5 ms·

Ecosia starts their privacy policy with, "We protect your privacy." ...but when you dig in, they: 1. Use Facebook for "conversion tracking". 2. May collect m

Ecosia starts their privacy policy with, "We protect your privacy." ...but when you dig in, they: 1. Use Facebook for "conversion tracking". 2. May collect messages, photos, calendar information if you're using the app. 3. Hold on to personally identifiable information for upto 7 days post which they (pseudo)anonymize it to store it indefinitely. Now, without more information on how they do so, I'm not sure I'd trust the effectiveness of their anonymization, given they may store logs (and other metrics) "as long as necessary". 4. Integrate with advertisement platform run by Bing on the search pages (and so they 'don't control the data Bing collects'). Who reads privacy policies, right? Everyone just reads the headlines and FAQs. "Ecosia is a “privacy friendly” search engine. We take user privacy very seriously." Right. I wish they were upfront and admitted to collecting data instead of trying hard to convince they don't do so for nefarious purposes (in their own eyes, that is). https://info.ecosia.org/privacy https://info.ecosia.org/privacy

beardog 6y ago
Further, the difference between this and how Duckduckgo uses Bing is that DDG does a proper proxy without forwarding your IP or any info about you.
- toper-centage 6y ago
  Ecosia also does that
- ColinHayhurst 6y ago
  Microsoft knows what they both do, but ain't saying. Maybe they have the same contract or each syndidation partner has a unique one. Probably the latter. Trying getting a syndication partnership where you don't agree to pass on some part of the IP; I've not heard of anyone getting that but anecdotes is all I have. Microsoft (or Google in the case of their syndication partners) are not going to tell us.
bboygravity 6y ago
Rule #1 on the internet: the more a website screams something, the less it's true. Examples: "Our mission is to organize the world's information." (proceeds to organize the world's commercial brands and spam people based on what they do online) "We value freedom of speech." (proceed to literally ban the president, wrong opinions and alternative apps like Parler) "We value your privacy." (Every big"tech"/cloud company ever that sells your data and has an automated system in place to pass all data on to the NSA, authorities and anybody willing to buy data) "Download now" (not actually now, but after you get our download manager adware/cryptolocker) "Download full functional version for free now" (actually a limited trial that you get to use after you dump personal info) "Free trial, unlimited music downloads, cancel any time" (proceed to charge your credit card even though you cancelled the limited DRM download service on time. I'm looking at you Amazon Music)
- deleted 6y ago
  [deleted]
- kitkat_new 6y ago
  You imply that a website that does not mention tree planting at all, plants the most trees. Interesting. What would you recommend people to put on their website when they genuinely would want to provide a search engine that plants trees? Do you imply matrix.org being a protocol for closed islands for insecure, centralized silence instead of a protocol for an open network for secure, decentralized communication? Please start finding actual arguments instead of spreading superficial unfounded commentary.
  - notretarded 6y ago
    Impressive mental gymnastics there.
  - bboygravity 6y ago
    >> What would you recommend people to put on their website when they genuinely would want to provide a search engine that plants trees? Everything except lies. Simple. PS: I think the idea of a search engine like that is great (assuming the tree planting is done in a responsible way without destroy ecosystems). But I don't think implying to be privacy friendly when you're not really is great.
toper-centage 6y ago
The only place where Ecosia uses Facebook tracking, in on Marketing landing pages. If you don't land there from Facebook, i.e. If you go to the website directly, there is no Facebook tracking.
- Shared404 6y ago
  Just went directly to Ecosia's search page and disable tracking protection. This appears to be accurate.
  - ignoramous 6y ago
    Ecosia, especially since they lay claim to protect their user's privacy, shouldn't, in my eyes, have anything to do with Facebook regardless of where their integration points are. That said, my gripe isn't with their Facebook integration, it is with their dishonest privacy posture when the fine print reveals something else. They can do way better.
    - Shared404 6y ago
      I concur. I just thought it wise to check the above commentors statement just to make sure that what they said was accurate. I definitely agree about the fine print. I wish more companies would just say up front what they are going to do.
nalekberov 6y ago
Well if you say “we plant trees” people start to think of you as being an angel and being extremely good at everything you do. I don’t mind if they use environmental issues for their marketing interests, but this is so ridiculous to have such privacy policy.
acvny 6y ago
Something - friendly is just the same as Something - ready. If you remember the HD - ready TVs you know what it means.
Bellamy 6y ago
I think they mean: "We don't store all your search results for years and monetize you, like the other major search engines. Especially the biggest one, u know what I mean."
1vuio0pswjnm7 6y ago
