Hi Christoph, Thanks for pointing out GDPR-specific compliance measures that VisiData is missing. I began looking into it, and I'm aiming to update our privacy policy this week.
My understanding is that "legitimate interests" requires a straightforward opt-out mechanism (which VisiData does provide), but doesn't require opt-in. We're going to ensure we meet legitimate interests compliance. My plan is: * to add language related to "legitimate interests" as the GDPR legal basis * automate the deletion of individual data the day after the daily usage counts are calculated * create a process for data access and deletion requests if a person wants their data deleted earlier Again, thank you for drawing our attention to this! Best, Anja On Sat, 1 Mar 2025 at 16:37, Christoph Berg <m...@debian.org> wrote: > Re: Anja > > The creator of VisiData goes into great depth here about his decision to > > enable motd by default: https://github.com/saulpw/visidata/issues/913 > > > > The privacy page is here: https://www.visidata.org/privacy/. > > This privacy policy is incomplete. You are collecting PII (the IP > address of users of the program, not just the website visitors), but > there is no data protection officer defined, no contact address for > enquiries, etc. As you probably have users in Europe, the GDPR apply, > and this is a violation. > > Collecting PII needs a legitimate reason, and the one stated here "we > like to have numbers of users" sounds nice to have, but I really don't > see it outweighing the interest of the user to remain private. > > TBH, you are on very slippery ground here and would be far better off > by turning this off for legal reasons. > > As already mentioned, there is the Debian popularity contest (which is > opt-in), and it does have visidata numbers: > > https://qa.debian.org/popcon.php?package=visidata > > This is how this works in Debian. Please you can keep the feature, but > make it opt-in. > > There is no written policy for this yet, but every other package I > know with such a feature has turned it off in the packaging. > > Thanks. > > Christoph >
