5 ms·

OP here, happy to answer your questions! Most importantly: We take privacy very seriously, none of your calendar data is stored, just tabulated, and as soon a

by remyp 8y ago

OP here, happy to answer your questions! Most importantly: We take privacy very seriously, none of your calendar data is stored, just tabulated, and as soon as we finish we remove the token so we can't access anything in the future. The ONLY thing we store is the tabulation and your email address (which is not made public) tied to that tabulation.

Signez 8y ago
If you really care about our privacy that much, please configure the GDPR popup in a way[0] that let your EU visitors to say that they are not allowing third party usage of their personal data. [0] https://www.leonpaternoster.com/posts/techradar-gdpr/ https://www.leonpaternoster.com/posts/techradar-gdpr/
- bwb 8y ago
  OP here, ya that shouldn't be. We used a GDPR service called ShareThis.com and I will check that as we do not share that with any 3rd party. [Update] - We are only doing 1st party consent so I will email their support to find out what the heck is going on with it showing that.
  - vintagedave 8y ago
    FYI: the button has only I Accept and Customize options; that may violate the GDPR by not providing a No option. When you click Customize, and manually turn off all options, the very next page you visit will show you the GDPR prompt again - and again. This definitely violates the consent statutes. Please let your provider know so they can fix this bug, and on either their or your side, provide an option for a clear No button, or at the very least a quick way to disable all.
- adtac 8y ago
  Interesting. I have a product (unreleased, still in private beta) that's in the privacy space. I want people to know I care about their privacy, and that absolutely no information is given to third-parties. What's the best way I can get GDPR compliant? I know that GDPR isn't designed to crack down on products like mine, but I'm still legally required to comply. A simple notice saying user data isn't given to any third parties? I have a privacy policy, of course.
  - gpm 8y ago
    Apart from a privacy policy I do not believe any notice is necessary. The "notices" you see on pages today are actually asking for consent to store data, but you don't need to do that if you aren't storing data. (IANAL) As for bragging about your privacy stance - well - that's a product design decision. Personally I'd probably do it on the "why you should use this" style pages and leave it out of any functional pages.
    - adtac 8y ago
      >The "notices" you see on pages today are actually asking for consent to store data Consent to store data or share it with third parties? I store PII, but I don't share it with any third-party.
      - jazzyjackson 8y ago
        Yea consent to collect it. Best way to comply with GDPR is read it carefully and/or hire a lawyer.
prepend 8y ago
Can you add an ability for me to upload a calendar file that I scrub out everything I don’t want you to have temporary access to?
- remyp 8y ago
  This is a really good idea we hadn't thought of yet, thank you! We'd even be able to use the exact same logic to do the calculations...
  - prepend 8y ago
    Thanks. This is a great idea, but just can’t expose my calendar, especially work.
    - bwb 8y ago
      Ah gotcha, thanks for the feedback as that helps us. Any chance you could tell me a bit more details @ ben@execution.com?
anyfoo 8y ago
Do you have a team working full time on the security of your service? Taking privacy seriously is necessary, but not sufficient for protecting that most sensitive data.
- bwb 8y ago
  Yes, security and privacy are the utmost concern for both of us. I want to stress we do not store any personal data, it only hits memory while we tabulate the results, and then we remove the token so we can't access it again. The only thing we store is your email to tie it to that tabulation.
  - anyfoo 8y ago
    When you say you "remove" the token, does it continue to be valid? If the token accidentally leaks (logs?), or if someone willfully intercepts it, will they have access to the calendar?
    - remyp 8y ago
      Depends on the service. Google allows us to invalidate the token when we're done, rendering it useless, so we do. You'll notice that if you run the stats tool again you'll have to re-authorize it for Google. Microsoft does not, so it will remain valid. We don't store it or log it anywhere, and the system that retrieves and processes data is not publicly accessible.
      - adtac 8y ago
        >We don't store it or log it anywhere I know you have good intentions here, but I hope you are aware that you may unintentionally be storing it somewhere [1]. Not much you can do about it unless you keep actively searching for it everywhere. [1] I strongly remember reading an article here on HN recently about some security breach stemming from writing production secrets in log files, but I can't find the link :/ If anyone else has it, can you post it?