Ecosia requires a User-Agent header else will block user and ask her to solve captcha. Few if any search engines ask for this additional identifier. Google. Bing, DuckDuckGo all work fine without it. Does Ecosia's privacy documentation explain why Ecosia is different.
kazinator 6y ago
And "Results by Microsoft". Uh, okay.
- Daho0n 6y ago
  DDG uses Bing too. Nothing wrong with that.
agar 6y ago
I'm not weighing in on Ecosia specifically (no direct knowledge), but... It's very important to remember the legal and liability requirements associated with privacy policies. In many jurisdictions, you are subject to liability if you collect something that was not disclosed in your privacy policy. Therefor, the default is to over-report. If there's a chance that something is collected, better to put it into the privacy policy. This is similar to the famous "California Cancer Warning" - the incentives to include everything, no matter the materiality, ultimately render the warnings useless. Any central server will "collect" everything typed into a text box. If it allows registration, requires password verification, perhaps offers customer support, it will disclose collection of "personally identifiable information" including email, phone number, possibly computer-specific information like browser, IP, installed version info, etc. Hosting on Amazon means it's shared with a 3rd party. And so on. Also, this seems crazy to the privacy conscious, but many consumers want Facebook integration. They ask for social logins, and easy ways to share via social media. Once those features are enabled to satisfy their users, they're subject to all the cruft that comes with those APIs - and need to disclose those in their privacy policies. None of the above means that a site is nefariously using the data it collects. Nor does it mean they do not take privacy very seriously. The interconnectedness of the web, legal requirements, litigious privacy advocates, and overarching privacy regulations (none of which are bad on their own) combine to make the Privacy Policy an almost useless signal of a company's actual privacy posture. That's why it's highly unfair to Ecosia for OP to so strongly imply they lie (or are, at best, misleading and hypocritical) and use your data nefariously, simply by excerpting a few lines of the Privacy Policy. The scare quotes, italicized "may"s, rhetorical questions, and other devices written to instill doubt and distrust makes me wonder about the agenda behind the message, frankly. Privacy is extremely important, but so is customer service and a viable business model. Suggesting that any product that collects data to run the business (and properly discloses it, as Ecosia does) will "do so for nefarious purposes" and does not "take user privacy very seriously" ("Right.") is unfair and undermines the work good people do to craft a viable balance in today's difficult tech ecosystem.
- ignoramous 6y ago
  Thanks, I get where you're coming from (that: privacy absolutists tend to throw the baby out with the bath water) but you misunderstand the point I was making. My gripe is with their claim that they protect privacy. If you're going to store user-data as-is for 7 days even if anonymized later and stored forever (for some definition of "anonymization", which is not a trivial thing to do), it doesn't come close to "protecting" anything. I don't have a horse in this fight, but I do build FOSS anti-surveillance / anti-censorship apps, and take offense at such misleading messaging. > It's very important to remember the legal and liability requirements associated with privacy policies. Why isn't it important to not mislead with headlines and FAQs? > Therefor, the default is to over-report. Wouldn't have to if one really took measures to "protect privacy" but when one can't / don't / won't ... then one may at least have the courtesy to be upfront about it. > Nor does it mean they do not take privacy very seriously. They claim to "protect your privacy". Their words, not mine. But the fine-print doesn't inspire confidence, even if written in CMA-style (though, that's a lame excuse). Or as they say, why not put money where your mouth is. > That's why it's highly unfair to Ecosia for OP to so strongly imply they lie (or are, at best, misleading and hypocritical) and use your data nefariously, simply by excerpting a few lines of the Privacy Policy. Thanks but it is not I that's hypocritical. You have it the other way around, I am afraid. > italicized "may"s, Here's the clause: "The anonymised data is saved for as long as is necessary for the evaluation. The data is not transferred to any third party. We will not access your data located outside of the app, such as your calendar, photos, messages or such like unless you have permitted us to do so." > Suggesting that any product that collects data to run the business... You're extrapolating the critique to the entire world, which you can, but you then don't get to dismiss it for one entity just because "the rest of the world can't survive without data collection". Ecosia may not need personal data to be running a viable tech business (which at its core is a wrapper on top of Bing with ad revenue going to afforestation efforts). > ...good people do to craft a viable balance in today's difficult tech ecosystem. Like someone else suggested in this thread: Just because you plant trees, you don't suddenly have a claim to being an "angel". Ecosia may have good people behind them or not, but I do care about honesty and earnestness. Also, I write FOSS software full-time, do I qualify for your "good people" list? :D

