https://github.com/audacity/audacity/discussions/1225 Skip to content Sign up * Why GitHub? Features - + Mobile - + Actions - + Codespaces - + Packages - + Security - + Code review - + Issues - + Integrations - + GitHub Sponsors - + Customer stories- * Team * Enterprise * Explore + Explore GitHub - Learn and contribute + Topics - + Collections - + Trending - + Learning Lab - + Open source guides - Connect with others + The ReadME Project - + Events - + Community forum - + GitHub Education - + GitHub Stars program - * Marketplace * Pricing Plans - + Compare plans - + Contact Sales - + Education - [ ] [search-key] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this organization All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up {{ message }} audacity / audacity * Notifications * Star 5.6k * Fork 1.4k * Code * Issues 275 * Pull requests 59 * Discussions * Actions * Projects 8 * Wiki * Security * Insights More * Code * Issues * Pull requests * Discussions * Actions * Projects * Wiki * Security * Insights You must be logged in to vote 17 Clarification of Privacy Policy #1225 workedintheory started this conversation in General Clarification of Privacy Policy #1225 @workedintheory workedintheory Jul 5, 2021 * 32 comments * 51 replies Return to top edited @workedintheory workedintheory Jul 5, 2021 A quick statement to address the concerns around our new Privacy Policy. We believe concerns are due largely to unclear phrasing in the Privacy Policy, which we are now in the process of rectifying. In the meantime, we would like to clarify what seem to be the major points of concern: * Selling Data & Sharing - We do not and will not sell ANY data we collect or share it with 3rd parties. Full stop. * Data Collection - Data we collect is very limited. + IP address - which is pseudonymised and irretrievable after 24 hours. + Basic System Info - OS version and CPU type. + Error Report Data (Optional) - Sent manually by users as part of an Error Report. * Additional Data - We do not collect any additional data beyond the points listed above for any purpose. * Compliance with Law Enforcement - We will not collect or provide any information other than data described above with with any government entity or law enforcement agency. + Compelled by Court - Data is not shared upon an agency request; we will do so only if compelled by a court of law in a jurisdiction that we serve. + Limited Window - After 24 hours the IP address being collected is irretrievably lost. + Jurisdiction Requirements - We operate in many countries around the world and this is a standard policy requirement for providing services in many jurisdictions, regardless of the depth of data collected or nature of service. * Offline Use - The Privacy Policy does not apply to offline use of the application. We are working with our legal team to revise our privacy policy to more clearly communicate the above points and our intent. -- About the term 'Personal Data' GDPR classifies an IP address as something that potentially counts as 'personal data', which is why we use that term in the Privacy Policy. This is necessary for two features being introduced in the next version of Audacity: * Automatic Updates - checking to see if there is a new version available * Error Reporting - an opt-in feature for users to send error reports to us As mentioned in the Compliance with Law Enforcement above, we take steps so that the IP address we collect is non-identifiable after 24 hours. -- We do understand that unclear phrasing of the Privacy Policy and lack of context regarding introduction has led to major concerns about how we use and store the very limited data we collect. We will be publishing a revised version shortly. In the meantime, the Privacy Policy doesn't actually come into force until the next release of Audacity (3.0.3). The current version (3.0.2) does not support data collection any data of any kind and has no networking features enabled. 53 186 23 12 Replies 32 comments * 51 replies Oldest Newest Top You must be logged in to vote 25 @TechandMusic462 TechandMusic462 Jul 5, 2021 After the telemetry, CLA, and now this, do you expect any trust from the community? MUSE still does not understand open source software at a fundamental level. I am holding out for a fork to gain momentum, and will stay on pre-MUSE Audacity until then. 150 13 12 1 reply @edo0 edo0 Jul 5, 2021 Judging by the number of stars, contributions and community interest, this seems to be the upcoming fork many of us have invoked and wished for! https://github.com/cookiengineer/audacity 18 [?] 8 You must be logged in to vote 15 @masumahmed masumahmed Jul 5, 2021 This comment was deleted. 