8 ms·

The start-up code of conduct and ethics

37 points by vijaydev 15y ago

vaksel 15y ago
it seems pretty restrictive in the early stage you are required to build extra features....and in the later stage you are requiring the acquirer to agree to this
- jacquesm 15y ago
  It's actually not that bad. The first section 1.1 through 1.5 is roughly what the EU law would have you do anyway, 1.6 is a good way to tell your users that you don't intend to use the service as a pre-text to harvest more data on them than you need. The second part has some issues that would come up in an acquisition, but think about it, if you are placing the wants and needs of an acquirer ahead of those of your users then you should have never started that company to begin with, after all, it is more than likely that your users are what gave you the platform to get the acquirer interested. A 'pure' team acquisition that kills the product post acquisition is about as bad as it gets from a user point of view and if you intend to do that then maybe you should clarify that up-front instead of when it is two minutes to twelve. Killing off APIs willy nilly is a very bad nono imo, you basically create an avalanche of fall-out the consequences of which are probably hard to envision, especially if your API becomes important enough that people will start to build commercial services around it.
  - synnik 15y ago
    I think you are being unrealistic about acquisition. I hear way too many discussions on HN about monetizing your products, and people looking for their big exit/payday. People are not going to give up their exit plan because of an idealistic "code of ethics" for their users.
    - jacquesm 15y ago
      I think we all speak for ourselves here. Maybe it is true that not many companies would require an acquirer to continue to run the service as it was at the moment of acquisition (or better!), but I think those that do want to make such a commitment to their end users should get a leg up. If someone offered to buy out the sites that I run in order to shut them down I would refuse.
      - rdl 15y ago
        Actually I think it would be cool to ask ~10 big acquirers, both of talent and of products/tech, to see how they'd feel about deals with these terms. Google seemed ok with Etherpad running in parallel for a while. The concerns seem to be: * Acq wants to be able to develop their own products with the tech, less competition -- shutting off system supports that, but so does disabling new account creation on it, and making your own product superior. Some changes seem ok, some seem borderline (flickr -> yahoo login), but just shutting down a service is different. * Wanting full resources of the team -- running the old site on autopilot * If the old service is inherently unsustainable (patent/IP issues, negative marginal income, ...); the former might be a big deal (although YouTube won by having the Google lawhammer on their side), and the latter might not be a big deal if the absolute dollar value involved is low relative to the deal. Even if a deal ends up being 5% less due to the requirement that the service stay operating after acq, if it makes user acq easier so you get 2x more users and thus a 2-10x higher valuation, it's win/win/win/win (acq, founders, investors, users).
BrandonMTurner 15y ago
I am developer at a small start up, in terms of company size at least. There are only 4 people in the company and I the only full time developer. The CEO is technical and writes code half of the time himself as well. Though, while small in size, we have roughly 1.5M uniques per month. Only a small part our service is read only / consumption based (the forums and other social networking features). Based on the nature of what our service does we end up collecting a lot of information on all of our users. Non financial information, but most of the information we have about users they would never want other people to know or find out about. Each day the average active user gives about 10-15 new bits of information (willing-fully, thats why they use our service, we are not just tracking users to get the information). That being said, a lot of users when they close their account contact us and demand us to verify we have deleted all of our their information. We do our best to anonymize by blanking out their name, location, email address, etc... in our database. Then we mark the account no longer active. However, we can never confirm their data is fully gone. We can not retroactively go back and remove them from our countless number of backups. We snapshot ever night and keep the backups for differing amount of time. Since we can never get rid of them via the backups, which basically are just as good (if stolen, leaked, etc..) as the data in our live database we can never confirm their data has been deleted. Would this mean we would be breaking this code of conduct? If so, that would make this code of conduct way to burdensome for any start up or company to follow. (Not to mention other things in there besides the data retention policy that make this way to much for any start up to promise to follow)
- jacquesm 15y ago
  Backups are hairy, from what I understand the EU directives on user privacy require that you delete the data from you normal business processes and you warrant that this data will never again be used actively or passively after the user requires deletion. The way I deal with this particular requirement on my site is that if a user requests removal that the deletion request is archived separately after the deletion. If I should have to roll-back a database from a back-up then I will run all the deletions against it that were made since the time that the backup was made. I'm not 100% sure if that is in compliance with the law but it is a pretty gray area. As far as I'm concerned I would say that you are doing just fine and that you operate to the spirit of the document even if you can't guarantee that in the most extreme cases you'd be following it to the letter. And that 'spirit' is exactly what this is all about.
patio11 15y ago
No offense, early adopters, but if you desire a SLA like this one from me, you'd better get moving because only one person will ever get one and my girlfriend looks like she is the odds-on favorite. This strikes me as optimizing for the somewhat quirky preference set of a group of people who do not pay money for software. (People who do pay money for software have an easy mechanism for determining what they are owed: check the contract, if it says you're owed it, you're owed it, if not, you're not.) Their opinion may, possibly, be relevant, but I wouldn't really go out of my way for it without a darn good reason for why. There are few startups on HN for whom API stability 18 months from now is a life-or-death issue for their startup. There are, almost certainly, juicier fruits which hang lower for your marketing than guaranteeing your API stability in the event of an acquisition or death of your startup. If you doubt this, please, post a statement of User Rights or what have you on your website. Count the clicks to it. People's revealed preference is that they do not care. They might think they care, they might even say they care ("How dare this Mobisocifotogame that I read about on HN close without letting me download the 5 minutes of attention I put into it in a convenient-to-use XML file?!"), but they do not make decisions based on this. Spend your time on things that actually influence decisions they make, like e.g. button colors. Seriously. Tweaking button color on your signup form will, provably, do more for your business than optimizing for the opinions of folks who flit between new web services like mayflies with less spending power.