beardog 6y ago

Further, the difference between this and how Duckduckgo uses Bing is that DDG does a proper proxy without forwarding your IP or any info about you.

toper-centage 6y ago
Ecosia also does that
ColinHayhurst 6y ago
Microsoft knows what they both do, but ain't saying. Maybe they have the same contract or each syndidation partner has a unique one. Probably the latter. Trying getting a syndication partnership where you don't agree to pass on some part of the IP; I've not heard of anyone getting that but anecdotes is all I have. Microsoft (or Google in the case of their syndication partners) are not going to tell us.

bboygravity 6y ago

Rule #1 on the internet: the more a website screams something, the less it's true. Examples: "Our mission is to organize the world's information." (proceeds to organize the world's commercial brands and spam people based on what they do online) "We value freedom of speech." (proceed to literally ban the president, wrong opinions and alternative apps like Parler) "We value your privacy." (Every big"tech"/cloud company ever that sells your data and has an automated system in place to pass all data on to the NSA, authorities and anybody willing to buy data) "Download now" (not actually now, but after you get our download manager adware/cryptolocker) "Download full functional version for free now" (actually a limited trial that you get to use after you dump personal info) "Free trial, unlimited music downloads, cancel any time" (proceed to charge your credit card even though you cancelled the limited DRM download service on time. I'm looking at you Amazon Music)

deleted 6y ago
[deleted]
kitkat_new 6y ago
You imply that a website that does not mention tree planting at all, plants the most trees. Interesting. What would you recommend people to put on their website when they genuinely would want to provide a search engine that plants trees? Do you imply matrix.org being a protocol for closed islands for insecure, centralized silence instead of a protocol for an open network for secure, decentralized communication? Please start finding actual arguments instead of spreading superficial unfounded commentary.
- notretarded 6y ago
  Impressive mental gymnastics there.
- bboygravity 6y ago
  >> What would you recommend people to put on their website when they genuinely would want to provide a search engine that plants trees? Everything except lies. Simple. PS: I think the idea of a search engine like that is great (assuming the tree planting is done in a responsible way without destroy ecosystems). But I don't think implying to be privacy friendly when you're not really is great.

toper-centage 6y ago

The only place where Ecosia uses Facebook tracking, in on Marketing landing pages. If you don't land there from Facebook, i.e. If you go to the website directly, there is no Facebook tracking.

Shared404 6y ago
Just went directly to Ecosia's search page and disable tracking protection. This appears to be accurate.
- ignoramous 6y ago
  Ecosia, especially since they lay claim to protect their user's privacy, shouldn't, in my eyes, have anything to do with Facebook regardless of where their integration points are. That said, my gripe isn't with their Facebook integration, it is with their dishonest privacy posture when the fine print reveals something else. They can do way better.
  - Shared404 6y ago
    I concur. I just thought it wise to check the above commentors statement just to make sure that what they said was accurate. I definitely agree about the fine print. I wish more companies would just say up front what they are going to do.

nalekberov 6y ago

Well if you say “we plant trees” people start to think of you as being an angel and being extremely good at everything you do. I don’t mind if they use environmental issues for their marketing interests, but this is so ridiculous to have such privacy policy.

acvny 6y ago

Something - friendly is just the same as Something - ready. If you remember the HD - ready TVs you know what it means.

Bellamy 6y ago

I think they mean: "We don't store all your search results for years and monetize you, like the other major search engines. Especially the biggest one, u know what I mean."

1vuio0pswjnm7 6y ago

Ecosia requires a User-Agent header else will block user and ask her to solve captcha. Few if any search engines ask for this additional identifier. Google. Bing, DuckDuckGo all work fine without it. Does Ecosia's privacy documentation explain why Ecosia is different.

kazinator 6y ago

And "Results by Microsoft". Uh, okay.

