5 ms·

Hi, Armin from Sentry here. I wrote a blog post alongside the TOS change that goes into details here that addresses some of the questions I hope: https://blog.

Hi, Armin from Sentry here. I wrote a blog post alongside the TOS change that goes into details here that addresses some of the questions I hope: https://blog.sentry.io/ai-privacy-and-terms-of-service-updates/ https://blog.sentry.io/ai-privacy-and-terms-of-service-updat... I'm also happy to answer specific questions about the TOS change or what we're intending on using. As for the opt-out: given the scope of how we are using usage and service data it did not seem all that obvious an opt-out was needed. We did receive the feedback however and will follow up here.

ProllyInfamous 3y ago
>...and will follow up here >...happy to answer specific questions JFC, how much are your overlords paying you for such corporate drivel..? There is no discussion to be had, here. Such a service ought'ta LEGALLY be `opt-in`, and inability to even opt-out is also INTENTIONAL.
- the_mitsuhiko 3y ago
  Our terms of service are historically very restrictive. Unlike many others in the space they do not permit us to use event data for analysis or improvements of the service. For instance SigNoz was mentioned in the thread here, their terms of service already contain a similar clause. I'm not sure how many companies offer opt-outs for that.
  - ProllyInfamous 3y ago
    >historically How'bout now-ly? Can you honestly say that the lack of opt-out wasn't planned?
    - the_mitsuhiko 3y ago
      Clauses in terms of services for using event and usage data for product improvements without an opt-out are quite common place. Here the equivalent clause from Datadog: > In order to provide and support the Service for the benefit of Customer, Customer hereby grants Datadog a worldwide, non-exclusive, royalty-free license […] Customer agrees that, so long as no Customer Confidential Information is publicly disclosed, Datadog may: (i) use Customer Data to refine, supplement or test Datadog’s product and service offerings; (ii) include aggregated and anonymized Customer Data in any publicly available reports, analyses and promotional materials; and (iii) retain anonymized, non-attributable Customer Data following any termination of this Agreement for use in connection with the foregoing.
      - ProllyInfamous 3y ago
        My personal prediction is that part of the ongoing [gen] AI Revolution will see a massive return of self-hosting at co-located data centers (if not also @HQ). I was a union electrician in such data centers back enough years ago that this was the then-popular method [owning your own hardware]. IMHO, good-riddance to The Everything Cloud™. Proprietary data should belong to their companies/people, only. EDIT: I can't respond [anti-flame measure; this is genuine discussion]; my follow-up to your comment (below) is: DO THE TERMS YOU CITED ABOVE APPLY ON SELF-HOSTED INSTANCES? If I blackhole your DNS entry-points, will the service remain functional "off-site"?
        the_mitsuhiko 3y ago
        This is the point where I will point out that you can self-host Sentry free of charge :) https://develop.sentry.dev/self-hosted/ https://develop.sentry.dev/self-hosted/ // EDIT: > DO THE TERMS YOU CITED ABOVE APPLY ON SELF-HOSTED INSTANCES? If I blackhole your DNS entry-points, will the service remain functional "off-site"? The only communication that a self hosted sentry has with sentry.io is the beacon which is the first item in the self hosted docs for how to turn it off or on. It does not transmit any of your data other than the admin's email address for security updates which also can be turned off. You can also look at the code to validate that it doesn't do anything dodgy. No need to firewall it off.
        ProllyInfamous 3y ago
        >No need to firewall it off. I trust everything you said, up to this point. Thanks again for the quick answers. Truly impressive PR. We'll take a look into these claims, thanks.
throwaway2990 3y ago
> it did not seem all that obvious an opt-out was needed That doesn’t help seem like people making decisions at sentry are caring about their customers. I left sentry for other reasons but this just reinforces my decision to leave.
- nine_k 3y ago
  What are you using instead?
Annuity3036 3y ago
> did not seem all that obvious an opt-out was needed WOW JUST WOW
Annuity3036 3y ago
why can't companies be honest that they want to gather data so they could get higher valuation and sell that data in some cases for profit instead of making such shameless statements?
- the_mitsuhiko 3y ago
  We do not disclose data and we do not sell data.
  - ProllyInfamous 3y ago
    How about the trained-datasets (of our data) — are you insisting that those won't also be sold/traided/trained-upon?
    - the_mitsuhiko 3y ago
      Correct. No such data is disclosed in any way other than to operate the service. We might use that data to rank issues by severity within sentry.io, but this data is not disclosed to anyone.
      - ProllyInfamous 3y ago
        Hope this remains true. Thanks for concise answers.
        93po 3y ago
        True until they're hacked, or they're bought by some firm, or the management changes, or someone sneezes and makes a commit by mistake, or they just straight up change their mind.
  - Annuity3036 3y ago
    and how about not training on my data?
piva00 3y ago
> As for the opt-out: given the scope of how we are using usage and service data it did not seem all that obvious an opt-out was needed. We did receive the feedback however and will follow up here. A good rule of thumb for vacuuming customer data in enterprise environments is: everything needs an opt-out (I'd even say that almost every instance of it should be opt-in). You can't assume that all of your customers are ok to provide their data to a black box owned by you, sometimes that might even create regulatory issues they need to be aware of. Even if historically your ToS restricts how you can use said data, it creates a risk that one day you might not be so restrictive, we are all very aware of companies slicing the salami to further encroach on customers' data. It sounds really strange that a company serving enterprise customers is not thinking in those terms.
tsak 3y ago
Have you considered your target audience when writing or before sending that email about that TOS change? What really peeved me was that bit: > If you do not want to be governed by the updated TOS, be sure to close your account before the updated TOS applies to you. My immediate reaction was to look for alternatives to Sentry and/or to self-host for the time being. Judging by the comments here I'm not the only one. Instead of this cold, matter of fact kind of tone, why not explain the reason for wanting to collect data, give an example, etc. Why not sell this as a win instead of telling us to fuck off if we don't like it?
- the_mitsuhiko 3y ago
  The tone of the email is regretful. It is in line I believe with prior TOS changes but obviously not every TOS change is the same. We have something to learn here.
beaugunderson 3y ago
If you move forward with these changes will they apply to customers bound by HIPAA who you have a BAA with?
itsdrewmiller 3y ago
Not super surprising that there are a bunch of negative comments here, but as a customer I appreciate the candor and especially the note that most competitors already have similar terms.