94 10 5 3 4 replies @shoogle shoogle Jul 5, 2021 Collaborator Check for updates is the only networking feature enabled by default (it is opt-out while the others are opt-in). This, and your IP address, is the only information sent during a check for updates: GET /feed/latest.xml HTTP/1.1 Host: updates.audacityteam.org Accept: */* Accept-Encoding: deflate, gzip User-Agent: Audacity/3.0.3 (Windows 10_0_19042; x64) You can see this in the source code here and here. The IP address is stored on the server as a hash and becomes irretrievable after 24 hours when the salt is discarded. We believe that if we stated this more clearly in the privacy policy then fewer people would have a problem with it. 8 10 @uis246 uis246 Jul 5, 2021 Client version in user agent for checking for new version by client. U - usefulness. @derekslenk derekslenk Jul 5, 2021 The question remains as to why collect that information at all? Has law enforcement already asked you for IP addresses regarding the update mechanism? View more You must be logged in to vote 15 @gunqqer gunqqer Jul 5, 2021 It is too late, you know. You've already destroyed any good will the community had. With the CLA and the proposed privacy policy and the (failed) attempt at adding telemetry, us nerds know exactly what you are trying to do. As you've no doubt seen, none of us are having any of it. Forks are being made already. MUSE has no idea how the FLOSS community works, and the community knows it. Good job burning Audacity to the ground. 79 8 0 replies You must be logged in to vote 4 @JakobBruenker JakobBruenker Jul 5, 2021 What is the reason for having Error Report Data collection be optional but Basic System Info collection not be optional? 4 replies @shoogle shoogle Jul 5, 2021 Collaborator Both are optional, but update-checking is opt-out whereas error reporting is opt-in. The system info sent during update-checking is similar to the information your web browser sends during an ordinary HTTP request. Example check for updates request: GET /feed/latest.xml HTTP/1.1 Host: updates.audacityteam.org Accept: */* Accept-Encoding: deflate, gzip User-Agent: Audacity/3.0.3 (Windows 10_0_19042; x64) That, and of course your IP address, is all that gets sent during a check for updates (you can check for yourself here and here). The IP address is stored as a hash and becomes irretrievable after 24 hours when the salt is discarded. 22 2 @JakobBruenker JakobBruenker Jul 5, 2021 Got it, thanks 1 @databoose databoose Jul 5, 2021 Both are optional, but update-checking is opt-out whereas error reporting is opt-in. The system info sent during update-checking is similar to the information your web browser sends during an ordinary HTTP request. Example check for updates request: GET /feed/latest.xml HTTP/1.1 Host: updates.audacityteam.org Accept: */* Accept-Encoding: deflate, gzip User-Agent: Audacity/3.0.3 (Windows 10_0_19042; x64) That, and of course your IP address, is all that gets sent during a check for updates (you can check for yourself here and here). The IP address is stored as a hash and becomes irretrievable after 24 hours when the salt is discarded. Outside of updates the application should not be communicating with the internet without opting in flat out, it is an audio editing program, not a web browser, not a chatting application, not a video game. It's also questionable as to why these hashes of IP address would be stored on the server anyways, the only reason i can think is ddos protection, but again, this is a required connection, the user didn't consent to it, and it isn't necessary to exist, it just puts a users privacy more at jeopardy with no option to opt out. 4 View more You must be logged in to vote 7 @doomlerd doomlerd Jul 5, 2021 Time for forks. 38 2 1 reply @AndreiSva AndreiSva Jul 5, 2021 https://github.com/cookiengineer/audacity You must be logged in to vote 7 @SkaveRat SkaveRat Jul 5, 2021 or, y'know, not collect that data in the first place and you don't need all the legal stuff 61 1 1 reply @SkaveRat SkaveRat Jul 5, 2021 and I'm not even kidding. I know not having telemetry data about usage and crashes will suuuuck, but you basically crashed into an old community and it feels like you're going all coorporate on the "little FOSS project". Take some steps back and think about how every action you do is perceived. right now every little change you do is scutinized to the max. Some trust-building is in order here 41 You must be logged in to vote 5 edited @ohno9119 ohno9119 Jul 5, 2021 Stop going "uh oh we got caught again.... sorry we wont do again..." and actually fix your mistakes. Even if you wont pull something like this again we have lost all trust with the current maintainers of Audacity and people are already using forks. Audacity will be the new OpenJDK/OpenOffice/XFree86. 