by remyp 8y ago

Signez 8y ago

If you really care about our privacy that much, please configure the GDPR popup in a way[0] that let your EU visitors to say that they are not allowing third party usage of their personal data. [0] https://www.leonpaternoster.com/posts/techradar-gdpr/ https://www.leonpaternoster.com/posts/techradar-gdpr/

bwb 8y ago
OP here, ya that shouldn't be. We used a GDPR service called ShareThis.com and I will check that as we do not share that with any 3rd party. [Update] - We are only doing 1st party consent so I will email their support to find out what the heck is going on with it showing that.
- vintagedave 8y ago
  FYI: the button has only I Accept and Customize options; that may violate the GDPR by not providing a No option. When you click Customize, and manually turn off all options, the very next page you visit will show you the GDPR prompt again - and again. This definitely violates the consent statutes. Please let your provider know so they can fix this bug, and on either their or your side, provide an option for a clear No button, or at the very least a quick way to disable all.
adtac 8y ago
Interesting. I have a product (unreleased, still in private beta) that's in the privacy space. I want people to know I care about their privacy, and that absolutely no information is given to third-parties. What's the best way I can get GDPR compliant? I know that GDPR isn't designed to crack down on products like mine, but I'm still legally required to comply. A simple notice saying user data isn't given to any third parties? I have a privacy policy, of course.
- gpm 8y ago
  Apart from a privacy policy I do not believe any notice is necessary. The "notices" you see on pages today are actually asking for consent to store data, but you don't need to do that if you aren't storing data. (IANAL) As for bragging about your privacy stance - well - that's a product design decision. Personally I'd probably do it on the "why you should use this" style pages and leave it out of any functional pages.
  - adtac 8y ago
    >The "notices" you see on pages today are actually asking for consent to store data Consent to store data or share it with third parties? I store PII, but I don't share it with any third-party.
    - jazzyjackson 8y ago
      Yea consent to collect it. Best way to comply with GDPR is read it carefully and/or hire a lawyer.

prepend 8y ago

Can you add an ability for me to upload a calendar file that I scrub out everything I don’t want you to have temporary access to?

remyp 8y ago
This is a really good idea we hadn't thought of yet, thank you! We'd even be able to use the exact same logic to do the calculations...
- prepend 8y ago
  Thanks. This is a great idea, but just can’t expose my calendar, especially work.
  - bwb 8y ago
    Ah gotcha, thanks for the feedback as that helps us. Any chance you could tell me a bit more details @ ben@execution.com?

anyfoo 8y ago

Do you have a team working full time on the security of your service? Taking privacy seriously is necessary, but not sufficient for protecting that most sensitive data.

bwb 8y ago
Yes, security and privacy are the utmost concern for both of us. I want to stress we do not store any personal data, it only hits memory while we tabulate the results, and then we remove the token so we can't access it again. The only thing we store is your email to tie it to that tabulation.
- anyfoo 8y ago
  When you say you "remove" the token, does it continue to be valid? If the token accidentally leaks (logs?), or if someone willfully intercepts it, will they have access to the calendar?
  - remyp 8y ago
    Depends on the service. Google allows us to invalidate the token when we're done, rendering it useless, so we do. You'll notice that if you run the stats tool again you'll have to re-authorize it for Google. Microsoft does not, so it will remain valid. We don't store it or log it anywhere, and the system that retrieves and processes data is not publicly accessible.
    - adtac 8y ago
      >We don't store it or log it anywhere I know you have good intentions here, but I hope you are aware that you may unintentionally be storing it somewhere [1]. Not much you can do about it unless you keep actively searching for it everywhere. [1] I strongly remember reading an article here on HN recently about some security breach stemming from writing production secrets in log files, but I can't find the link :/ If anyone else has it, can you post it?