ProllyInfamous 3y ago

>...and will follow up here >...happy to answer specific questions JFC, how much are your overlords paying you for such corporate drivel..? There is no discussion to be had, here. Such a service ought'ta LEGALLY be `opt-in`, and inability to even opt-out is also INTENTIONAL.

the_mitsuhiko 3y ago
Our terms of service are historically very restrictive. Unlike many others in the space they do not permit us to use event data for analysis or improvements of the service. For instance SigNoz was mentioned in the thread here, their terms of service already contain a similar clause. I'm not sure how many companies offer opt-outs for that.
- ProllyInfamous 3y ago
  >historically How'bout now-ly? Can you honestly say that the lack of opt-out wasn't planned?
  - the_mitsuhiko 3y ago
    Clauses in terms of services for using event and usage data for product improvements without an opt-out are quite common place. Here the equivalent clause from Datadog: > In order to provide and support the Service for the benefit of Customer, Customer hereby grants Datadog a worldwide, non-exclusive, royalty-free license […] Customer agrees that, so long as no Customer Confidential Information is publicly disclosed, Datadog may: (i) use Customer Data to refine, supplement or test Datadog’s product and service offerings; (ii) include aggregated and anonymized Customer Data in any publicly available reports, analyses and promotional materials; and (iii) retain anonymized, non-attributable Customer Data following any termination of this Agreement for use in connection with the foregoing.
    - ProllyInfamous 3y ago
      My personal prediction is that part of the ongoing [gen] AI Revolution will see a massive return of self-hosting at co-located data centers (if not also @HQ). I was a union electrician in such data centers back enough years ago that this was the then-popular method [owning your own hardware]. IMHO, good-riddance to The Everything Cloud™. Proprietary data should belong to their companies/people, only. EDIT: I can't respond [anti-flame measure; this is genuine discussion]; my follow-up to your comment (below) is: DO THE TERMS YOU CITED ABOVE APPLY ON SELF-HOSTED INSTANCES? If I blackhole your DNS entry-points, will the service remain functional "off-site"?
      - the_mitsuhiko 3y ago
        This is the point where I will point out that you can self-host Sentry free of charge :) https://develop.sentry.dev/self-hosted/ https://develop.sentry.dev/self-hosted/ // EDIT: > DO THE TERMS YOU CITED ABOVE APPLY ON SELF-HOSTED INSTANCES? If I blackhole your DNS entry-points, will the service remain functional "off-site"? The only communication that a self hosted sentry has with sentry.io is the beacon which is the first item in the self hosted docs for how to turn it off or on. It does not transmit any of your data other than the admin's email address for security updates which also can be turned off. You can also look at the code to validate that it doesn't do anything dodgy. No need to firewall it off.
        ProllyInfamous 3y ago
        >No need to firewall it off. I trust everything you said, up to this point. Thanks again for the quick answers. Truly impressive PR. We'll take a look into these claims, thanks.