Daho0n 6y ago
DDG uses Bing too. Nothing wrong with that.

agar 6y ago

I'm not weighing in on Ecosia specifically (no direct knowledge), but... It's very important to remember the legal and liability requirements associated with privacy policies. In many jurisdictions, you are subject to liability if you collect something that was not disclosed in your privacy policy. Therefor, the default is to over-report. If there's a chance that something is collected, better to put it into the privacy policy. This is similar to the famous "California Cancer Warning" - the incentives to include everything, no matter the materiality, ultimately render the warnings useless. Any central server will "collect" everything typed into a text box. If it allows registration, requires password verification, perhaps offers customer support, it will disclose collection of "personally identifiable information" including email, phone number, possibly computer-specific information like browser, IP, installed version info, etc. Hosting on Amazon means it's shared with a 3rd party. And so on. Also, this seems crazy to the privacy conscious, but many consumers want Facebook integration. They ask for social logins, and easy ways to share via social media. Once those features are enabled to satisfy their users, they're subject to all the cruft that comes with those APIs - and need to disclose those in their privacy policies. None of the above means that a site is nefariously using the data it collects. Nor does it mean they do not take privacy very seriously. The interconnectedness of the web, legal requirements, litigious privacy advocates, and overarching privacy regulations (none of which are bad on their own) combine to make the Privacy Policy an almost useless signal of a company's actual privacy posture. That's why it's highly unfair to Ecosia for OP to so strongly imply they lie (or are, at best, misleading and hypocritical) and use your data nefariously, simply by excerpting a few lines of the Privacy Policy. The scare quotes, italicized "may"s, rhetorical questions, and other devices written to instill doubt and distrust makes me wonder about the agenda behind the message, frankly. Privacy is extremely important, but so is customer service and a viable business model. Suggesting that any product that collects data to run the business (and properly discloses it, as Ecosia does) will "do so for nefarious purposes" and does not "take user privacy very seriously" ("Right.") is unfair and undermines the work good people do to craft a viable balance in today's difficult tech ecosystem.

ignoramous 6y ago
Thanks, I get where you're coming from (that: privacy absolutists tend to throw the baby out with the bath water) but you misunderstand the point I was making. My gripe is with their claim that they protect privacy. If you're going to store user-data as-is for 7 days even if anonymized later and stored forever (for some definition of "anonymization", which is not a trivial thing to do), it doesn't come close to "protecting" anything. I don't have a horse in this fight, but I do build FOSS anti-surveillance / anti-censorship apps, and take offense at such misleading messaging. > It's very important to remember the legal and liability requirements associated with privacy policies. Why isn't it important to not mislead with headlines and FAQs? > Therefor, the default is to over-report. Wouldn't have to if one really took measures to "protect privacy" but when one can't / don't / won't ... then one may at least have the courtesy to be upfront about it. > Nor does it mean they do not take privacy very seriously. They claim to "protect your privacy". Their words, not mine. But the fine-print doesn't inspire confidence, even if written in CMA-style (though, that's a lame excuse). Or as they say, why not put money where your mouth is. > That's why it's highly unfair to Ecosia for OP to so strongly imply they lie (or are, at best, misleading and hypocritical) and use your data nefariously, simply by excerpting a few lines of the Privacy Policy. Thanks but it is not I that's hypocritical. You have it the other way around, I am afraid. > italicized "may"s, Here's the clause: "The anonymised data is saved for as long as is necessary for the evaluation. The data is not transferred to any third party. We will not access your data located outside of the app, such as your calendar, photos, messages or such like unless you have permitted us to do so." > Suggesting that any product that collects data to run the business... You're extrapolating the critique to the entire world, which you can, but you then don't get to dismiss it for one entity just because "the rest of the world can't survive without data collection". Ecosia may not need personal data to be running a viable tech business (which at its core is a wrapper on top of Bing with ad revenue going to afforestation efforts). > ...good people do to craft a viable balance in today's difficult tech ecosystem. Like someone else suggested in this thread: Just because you plant trees, you don't suddenly have a claim to being an "angel". Ecosia may have good people behind them or not, but I do care about honesty and earnestness. Also, I write FOSS software full-time, do I qualify for your "good people" list? :D