the brand risk when something goes wrong.
None of this means H5 is useless. For a one-time campaign — drive traffic, convert once, forget — an embedded page is cheap and fine. The error is treating it as infrastructure. Infrastructure is what you own. A rented storefront is not.
This is the part the super-apps understood a decade ago, and it's worth stating plainly because it's the actual source of their valuations. WeChat, Alipay, Grab, Gojek did not build "websites you click." They built identity, a wallet, and a messaging channel as owned infrastructure, then let thousands of merchants run inside that runtime. The commerce layer sat on top of a relationship the platform controlled end to end. The eyeballs were never the asset. The owned relationship was.
A mini-program runtime is the mechanism that reproduces that structure without rebuilding a super-app from scratch. When services run inside the host's runtime, the host supplies identity, wallet, and notification — so every interaction writes into the host's own accounts, not the provider's. The user becomes a record you hold, not a visitor the provider logs.
I'd push back on one romantic version of this. Owning the runtime does not mean owning the user in the extractive sense — lock-in for its own sake. The durable advantage is narrower and more defensible: it converts a relationship you were renting, and could lose the moment the provider changes terms or gets pulled from the store, into an asset that survives those shocks because it lives in your systems. You stop being a traffic provider that rents its audience to someone else's service, and start being a platform that owns the shelf, the register, and the customer list.
That's the real line. Traffic is rented. Assets are owned. A runtime is how you move from one column to the other.