43 6 3 replies @shuffleQ shuffleQ Jul 5, 2021 I don know if they are deleting comments, but can you all please understand that he is a designer and not involved with this. If you want to complain do it here or elsewhere, but Tantacrul's comment sections are really for discussing his videos, and last time I checked there is none about Privacy Policies. And about that "you": MUSE has no business in Tanta's YouTube channel. He is an employee, not the other way around. They are not his social media team. 12 10 @lne01 lne01 Jul 5, 2021 Stop going "uh oh we got caught again.... sorry we wont do again..." and actually fix your mistakes. Even if you wont pull something like this again we have lost all trust with the current maintainers of Audacity and people are already using forks. Audacity will be the new OpenJDK/OpenOffice/ XFree86. (Also we know that you guys are wiping all negative comments about Audacity under Tantacrul's videos. Dont try to hide that aswell) Also you can disscuss anything in a youtube comment unless it violates youtube's terms of service or gets filtered by the word filter put up by the creator. @shuffleQ edited shuffleQ Jul 5, 2021 Also you can disscuss anything in a youtube comment unless it violates youtube's terms of service or gets filtered by the word filter put up by the creator. thank you I didn't know that /s The point is, there is a legit reason to do that because thats simply not the topic and he might not want to get bothered with that, as said he has nothing to do with this, imagine people raiding your home because your employer did dipshit. The "you" im talking about is referencing MUSE (the current maintainers of Audacity) and not Tanta. yes I know. And I was saying that I am 99.99% sure that they have no access to his channel whatsoever, because its tantas and not theirs. They cant delete comments on his videos, why would they have access to it? Its his personal channel and not the MUSE or Audacity one. Does your employer have access to your social media channels? Can they delete comments below your posts? No. You must be logged in to vote 10 @a-hurst a-hurst Jul 5, 2021 We believe concerns are due largely to unclear phrasing in the Privacy Policy I think what a lot of people are also taking issue with, especially after all the backlash against the basic telemetry and CLA issues, is that these major, scary-sounding changes are popping up seemingly out of nowhere without any sense of community consultation. Right now, I think people feel caught off-guard yet again and are frustrated that the maintainers aren't demonstrating that they care about what the broader community thinks of their decisions. Not saying you don't, just that it's quite clear people don't feel like you do. Even having a project blog where major decisions are announced and explained well in advance of their implementation would have dramatically decreased the blowback from all these incidents, as the broader community wouldn't feel like the maintainers are trying to sneak things in while no one's paying attention. The more transparent you are about this stuff, the shadowy and sinister people will make you out to be. 54 1 reply @Kavaeric edited Kavaeric Jul 5, 2021 This is what I feel is the crux of this issue. Stated plainly most (not all, see the GPL considerations with under-13s) of the changes implied by the new privacy policy are pretty agreeable: this is the infrastructure you need for automatic update checking, IP address collection is needed because that's how the internet works, 24-hour retention is understandable to debug faulty update requests or just a plain DOS attack, you can't refuse a request from law enforcement no matter how trivial your collected data is or how unlikely you think it is. It's ultimately mostly legalese that just reads really scarily to the uninformed. But, yeah, the fact that people reading this stuff aren't terribly informed isn't a good look as it is. Pushing changes, no matter how minor you think they might be, even if they are policy-based without any code to back it up yet, without consultation to a user group isn't great in any circumstance, but I'd imagine it stings particularly badly when it comes to the FOSS development community. I'm not really a programmer myself, but my understanding that the entire git system is based around consenst with code: you can't randomly force code on anyone if they don't want to merge, and for the most part (with open source projects anyway) you can't hide anything. The system forbids a "quiet update" in any real sense and so the act of pushing what is effectively a quiet update to the privacy policy that people just accidentally found out about over the course of the weekend is going to be a bad look to say the least. I should probably take the time to reiterate that blaming Tantacrul for "ruining Audacity" is misplaced at best; the guy's job is to make buttons look pretty, and I'm doubtful he has any hand in writing these policies or handling PR. Wouldn't be surprised if he just learned it around the same time we all did. In any case, directing critcism at him isn't just stupid, but also means criticism wouldn't be reaching the people actually responsible for these kinds of changes. The last thing I think we all want is for someone who really has no concrete say in these matters becoming the meatshield sponge for criticism while the people actually in charge can get away with whatever. 