3 ms·
[Copied from my post on the other HN thread about this (https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334)]: I guess
by boole1854 4y ago
[Copied from my post on the other HN thread about this (https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334)]:
I guess I'll take the contrarian view here: the developer violated a reasonable Play Store policy, refused to fix the problem, and received an expected outcome.
If you read the details of the Play Store complaint, you will see that they say the app was uploading information from the user's contact list without properly disclosing to the user that this was happening [1]. This is a violation of Play Store policy (a disclosure is required). It's not an unreasonable policy.
You can see in the app's source code where some of this happens [2]. In short, the contact list is read off the device, email addresses associated with each contact are parsed out, and the app does HTTP requests to remote servers to get the favicon associated with each email contact domain. Note that this is the sending of information off each user's contact list (the email address domains) to those remote servers. As such, it requires a disclosure to the user.
The developer's response is that he refuses to add a disclosure to the app because he is not uploading "contact info". [3]. Ok... not a great response. Certainly I would expect apps to disclose whether or not they are using any information on my contact list to reach out to third-party servers, even if only domain names. In any case, it's Play Store policy.
In the end, he finally removed the favicon feature. And Play agreed to allow the app back into the store. [4] But he has not yet backed down on shutting down the whole project because he's still upset.
Sources
[1] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86913731 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f...
[2] https://github.com/M66B/FairEmail/blob/master/app/src/main/java/eu/faircode/email/ContactInfo.java https://github.com/M66B/FairEmail/blob/master/app/src/main/j...
[3] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86913771 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f...
[4] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86914375 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f...
- dang 4y agoPlease don't copy comments into other threads. Besides lowering the signal/noise ratio of the site, it makes merging threads a pain because it adds a subthread merge to the problem! - that is, we have to turn all the replies to your copied comment into replies to the original comment in order to be fair to the repliers. If threads need merging, you (or anyone!) are welcome to let us know at hn@ycombinator.com. That's how I found out about this case.
- boole1854 4y agoGood to know, thanks.
- sureglymop 4y agoCould you please elaborate? How exactly is getting a favicon for each of these domains possibly "sending of information off each users contact list"?
- xnx 4y agoIt sounds like you answered your own question. The domain of a contact is private information that I don't want shared without my consent, even if the domain isn't as high resolution as the full email address. In many cases the domain is all you need. Example: Imagine I have the contact z@markzuckerberg.com in my address book, or customerservice@embarassing-medical-condition.org.