4 ms·

To be honest, after reading the privacy policy of the service (https://safeapps.io/content/privacy https://safeapps.io/content/privacy) I would not trust them w

To be honest, after reading the privacy policy of the service (https://safeapps.io/content/privacy https://safeapps.io/content/privacy) I would not trust them with my financial data. No properly registered company is named and the policy says things like The personal information we collect is stored and/or processed in United States, Netherlands, and Russian Federation, or where we or our partners, affiliates, and third-party providers maintain facilities. How is that privacy-first or even legal? That clause alone is in direct violation of GDPR and CCPA. So I'm not surprised that this got banned.

pbhjpbhj 5y ago
How does this violate GDPR?
- ThePhysicist 5y ago
  You can't store EU resident's data in the Russian Federation as the laws there do not provide an adequate level of data protection. Likewise you can't store it in the US in principle, although the situation is more complicated there legally. The CCPA has similar requirements regarding data residency for data belonging to US citizens as far as I know (not an expert on that though). Also, the website does not name a data protection representative in the EU. In fact, I couldn't find any information about the country that the company is based in (I assume Russia), or if there even is a registered company to begin with, which is another no-go. If you want to operate a privacy-first service you should at least make sure the basic formalities are met, and that includes naming who exactly is processing your data for which purposes.
freeone3000 5y ago
A reasonable assumption would be that EU data is processed in the Netherlands, Russian data is processed in the Russian Federation, and that Rest-of-World data is processed in the US. This complies with all of the listed regulations, but it would be nice to have this explicitly broken down.
dkzlv 5y ago
Author's here. It is a standard privacy policy generated by getterms.io. We have no data on you. You can read about our security model here (https://safeapps.io/content/security https://safeapps.io/content/security) and walk through our source code here (https://github.com/safeapps-io https://github.com/safeapps-io). TL;DR: every bit of data you create within the product is encrypted in the browser. The server only sees a blob of encrypted bits, that's all. You can sign up without an email. But if you do, we use Sparkpost for sending emails, which is a EU-based ISP. We do not have any third-party scripts or cookies across all the site at all. No Google Analytics, no Facebook Pixel, no Intercom support chat. We use German hosting and I'm personally from Russia. So no, we do not violate GDPR (but we do violate Russian laws because we do not have any servers in Russia). And we do take privacy seriously.

pbhjpbhj 5y ago

How does this violate GDPR?

ThePhysicist 5y ago
You can't store EU resident's data in the Russian Federation as the laws there do not provide an adequate level of data protection. Likewise you can't store it in the US in principle, although the situation is more complicated there legally. The CCPA has similar requirements regarding data residency for data belonging to US citizens as far as I know (not an expert on that though). Also, the website does not name a data protection representative in the EU. In fact, I couldn't find any information about the country that the company is based in (I assume Russia), or if there even is a registered company to begin with, which is another no-go. If you want to operate a privacy-first service you should at least make sure the basic formalities are met, and that includes naming who exactly is processing your data for which purposes.

freeone3000 5y ago

A reasonable assumption would be that EU data is processed in the Netherlands, Russian data is processed in the Russian Federation, and that Rest-of-World data is processed in the US. This complies with all of the listed regulations, but it would be nice to have this explicitly broken down.

dkzlv 5y ago

Author's here. It is a standard privacy policy generated by getterms.io. We have no data on you. You can read about our security model here (https://safeapps.io/content/security https://safeapps.io/content/security) and walk through our source code here (https://github.com/safeapps-io https://github.com/safeapps-io). TL;DR: every bit of data you create within the product is encrypted in the browser. The server only sees a blob of encrypted bits, that's all. You can sign up without an email. But if you do, we use Sparkpost for sending emails, which is a EU-based ISP. We do not have any third-party scripts or cookies across all the site at all. No Google Analytics, no Facebook Pixel, no Intercom support chat. We use German hosting and I'm personally from Russia. So no, we do not violate GDPR (but we do violate Russian laws because we do not have any servers in Russia). And we do take privacy seriously.