16 You must be logged in to vote 8 edited @AsuMagic AsuMagic Jul 5, 2021 If error reporting is opt-in and those points are required to implement automatic update checking: * Why is logging IPs for 24h a requirement at all? * For how long is the OS version logged? You do not mention for how long that data is kept, which looks like mandatory telemetry to me. * What does the OS version string contain (e.g. on Linux specifically)? Some custom kernel version strings could possibly identify someone. * Is automatic updating opt-in/opt-out/enforced as a popup on first launch, i.e. would it be possible to get Audacity to not initiate any connection to your servers? * When installed through a package manager, hence not requiring automatic updates through the conventional channel, will Audacity initiate any connection to your servers (when not reporting an error)? I assume this is usually patched by maintainers themselves though. 32 2 replies @darkstar darkstar Jul 5, 2021 IANAL, but I guess the answers to your questions are: * 24h IP logging: Because basic IP logging for a limited time is required in certain jurisdictions if you provide any "online service" (which automatic updating and crash-reporting apparently counts as, according to their lawyers) * retaining OS version: an OS version is not PII and thus there's no requirement of deleting it. being able to correlate different reports by means other than PII (e.g. a unique kernel version string) is not against the GDPR * OS version string: you can check that in the source code for yourself (note that it might change before release, so check often) * popup on first launch: you can also see that in the code, but I guess until the release arrives nobody will know for certain * package manager: that is a question you have to ask the package maintainers, not the upstream developers 3 @wafles38 wafles38 Jul 5, 2021 Their privacy policy says Other information we collect, such as OS version or CPU information is not identifiable. Basically, they don't think it's identifiable, or because it's not legally identifiable, then they feel like they can track this. 2 You must be logged in to vote 1 edited @PizzaCube PizzaCube Jul 5, 2021 I dont buy it. Time to start a new software i dont want to get sued by the music industry or something when you tip them off i am making an audio file because for some reason it is sending data out on the internets even though it has worked fine offline for years. for some reason you care about what audio wavs i am cutting for some reason who knows and want the data on everything i do. 4 1 1 reply @marth8880 marth8880 Jul 5, 2021 ...wat the only information they collect is your basic system specs, your region, and additional optional data related to any errors lmao 3 You must be logged in to vote 3 @catboy-oss catboy-oss Jul 5, 2021 You could always just not log the IP or retain it at all, just drop it on the floor? You still get your counts. 17 0 replies You must be logged in to vote 5 edited @overcast07 overcast07 Jul 5, 2021 I'm disappointed that you didn't address the GPL compliance issue that was brought up in the comments of #1213 (i.e. whether children will still be technically allowed to use Audacity once the privacy policy comes into effect). I'd prefer to give you guys the benefit of the doubt where possible, but I think we all expected better than whatever this debacle is. 17 5 replies @workedintheory workedintheory Jul 5, 2021 Author See original post: Offline Use - The Privacy Policy does not apply to offline use of the application. 7 6 @overcast07 overcast07 Jul 5, 2021 See original post: Offline Use - The Privacy Policy does not apply to offline use of the application. Thank you for clarifying that that would address the issue, though I don't think I know enough about this to tell if that specific change would resolve the GPL compliance issue entirely. 3 @TheCreeper edited TheCreeper Jul 5, 2021 See original post: Offline Use - The Privacy Policy does not apply to offline use of the application. Wouldn't that still be restricted use though? You're requiring that individuals (<13) either disconnect from the internet before using the application or recompile it without the problematic bits. I don't see how this resolves the "unrestricted use" clause, in any universe. GPLv2: The act of running the Program is not restricted GPLv3: This License explicitly affirms your unlimited permission to run the unmodified Program. 2 View more You must be logged in to vote 2 @majestrate majestrate Jul 5, 2021 have you considered moving development to be incorporated in a country that is a little less pushy about "lawful interception"? The Russian Federation is probably one of the worst choices to be located when it comes to such legislation, besides maybe mainland China. 