- jacquesm 15y ago
  It's voluntary :) People's revealed preference is that they do not care until they get bitten. And then they care very much. So we can and should do better than the bare minimum, and better than 'what users ask for' before they get bitten. That you do not care is a different story altogether, but consider that if you align your users' interests with your own that you probably stand a much better chance of success than if you do not. Sure, 'greed is good' and all that but in the end, company data being sold in bankruptcy proceedings is simply bad, companies giving several days warning before shutting down (http://news.ycombinator.com/item?id=2770257 http://news.ycombinator.com/item?id=2770257) are not helping anybody (not even themselves), and Yahoo!'s shutting down Geocities still reverberates around the web (especially the way they went about it, for a pittance they could have continued to at least store the data). My inbox fills up daily with people that thought they had an agreement with one of the largest companies on the web and it turned out they got hurt badly. Big or small, it does not matter. We are all operating by the grace of our users and those people that put their own interests ahead of those of the users are hurting all of us. Maintaining this sort of integrity is not a cost, it is a long term benefit, for everyone.
preinheimer 15y ago
These sound all nice and friendly, but they're not feasible for me. If you've paid me, use the service for a time, then ask me to delete all data associated with your account, I've got nothing to fight a chargeback with. Shutting down after losing a patent (or other) lawsuit, then open sourcing the aplicable software seems wrought of peril. 6 months notice is feasible for a paid service, but not so much for a free one.
- jacquesm 15y ago
  > then ask me to delete all data associated with your account You may not even have that option: http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.HU http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.HU As for keeping the history for anti-chargeback purposes, it is my understanding that you are allowed to keep username and log in data and your IPSP will have the rest of the information that you'd need to fight a chargeback. Also, someone requesting deletion of their data would make it pretty easy to fight that chargeback because they're providing you with auxiliary proof (the request itself) that they've been active users of your site. The patent claim is a good one, I'll have to think about that. Keeping a free service 'up' without allowing new data to be entered in to the system post shutdown without support or development costs a very small fraction of what it would cost to run the service in an active way. For example, Yahoo! claimed that running Geocities cost them tens of millions of dollars annually, and yet, somehow I can maintain a large fraction (how large a fraction we'll never know) of their accounts up and running for approximately $500 / month. The problem with giving notice is that many people will never get your notice, even when given 6 months ahead of time. Imagine dropbox shutting down their free accounts overnight. It's technically within their rights. Ditto google docs and a myriad of other services that people come to rely on.
  - preinheimer 15y ago
    > As for keeping the history for anti-chargeback purposes, it is my understanding that you are allowed to keep username and log in data and your IPSP will have the rest of the information that you'd need to fight a chargeback. If I'm keeping your username, your login and usage history (likely IP address) to fight the chargeback, I haven't deleted all your data by a long shot. > Keeping a free service 'up' without allowing new data to be entered in to the system post shutdown without support or development costs a very small fraction of what it would cost to run the service in an active way. Keeping anything running has cost, you don't just stand up a machine, step back, and hope for the best. There's maintenance, patches, IDS work, etc. Hitting a "read only" flag in your software (presuming it exist) doesn't make the machine invulnerable.
rdl 15y ago
A one-size-fits-all is not going to work, I think. The correct model is probably something similar to the Creative Commons model -- create a few bundles of rights, let creators/site operators compose them, creating a 2x2 matrix of licenses or whatever. For instance: 1) Ownership of content/derived rights 2) Persistence of terms through exit (bankruptcy, sale, change of control...) 3) Revocability (can never, can easily, or can after N day waiting period during which users may delete all data, or opt in/out of new terms...) 4) Law enforcement: we'll actively bend over/cooperate like eBay, or we will require warrants and resist to the extent legally allowed, or technical countermeasures, plus which jurisdictions (I'm usually fine with USA law, but wouldn't want my content under e.g. Saudi law) 5) ... This matters more for power users and API users (developers) than for casual users, but I agree something like this is necessary.
- jacquesm 15y ago
  That is a very good idea!
  - cesar 15y ago
    The creative commons comparison is a good idea. I wonder if you could put it into github, then people could just fork it, make their changes and use it. Just a thought.
gojomo 15y ago
This seems like an anti-pivot poison pill.
- jacquesm 15y ago
  I would say the sweet spot for defining your users rights is right after you gain some major traction and before any kind of exit is even on the horizon. And definitely before other companies start to rely on you, and/or network effects have put you in a position where you can afford to screw people over. Probably it would be a good idea to have your business model figured out as well. A side effect of this is that it may force you to think a bit harder over whether you want to support this creation for an extended period, and that alone might be enlightening. So, pivot to your hearts content, but when you feel you have a 'live one' define your users rights and stick to it.
4J7z0Fgt63dTZbs 15y ago
This kills off the root motivation to be Samaritan with power. If everyone can copy and paste instead of reinventing it, dealing with double binds and trade offs,they'll grow to put less weight on caring for user interest.
bauchidgw 15y ago
anybody remembers the blogger code of ethics? what happened to it? what was its impact (if any)?
phamilton 15y ago
How many startups actually shut down? When I say shutdown I mean close the doors, unplug the servers, delete all code and walk away? If there is any significant codebase, isn't that at least worth something? Sell it off to the highest bidder? I think the open source clause under shutdowns is going to be rare.
sixtofour 15y ago
What are some typical contractual agreements for user data of an acquired startup, between the acquirer and the startup?