throwaway2990 3y ago

> it did not seem all that obvious an opt-out was needed That doesn’t help seem like people making decisions at sentry are caring about their customers. I left sentry for other reasons but this just reinforces my decision to leave.

nine_k 3y ago
What are you using instead?

Annuity3036 3y ago

> did not seem all that obvious an opt-out was needed WOW JUST WOW

Annuity3036 3y ago

why can't companies be honest that they want to gather data so they could get higher valuation and sell that data in some cases for profit instead of making such shameless statements?

the_mitsuhiko 3y ago
We do not disclose data and we do not sell data.
- ProllyInfamous 3y ago
  How about the trained-datasets (of our data) — are you insisting that those won't also be sold/traided/trained-upon?
  - the_mitsuhiko 3y ago
    Correct. No such data is disclosed in any way other than to operate the service. We might use that data to rank issues by severity within sentry.io, but this data is not disclosed to anyone.
    - ProllyInfamous 3y ago
      Hope this remains true. Thanks for concise answers.
      - 93po 3y ago
        True until they're hacked, or they're bought by some firm, or the management changes, or someone sneezes and makes a commit by mistake, or they just straight up change their mind.
- Annuity3036 3y ago
  and how about not training on my data?

piva00 3y ago

> As for the opt-out: given the scope of how we are using usage and service data it did not seem all that obvious an opt-out was needed. We did receive the feedback however and will follow up here. A good rule of thumb for vacuuming customer data in enterprise environments is: everything needs an opt-out (I'd even say that almost every instance of it should be opt-in). You can't assume that all of your customers are ok to provide their data to a black box owned by you, sometimes that might even create regulatory issues they need to be aware of. Even if historically your ToS restricts how you can use said data, it creates a risk that one day you might not be so restrictive, we are all very aware of companies slicing the salami to further encroach on customers' data. It sounds really strange that a company serving enterprise customers is not thinking in those terms.

tsak 3y ago

Have you considered your target audience when writing or before sending that email about that TOS change? What really peeved me was that bit: > If you do not want to be governed by the updated TOS, be sure to close your account before the updated TOS applies to you. My immediate reaction was to look for alternatives to Sentry and/or to self-host for the time being. Judging by the comments here I'm not the only one. Instead of this cold, matter of fact kind of tone, why not explain the reason for wanting to collect data, give an example, etc. Why not sell this as a win instead of telling us to fuck off if we don't like it?

the_mitsuhiko 3y ago
The tone of the email is regretful. It is in line I believe with prior TOS changes but obviously not every TOS change is the same. We have something to learn here.

beaugunderson 3y ago

If you move forward with these changes will they apply to customers bound by HIPAA who you have a BAA with?

itsdrewmiller 3y ago

Not super surprising that there are a bunch of negative comments here, but as a customer I appreciate the candor and especially the note that most competitors already have similar terms.