19 1 reply @majestrate majestrate Jul 5, 2021 It also seems that one of audacity's dependencies have use of cryptographic primitives that are restricted by Russian import law and USA export law, specially AES. If you really want to be true to the spirit of the law audacity's inclusion of these are potentially in grave violation. I have heard the Russian Federation is very pedantic on this issue. This would probably be yet another reason to not incorporate in the country you are currently located in. If compliance with law enforcement really is an issue it would be wise to get some clarifications on the inclusion of these. 3 2 You must be logged in to vote 1 @trumad trumad Jul 5, 2021 This comment was deleted. 1 reply @trumad trumad Jul 5, 2021 Deleting because github made it seem like my comment didn't get posted. And the thing I said about minors was addressed above. You must be logged in to vote 5 @trumad trumad Jul 5, 2021 Please explain why you need an ip address at all. It's hard to believe what a mess is being made of this. Why not run a beta program, with a version of audacity which sends error reports and data, which beta users are happy to share along with their feedback? Why force it into the main product like this and alienate everyone? 9 3 replies @AverageHelper AverageHelper Jul 5, 2021 I can imagine the IP address being used by the relevant network protocols involved, but I'm confused about the logging. Once an update check is complete, and a subsequent update run separately, why keep the log around? Have I misunderstood something about how these things work? @zelch zelch Jul 5, 2021 Frankly, you want the IP address for at least some short period of time to handle things like DOS attacks, and in figuring out if you even are facing a DOS attack vs say, you screwed up a release and it's flooding your system with update checks. Removing it after 24 hours is definitely better than keeping it in your apache/ngnix server logs for however long you happen to keep them. (Could be a week, could be years.) Which is what most entities would have done pre-GDPR. 12 @AverageHelper AverageHelper Jul 5, 2021 Ah, that makes sense. Thank you for clarifying that for me 2 hidden items Load more... You must be logged in to vote 2 @sneak sneak Jul 5, 2021 We believe concerns are due largely to unclear phrasing in the Privacy Policy This is gaslighting. It's not the wording people have an issue with, it's the nonconsensual spyware. 25 5 2 replies @shoogle shoogle Jul 5, 2021 Collaborator Check for updates is the only networking feature enabled by default (it is opt-out while the others are opt-in). This, and your IP address, is the only information sent during a check for updates: GET /feed/latest.xml HTTP/1.1 Host: updates.audacityteam.org Accept: */* Accept-Encoding: deflate, gzip User-Agent: Audacity/3.0.3 (Windows 10_0_19042; x64) You can see this in the source code here and here. The IP address is stored on the server as a hash and becomes irretrievable after 24 hours when the salt is discarded. We believe that if we stated this more clearly in the privacy policy then fewer people would have a problem with it. 2 2 @marth8880 marth8880 Jul 5, 2021 uh oh god forbid the application check for updates lmao 6 You must be logged in to vote 2 edited @0x664b44c3 0x664b44c3 Jul 5, 2021 sorry to say that. you had some credibility. note the past tense. had. after the first attempt on new terms of use and introduction of telemetry and the following discussion - where you backed off - you had the chance to minimize the damage. you had the chance. credibility is a thing you earn in years and lose in seconds. 5 0 replies You must be logged in to vote 2 @Frankkkkk Frankkkkk Jul 5, 2021 All of this drama for adding sentry. Then people wanting to fork Audacity so not we have hundreds of half-assed programs.. Hope in humanity is lost for now :( 2 1 reply @zelch zelch Jul 5, 2021 Frankly, the problem is that it is far from clear that this was a misunderstanding, instead of this being a rapid backpedaling because of the reaction. It's going to take a lot of time and effort on their part to get that trust back. You must be logged in to vote 4 @marth8880 marth8880 Jul 5, 2021 Thanks for the clarification :) 2 0 replies You must be logged in to vote 2 @darkstar darkstar Jul 5, 2021 I wonder how people will react when they find out that the apt, yum, pacman servers and auto-update servers from things like Gnome or KDE keep the IP addresses in their nginx logs for months :-) /s 5 0 replies You must be logged in to vote 1 edited @wafles38 wafles38 Jul 5, 2021 this feels like stupid decisions added by noob maintainer that only thinks about their own benefit and when he does this he things "yeah, this is useful, why not?" instead of "is this necessary and would this be bad for people?" The main concern I have is that not sharing how exactly this data is collected and forces people like me to make a lot of assumptions when trying to understanding this. Not sharing why you need to keep some of this data also leads to assumptions. Why do you keep the unretrievable ip address for a year, and only delete it after a year? It doesn't make sense. Why do you keep something you had made inaccessible in your system? 