37 points by vijaydev 15y ago

it seems pretty restrictive in the early stage you are required to build extra features....and in the later stage you are requiring the acquirer to agree to this

jacquesm 15y ago
It's actually not that bad. The first section 1.1 through 1.5 is roughly what the EU law would have you do anyway, 1.6 is a good way to tell your users that you don't intend to use the service as a pre-text to harvest more data on them than you need. The second part has some issues that would come up in an acquisition, but think about it, if you are placing the wants and needs of an acquirer ahead of those of your users then you should have never started that company to begin with, after all, it is more than likely that your users are what gave you the platform to get the acquirer interested. A 'pure' team acquisition that kills the product post acquisition is about as bad as it gets from a user point of view and if you intend to do that then maybe you should clarify that up-front instead of when it is two minutes to twelve. Killing off APIs willy nilly is a very bad nono imo, you basically create an avalanche of fall-out the consequences of which are probably hard to envision, especially if your API becomes important enough that people will start to build commercial services around it.
- synnik 15y ago
  I think you are being unrealistic about acquisition. I hear way too many discussions on HN about monetizing your products, and people looking for their big exit/payday. People are not going to give up their exit plan because of an idealistic "code of ethics" for their users.
  - jacquesm 15y ago
    I think we all speak for ourselves here. Maybe it is true that not many companies would require an acquirer to continue to run the service as it was at the moment of acquisition (or better!), but I think those that do want to make such a commitment to their end users should get a leg up. If someone offered to buy out the sites that I run in order to shut them down I would refuse.
    - rdl 15y ago
      Actually I think it would be cool to ask ~10 big acquirers, both of talent and of products/tech, to see how they'd feel about deals with these terms. Google seemed ok with Etherpad running in parallel for a while. The concerns seem to be: * Acq wants to be able to develop their own products with the tech, less competition -- shutting off system supports that, but so does disabling new account creation on it, and making your own product superior. Some changes seem ok, some seem borderline (flickr -> yahoo login), but just shutting down a service is different. * Wanting full resources of the team -- running the old site on autopilot * If the old service is inherently unsustainable (patent/IP issues, negative marginal income, ...); the former might be a big deal (although YouTube won by having the Google lawhammer on their side), and the latter might not be a big deal if the absolute dollar value involved is low relative to the deal. Even if a deal ends up being 5% less due to the requirement that the service stay operating after acq, if it makes user acq easier so you get 2x more users and thus a 2-10x higher valuation, it's win/win/win/win (acq, founders, investors, users).

