Too many words is a yellow flag; those words including a lot of opining about out of scope things like how users might be unnecessarily scared by the legal lang

Too many words is a yellow flag; those words including a lot of opining about out of scope things like how users might be unnecessarily scared by the legal language of GDPR is an orange flag; some of their points being factually incorrect is a red flag. Maybe they are truly honest and just have a bad GDPR + PR team, but I just can't bring myself to trust them. From their apology; > The best example is the catchall phrase ‘personal information’, a non-specific term that understandably raises concerns for regular readers. Personal information is actually a pretty accurate designation with sufficiently clear boundaries in GDPR context and the concerns it may raise are perfectly valid. It can't be downplayed to "just legalese". E.g only because IP address are personal information you had to separate your collection and retention policies very clearly, and could be help accountable on that. > The most unclear and damaging part of the original document stated that we collect personal information “…necessary for law enforcement, litigation and authorities' requests (if any)”. > In addition, the steps we have taken to anonymise all stored data means that it would be of extremely limited use to anyone. Be that as it may, those records are required for your GDPR compliance too, an information that is pretty useful about how honestly this policy will be executed. > It is verifiably untrue that we hid the exact data being collected. As noted by journalists who investigated the issue, Audacity is free and open source software, and an inspection of its source code shows that the data it shares is extremely limited. That is only true for the client code. To my knowledge the server side code is not public, as such it is completely unverifiable outside an audit context that whether you merely collected the IP address or also retained it for example. I am not an active user anymore, but I hope people make repeated data takeout requests just for that redundant bit of evidence in case they are found to be in non-compliance.