2 replies @reinaurre reinaurre Jul 5, 2021 The IP likely functions as a guid for collating error reports. 1 @marth8880 marth8880 Jul 5, 2021 What exactly does the "noob maintainer" benefit from by contributing to a FOSS project? You must be logged in to vote 3 @reinaurre reinaurre Jul 5, 2021 Thank you for the clarification that apparently so many people needed. As a software developer I fully understood the changes and the extent of their impact on my privacy - which would be none - from the first time I read about this, but some people see scary legalese and assume it means you'll now be installing cameras in our homes and asking for our social security numbers. You don't deserve the flack you're getting, but I think you're handling this backlash very well. I appreciate you. 5 4 1 reply @marth8880 marth8880 Jul 5, 2021 wtf a levelheaded comment (how is this possible) 3 You must be logged in to vote 2 @glubsy glubsy Jul 5, 2021 After 24 hours the IP address being collected is irretrievably lost. How do you prove that? Automatic Updates - checking to see if there is a new version available We don't need "automatic updates". That is the job of the package manager, not yours. Apart from the error reporting feature, I really don't see any reason why this application should be considered "on-line". My guess is that the "features" you plan on implementing in the future will be tied to online services. This seems beyond the scope of what Audacity was originally meant to be. 3 replies @reinaurre reinaurre Jul 5, 2021 We don't need "automatic updates". That is the job of the package manager, not yours. As someone who went years doing punch & roll manually without knowing it had been added in a new version a few years ago, I greatly appreciate an update notifier. I don't track Audacity development, I just use it. If something isn't broken I don't go looking for updates, but that doesn't mean new things haven't been added that would dramatically improve my quality of life. 1 @nyuszika7h nyuszika7h Jul 5, 2021 We don't need "automatic updates". That is the job of the package manager, not yours. Not everyone will use a package manager to install it, namely the majority of Windows users. And chances are whoever makes a package for it will patch out the update check as is standard anyway. 1 @marth8880 marth8880 Jul 5, 2021 I and many others would love automatic updates. You must be logged in to vote 5 @nico-abram nico-abram Jul 5, 2021 Selling Data & Sharing - We do not and will not sell ANY data we collect or share it with 3rd parties. Full stop. @workedintheory your own policy says this: We may disclose the Personal Data listed above (your hashed IP address) to (...) to a potential buyer (and its agents and advisers) imagen Are you lying? 5 3 replies @workedintheory edited workedintheory Jul 5, 2021 Author This is a very standard clause you will in most Privacy Policies that describes a potential scenario in which the COMPANY is acquired. This is in no way related to sales of any data. This context is further clarified as "in connection with any proposed purchase, merger, or acquisition of any part of our business". It is further clarified with the statement "provided we inform the buyer it must use your Personal Data only for the purposes disclosed" previously in the document. This simply means that if the company is acquired, the acquiring entity may not use this data for any purpose than already described in the Privacy Policy. 5 @nico-abram nico-abram Jul 5, 2021 Thanks for your response. I understand that part isn't about sales of just the data, but surely you can see how it can be construed as selling the company=selling the data. However, I took a bigger issue with the "share" part of your statement than with the "sell" part, since this clearly allows sharing the data with a third party potential buyer (Even if it does not go through). You say this third party would also have to abide by your rules, but in my book this still qualifies as sharing the data with a third party. Have a good day @workedintheory workedintheory Jul 5, 2021 Author The word "share" in this very specific context refers to making available for review in the due diligence process related to an acquisition. This process does not actually review the content of the data, just simply verify that is it there, is organized as described, and functions as represented. -- This entire issue actually represents a broader issue in the entire software industry as a whole, and something I find myself personally frustrated with as a user of various software products myself. What I mean... The way the software industry has evolved, privacy policies, terms of service, and all