Create privacy policy

[pombredanne]

See https://lwn.net/Articles/937528/

We likely need to establish some minimal privacy policy since we have projects that collect and accumulate data, some of which contains things to identify a user (as publicly made available by these users, such as an AUTHOR files and so on).

@armijnhemel @johnmhoran @DennisClark @mjherzog

[armijnhemel]

Related to this: for VulnerableCode and other webbased services you probably are also storing information from visitors, such as:

1. which URL (or PURL) is visited
2. when it is visited
3. from where it is visited
4. (possibly) user that visited

and so on.

In case you are using this information (for example, for metrics or telemetry and related) you might want to disclose what information you are storing and for what purpose you will be using the information.

[PiyushAryan]

Hey @pombredanne please assign me this issue

[vikas83pal]

please assign me this issue i would like to work on this issue

[pombredanne]

@PiyushAryan @vikas83pal Thanks for you enthusiasm but:

1. we do not "assign issues" except for project committers which is a privilege that is earned based on past contributions
2. a privacy policy is something we, as "we the core project maintainers" need to design ourselves

With this said if you have links to examples you can post here, this will be mucho welcomed!

[vikas83pal]

Privacy Policy This Privacy Policy describes how [Your Website Name] ("we", "us", or "our") collects, uses, and discloses your personal information when you visit [website URL] (the "Site"). Personal Information We Collect We collect information that you provide to us directly when you interact with the Site. This may include: Your name Email address Mailing address Phone number Any other information you choose to provide How We Use Your Personal Information We may use the personal information we collect for various purposes, including to: Provide, operate, and maintain our website Improve, personalize, and expand our website Understand and analyze how you use our website Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes Send you emails Find and prevent fraud Sharing Your Personal Information We may share your personal information with third parties such as service providers, business partners, and affiliates for the purposes outlined above. Your Rights You have certain rights regarding your personal information, including the right to access, correct, or delete your personal information. You may also opt-out of receiving marketing communications from us at any time. Data Retention We will retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Changes to This Privacy Policy We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. Contact Us If you have any questions or concerns about our Privacy Policy, please contact us at [contact email].

…

On Tue, 19 Mar 2024 at 16:03, Philippe Ombredanne ***@***.***> wrote: @PiyushAryan <https://github.com/PiyushAryan> @vikas83pal <https://github.com/vikas83pal> Thanks for you enthusiasm but: 1. we do not "assign issues" except for project committers which is a privilege that is earned based on past contributions 2. a privacy policy is something we, as "we the core project maintainers" need to design ourselves With this said if you have links to examples you can post here, this will be mucho welcomed! — Reply to this email directly, view it on GitHub <#128 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2JOIVWIIWPR2EBGDFJZI4LYZAH67AVCNFSM6AAAAAA2CBP73KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBWG42DQNJVGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[nancy-verma780]

hi @pombredanne please assign this issue to me

[pombredanne]

@nancy-verma780 we do not "assign" issues... you are welcome to work on this, and you can discuss your ideas here first. Join also our chats :)

[nancy-verma780]

Hi @pombredanne, thank you for the guidance! Here is a structured layout draft for PRIVACY_POLICY.md that explicitly addresses public contributor metadata (like AUTHOR files) alongside visitor telemetry data (PURLs, timestamps, and server interactions) for web services like VulnerableCode as noted by @armijnhemel.

Please review the draft text below. If this aligns with the project's direction, I can open the official Pull Request right away.

---

AboutCode Privacy Policy

This Privacy Policy explains how the AboutCode project handles data gathered through our open-source tools, public contribution structures, and web-based services (such as VulnerableCode).

1. Information from Public Contributions

By contributing to AboutCode projects, certain publicly available information is stored and displayed openly:

• Contributor names, pseudonyms, and emails within project metadata files (e.g., AUTHOR, CONTRIBUTORS, or README files).
• Publicly accessible git commit histories and signature logs.

2. Information Gathered via Web Services (e.g., VulnerableCode)

When you interact with our web-based platform APIs and services, our infrastructure logs minimal routing data to verify system health and metrics:

• Specific URLs or Package URLs (PURLs) visited.
• Timestamps and execution markers of the request.
• Originating network routing protocols (IP Addresses) and visitor credentials (if logged in).

3. Telemetry and Project Metrics

Any metrics used to track API load, check database scaling, or monitor usage trends are compiled strictly using transparent, project-managed analytics. We do not transmit this data to invasive third-party commercial monitoring networks.

4. Your Rights and Contacts

Because our software ecosystem is open, you can audit, verify, or private-host any asset dependencies on your own infrastructure. For questions regarding metadata deletion or correction, please reach out to the core project maintainers on our community chat channels.