BrandonMTurner 15y ago

I am developer at a small start up, in terms of company size at least. There are only 4 people in the company and I the only full time developer. The CEO is technical and writes code half of the time himself as well. Though, while small in size, we have roughly 1.5M uniques per month. Only a small part our service is read only / consumption based (the forums and other social networking features). Based on the nature of what our service does we end up collecting a lot of information on all of our users. Non financial information, but most of the information we have about users they would never want other people to know or find out about. Each day the average active user gives about 10-15 new bits of information (willing-fully, thats why they use our service, we are not just tracking users to get the information). That being said, a lot of users when they close their account contact us and demand us to verify we have deleted all of our their information. We do our best to anonymize by blanking out their name, location, email address, etc... in our database. Then we mark the account no longer active. However, we can never confirm their data is fully gone. We can not retroactively go back and remove them from our countless number of backups. We snapshot ever night and keep the backups for differing amount of time. Since we can never get rid of them via the backups, which basically are just as good (if stolen, leaked, etc..) as the data in our live database we can never confirm their data has been deleted. Would this mean we would be breaking this code of conduct? If so, that would make this code of conduct way to burdensome for any start up or company to follow. (Not to mention other things in there besides the data retention policy that make this way to much for any start up to promise to follow)

jacquesm 15y ago
Backups are hairy, from what I understand the EU directives on user privacy require that you delete the data from you normal business processes and you warrant that this data will never again be used actively or passively after the user requires deletion. The way I deal with this particular requirement on my site is that if a user requests removal that the deletion request is archived separately after the deletion. If I should have to roll-back a database from a back-up then I will run all the deletions against it that were made since the time that the backup was made. I'm not 100% sure if that is in compliance with the law but it is a pretty gray area. As far as I'm concerned I would say that you are doing just fine and that you operate to the spirit of the document even if you can't guarantee that in the most extreme cases you'd be following it to the letter. And that 'spirit' is exactly what this is all about.

patio11 15y ago

No offense, early adopters, but if you desire a SLA like this one from me, you'd better get moving because only one person will ever get one and my girlfriend looks like she is the odds-on favorite. This strikes me as optimizing for the somewhat quirky preference set of a group of people who do not pay money for software. (People who do pay money for software have an easy mechanism for determining what they are owed: check the contract, if it says you're owed it, you're owed it, if not, you're not.) Their opinion may, possibly, be relevant, but I wouldn't really go out of my way for it without a darn good reason for why. There are few startups on HN for whom API stability 18 months from now is a life-or-death issue for their startup. There are, almost certainly, juicier fruits which hang lower for your marketing than guaranteeing your API stability in the event of an acquisition or death of your startup. If you doubt this, please, post a statement of User Rights or what have you on your website. Count the clicks to it. People's revealed preference is that they do not care. They might think they care, they might even say they care ("How dare this Mobisocifotogame that I read about on HN close without letting me download the 5 minutes of attention I put into it in a convenient-to-use XML file?!"), but they do not make decisions based on this. Spend your time on things that actually influence decisions they make, like e.g. button colors. Seriously. Tweaking button color on your signup form will, provably, do more for your business than optimizing for the opinions of folks who flit between new web services like mayflies with less spending power.

jacquesm 15y ago
It's voluntary :) People's revealed preference is that they do not care until they get bitten. And then they care very much. So we can and should do better than the bare minimum, and better than 'what users ask for' before they get bitten. That you do not care is a different story altogether, but consider that if you align your users' interests with your own that you probably stand a much better chance of success than if you do not. Sure, 'greed is good' and all that but in the end, company data being sold in bankruptcy proceedings is simply bad, companies giving several days warning before shutting down (http://news.ycombinator.com/item?id=2770257 http://news.ycombinator.com/item?id=2770257) are not helping anybody (not even themselves), and Yahoo!'s shutting down Geocities still reverberates around the web (especially the way they went about it, for a pittance they could have continued to at least store the data). My inbox fills up daily with people that thought they had an agreement with one of the largest companies on the web and it turned out they got hurt badly. Big or small, it does not matter. We are all operating by the grace of our users and those people that put their own interests ahead of those of the users are hurting all of us. Maintaining this sort of integrity is not a cost, it is a long term benefit, for everyone.