other legal documents that are intended to inform the user are, in reality, written by lawyers for other lawyers. The user is, unfortunately, stuck in the middle. We're just as guilty of this as any other company out there. The unfortunate truth is that we have to use language that is very clear from one lawyer to another, but really might not be all that clear for the actual person using the software. The question here how we might balance the need to clearly inform the user, but state it in a way that is legally unambiguous. As I read the comments here in order to clarify each potential point of confusion, I am thinking about how we might be able to do this better in the future. One idea that comes to mind is to consider taking an annotation approach for legal documents similar to how Genius does with song lyrics. Sections are highlighted and explained further in very plain language that can very easily be understood. While it would be fantastic if we could just create plain language documents from the very beginning, this is not really how our legal system currently works and there are certain practices that have evolved for how to phrase something in a way that is generally accepted and legally unambiguous. Do understand that just as with the software development, all other aspects are also an iterative process. I do expect that we will soon arrive at a point where there is far less ambiguity and clearer understanding of the actual intent, which is to simply make the best possible software on the market that will remain 100% free and open. 2 You must be logged in to vote 1 @danielfleischer danielfleischer Jul 5, 2021 Can you clarify section 7.1, e.g. All your personal data is stored on our servers in the European Economic Area (EEA). However, we are occasionally required to share your personal data with our main office in Russia and our external counsel in the USA. 5 0 replies You must be logged in to vote 1 @AjHill15 AjHill15 Jul 5, 2021 How do you burn through so much good will this quickly and still get out of bed? Genuine question. 1 reply @darkstar darkstar Jul 5, 2021 Hanlon's Razor: "Don't attribute to malice what can be adequately explained by stupidity" I wonder why these days it's all about being so maximally enraged at things. Everyone suspects some sinister plot behind the smallest issues. I guess a majority of people who commented in this thread have not even used Audacity before. People need to calm down a bit. Stay at the current version if they don't like the new version, and if Audacity doesn't reverse/change these problematic issues, there will be forks that people can switch to. 3 You must be logged in to vote 1 @spamsgood spamsgood Jul 5, 2021 "You either die a hero or live long enough to see yourself become the villain" Looks like you guys have sold out and joined the massive horde of apps that mine our data. Shame. You shouldn't even be collecting our IP address or any data for that matter. I for one will be looking for other options unless you reverse this and promise not to collect our data. Maybe someone will make a fork and call it "audacity, without the spyware" super disappointed in you guys. You're better than this. 0 replies You must be logged in to vote 1 edited @julben julben Jul 5, 2021 Beware what you think: "pseudonymized" data might not be what you think and you might not be able to do even with the broad scope given by GDPR. Some European countries might not even allow you to do what you want. One random example, with official sources: https://www.ga4gh.org/news /are-pseudonymised-data-within-the-gpdrs-scope/ 0 replies You must be logged in to vote 1 @TiagoTiago TiagoTiago Jul 5, 2021 What counts as "off-line use"? Do I need to turn on Airplane Mode and close the curtains whenever I wanna use Audacity in private? Do I need to setup a separate airgapped machine? 0 replies You must be logged in to vote 2 edited @koblue koblue Jul 5, 2021 My questions: What valuable information do you get from telemetry that you cannot get from any other direct user feedback process? Why does telemetry extend to the point that you need a privacy policy, and the various regulations and T&Cs that come with that? edit: Why is this the story not "Here's a feature roadmap"? I get that things like policies and terms of service use boilerplate text, but even if you re-word and put it on a cake it the message still distils down to "this app phones home to the point lawyers are involved" 0 replies Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment Category General Labels None yet 47 participants @derekslenk @darkstar @DrMcCoy @TiagoTiago @sneak @nyuszika7h @majestrate @SkaveRat @theraot @reinaurre @koblue @AverageHelper @zelch @TheCreeper @crsib @databoose @Kavaeric @AjHill15 @AsuMagic @julben @trumad and others Beta Insert Link Link Text [ ] URL [ ] Add 1 1 1 1 1 [?] 1 1 1 * (c) 2021 GitHub, Inc. * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.