3 ms·
I understand the privacy concerns, but for me, if I'm prepared to outsource my email to Google then how different is it to let other SaaS scan my inbox to provi
by vertis 8y ago
I understand the privacy concerns, but for me, if I'm prepared to outsource my email to Google then how different is it to let other SaaS scan my inbox to provide their service (I accept size is one factor).
The Privacy Policy of Leave Me Alone is pretty clear on their respect for my data (not selling it).
If they don't respect this policy, it's going to get found out eventually, and it's going to hurt their business and their future reputation as founders.
Their incentives are in the right place to behave in the way that they've stated.
Security could be a concern as well, but it's all done within the framework that Google has created. Tokens can be revoked (if one desires, immediately).
Which just leaves the servers being compromised before/during the interaction. This isn't impossible and is something that LeaveMeAlone should definitely be considering. However, A breach potentially means the end of their business. This makes me trust, again, that their incentives are in preventing this from happening and investing in hardening the servers (etc).
- gnicholas 8y ago> if I'm prepared to outsource my email to Google then how different is it to let other SaaS scan my inbox to provide their service...If they don't respect this policy, it's going to get found out eventually, and it's going to hurt their business and their future reputation as founders. The likelihood that some small SaaS shop will be found out for unethical/illegal behavior is much smaller than Google being found out. It does look like their hearts are in the right place, for what it's worth. But there's no way for them to promise never to sell to someone interested in monetizing the data.
- jivings 8y agoThanks for the kind words. I think the only way we can make this promise is by doing what we're doing right now and not actually storing any email content. I'm not sure the best way to prove that this is what we're doing, short of open sourcing the code, so I'm open to suggestions there!
- royosherove 8y agoHold public audits by a trusted 3rd party to show you are not keeping any data - on a repeating basis (6 months?)
- jivings 8y agoWe're already required to perform an audit by Google every 12 months (I've mentioned the requirements of this below, but it basically amounts to the same thing), would this be acceptable?
- gnicholas 8y agoWhat are the details of this? I've seen how things work on the Chrome Store side, and it's completely haphazard. There isn't an official audit schedule, as far as I can tell, but like with the iOS App Store, they do sometimes decide to flag/remove an extension for completely bogus reasons, with little/no notice: https://medium.com/@BeeLineReader/google-yanked-my-chrome-extension-this-sunday-d9c481e285cb https://medium.com/@BeeLineReader/google-yanked-my-chrome-ex...
- jivings 8y agoAs of this year with apps that access the Gmail API it is an official audit by an authorised third party assessor. More info here: https://cloud.google.com/blog/products/g-suite/elevating-user-trust-in-our-api-ecosystems https://cloud.google.com/blog/products/g-suite/elevating-use...
- gnicholas 8y agoThat's great. I'd emphasize this both in the privacy policy and in the FAQ. It's not bulletproof, but it goes a long way.
- tux1968 8y agoIt would be interesting if you could define a restricted-API for email, with just enough functionality to provide your service. The issues right now is that there is no fine-grained way to grant permission to ones email, it's all or nothing. Of course, it might take a long time for email providers to offer such restricted-API access, if ever. As a stop gap, you could offer an open-source daemon your users could self-host. It would act as a gateway, granting you limited access to their email, without you needing their password or cart-blanche permissions.