4 ms·

I'm not weighing in on Ecosia specifically (no direct knowledge), but... It's very important to remember the legal and liability requirements associated with p

by agar 6y ago

I'm not weighing in on Ecosia specifically (no direct knowledge), but... It's very important to remember the legal and liability requirements associated with privacy policies. In many jurisdictions, you are subject to liability if you collect something that was not disclosed in your privacy policy. Therefor, the default is to over-report. If there's a chance that something is collected, better to put it into the privacy policy. This is similar to the famous "California Cancer Warning" - the incentives to include everything, no matter the materiality, ultimately render the warnings useless. Any central server will "collect" everything typed into a text box. If it allows registration, requires password verification, perhaps offers customer support, it will disclose collection of "personally identifiable information" including email, phone number, possibly computer-specific information like browser, IP, installed version info, etc. Hosting on Amazon means it's shared with a 3rd party. And so on. Also, this seems crazy to the privacy conscious, but many consumers want Facebook integration. They ask for social logins, and easy ways to share via social media. Once those features are enabled to satisfy their users, they're subject to all the cruft that comes with those APIs - and need to disclose those in their privacy policies. None of the above means that a site is nefariously using the data it collects. Nor does it mean they do not take privacy very seriously. The interconnectedness of the web, legal requirements, litigious privacy advocates, and overarching privacy regulations (none of which are bad on their own) combine to make the Privacy Policy an almost useless signal of a company's actual privacy posture. That's why it's highly unfair to Ecosia for OP to so strongly imply they lie (or are, at best, misleading and hypocritical) and use your data nefariously, simply by excerpting a few lines of the Privacy Policy. The scare quotes, italicized "may"s, rhetorical questions, and other devices written to instill doubt and distrust makes me wonder about the agenda behind the message, frankly. Privacy is extremely important, but so is customer service and a viable business model. Suggesting that any product that collects data to run the business (and properly discloses it, as Ecosia does) will "do so for nefarious purposes" and does not "take user privacy very seriously" ("Right.") is unfair and undermines the work good people do to craft a viable balance in today's difficult tech ecosystem.

ignoramous 6y ago
Thanks, I get where you're coming from (that: privacy absolutists tend to throw the baby out with the bath water) but you misunderstand the point I was making. My gripe is with their claim that they protect privacy. If you're going to store user-data as-is for 7 days even if anonymized later and stored forever (for some definition of "anonymization", which is not a trivial thing to do), it doesn't come close to "protecting" anything. I don't have a horse in this fight, but I do build FOSS anti-surveillance / anti-censorship apps, and take offense at such misleading messaging. > It's very important to remember the legal and liability requirements associated with privacy policies. Why isn't it important to not mislead with headlines and FAQs? > Therefor, the default is to over-report. Wouldn't have to if one really took measures to "protect privacy" but when one can't / don't / won't ... then one may at least have the courtesy to be upfront about it. > Nor does it mean they do not take privacy very seriously. They claim to "protect your privacy". Their words, not mine. But the fine-print doesn't inspire confidence, even if written in CMA-style (though, that's a lame excuse). Or as they say, why not put money where your mouth is. > That's why it's highly unfair to Ecosia for OP to so strongly imply they lie (or are, at best, misleading and hypocritical) and use your data nefariously, simply by excerpting a few lines of the Privacy Policy. Thanks but it is not I that's hypocritical. You have it the other way around, I am afraid. > italicized "may"s, Here's the clause: "The anonymised data is saved for as long as is necessary for the evaluation. The data is not transferred to any third party. We will not access your data located outside of the app, such as your calendar, photos, messages or such like unless you have permitted us to do so." > Suggesting that any product that collects data to run the business... You're extrapolating the critique to the entire world, which you can, but you then don't get to dismiss it for one entity just because "the rest of the world can't survive without data collection". Ecosia may not need personal data to be running a viable tech business (which at its core is a wrapper on top of Bing with ad revenue going to afforestation efforts). > ...good people do to craft a viable balance in today's difficult tech ecosystem. Like someone else suggested in this thread: Just because you plant trees, you don't suddenly have a claim to being an "angel". Ecosia may have good people behind them or not, but I do care about honesty and earnestness. Also, I write FOSS software full-time, do I qualify for your "good people" list? :D

by agar 6y ago

ignoramous 6y ago

Thanks, I get where you're coming from (that: privacy absolutists tend to throw the baby out with the bath water) but you misunderstand the point I was making. My gripe is with their claim that they protect privacy. If you're going to store user-data as-is for 7 days even if anonymized later and stored forever (for some definition of "anonymization", which is not a trivial thing to do), it doesn't come close to "protecting" anything. I don't have a horse in this fight, but I do build FOSS anti-surveillance / anti-censorship apps, and take offense at such misleading messaging. > It's very important to remember the legal and liability requirements associated with privacy policies. Why isn't it important to not mislead with headlines and FAQs? > Therefor, the default is to over-report. Wouldn't have to if one really took measures to "protect privacy" but when one can't / don't / won't ... then one may at least have the courtesy to be upfront about it. > Nor does it mean they do not take privacy very seriously. They claim to "protect your privacy". Their words, not mine. But the fine-print doesn't inspire confidence, even if written in CMA-style (though, that's a lame excuse). Or as they say, why not put money where your mouth is. > That's why it's highly unfair to Ecosia for OP to so strongly imply they lie (or are, at best, misleading and hypocritical) and use your data nefariously, simply by excerpting a few lines of the Privacy Policy. Thanks but it is not I that's hypocritical. You have it the other way around, I am afraid. > italicized "may"s, Here's the clause: "The anonymised data is saved for as long as is necessary for the evaluation. The data is not transferred to any third party. We will not access your data located outside of the app, such as your calendar, photos, messages or such like unless you have permitted us to do so." > Suggesting that any product that collects data to run the business... You're extrapolating the critique to the entire world, which you can, but you then don't get to dismiss it for one entity just because "the rest of the world can't survive without data collection". Ecosia may not need personal data to be running a viable tech business (which at its core is a wrapper on top of Bing with ad revenue going to afforestation efforts). > ...good people do to craft a viable balance in today's difficult tech ecosystem. Like someone else suggested in this thread: Just because you plant trees, you don't suddenly have a claim to being an "angel". Ecosia may have good people behind them or not, but I do care about honesty and earnestness. Also, I write FOSS software full-time, do I qualify for your "good people" list? :D