preinheimer 15y ago

These sound all nice and friendly, but they're not feasible for me. If you've paid me, use the service for a time, then ask me to delete all data associated with your account, I've got nothing to fight a chargeback with. Shutting down after losing a patent (or other) lawsuit, then open sourcing the aplicable software seems wrought of peril. 6 months notice is feasible for a paid service, but not so much for a free one.

jacquesm 15y ago
> then ask me to delete all data associated with your account You may not even have that option: http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.HU http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.HU As for keeping the history for anti-chargeback purposes, it is my understanding that you are allowed to keep username and log in data and your IPSP will have the rest of the information that you'd need to fight a chargeback. Also, someone requesting deletion of their data would make it pretty easy to fight that chargeback because they're providing you with auxiliary proof (the request itself) that they've been active users of your site. The patent claim is a good one, I'll have to think about that. Keeping a free service 'up' without allowing new data to be entered in to the system post shutdown without support or development costs a very small fraction of what it would cost to run the service in an active way. For example, Yahoo! claimed that running Geocities cost them tens of millions of dollars annually, and yet, somehow I can maintain a large fraction (how large a fraction we'll never know) of their accounts up and running for approximately $500 / month. The problem with giving notice is that many people will never get your notice, even when given 6 months ahead of time. Imagine dropbox shutting down their free accounts overnight. It's technically within their rights. Ditto google docs and a myriad of other services that people come to rely on.
- preinheimer 15y ago
  > As for keeping the history for anti-chargeback purposes, it is my understanding that you are allowed to keep username and log in data and your IPSP will have the rest of the information that you'd need to fight a chargeback. If I'm keeping your username, your login and usage history (likely IP address) to fight the chargeback, I haven't deleted all your data by a long shot. > Keeping a free service 'up' without allowing new data to be entered in to the system post shutdown without support or development costs a very small fraction of what it would cost to run the service in an active way. Keeping anything running has cost, you don't just stand up a machine, step back, and hope for the best. There's maintenance, patches, IDS work, etc. Hitting a "read only" flag in your software (presuming it exist) doesn't make the machine invulnerable.

rdl 15y ago

A one-size-fits-all is not going to work, I think. The correct model is probably something similar to the Creative Commons model -- create a few bundles of rights, let creators/site operators compose them, creating a 2x2 matrix of licenses or whatever. For instance: 1) Ownership of content/derived rights 2) Persistence of terms through exit (bankruptcy, sale, change of control...) 3) Revocability (can never, can easily, or can after N day waiting period during which users may delete all data, or opt in/out of new terms...) 4) Law enforcement: we'll actively bend over/cooperate like eBay, or we will require warrants and resist to the extent legally allowed, or technical countermeasures, plus which jurisdictions (I'm usually fine with USA law, but wouldn't want my content under e.g. Saudi law) 5) ... This matters more for power users and API users (developers) than for casual users, but I agree something like this is necessary.

jacquesm 15y ago
That is a very good idea!
- cesar 15y ago
  The creative commons comparison is a good idea. I wonder if you could put it into github, then people could just fork it, make their changes and use it. Just a thought.

gojomo 15y ago

This seems like an anti-pivot poison pill.

jacquesm 15y ago
I would say the sweet spot for defining your users rights is right after you gain some major traction and before any kind of exit is even on the horizon. And definitely before other companies start to rely on you, and/or network effects have put you in a position where you can afford to screw people over. Probably it would be a good idea to have your business model figured out as well. A side effect of this is that it may force you to think a bit harder over whether you want to support this creation for an extended period, and that alone might be enlightening. So, pivot to your hearts content, but when you feel you have a 'live one' define your users rights and stick to it.

4J7z0Fgt63dTZbs 15y ago

This kills off the root motivation to be Samaritan with power. If everyone can copy and paste instead of reinventing it, dealing with double binds and trade offs,they'll grow to put less weight on caring for user interest.

bauchidgw 15y ago

anybody remembers the blogger code of ethics? what happened to it? what was its impact (if any)?

phamilton 15y ago

How many startups actually shut down? When I say shutdown I mean close the doors, unplug the servers, delete all code and walk away? If there is any significant codebase, isn't that at least worth something? Sell it off to the highest bidder? I think the open source clause under shutdowns is going to be rare.

sixtofour 15y ago

What are some typical contractual agreements for user data of an acquired startup, between the acquirer and the startup?