Security and privacy professional. Currently testing and evaluating Signal username staging application.

  • 1 Post
  • 17 Comments
Joined 1 year ago
cake
Cake day: June 27th, 2023

help-circle



  • Anytype has responded and I had a couple other clarifying questions. Their first response:

    “Hi! In our privacy policy we include Amplitude & Sentry & explain why we work with them: anytype.io/app_privacy. Currently, you can opt-out by electing local-only or self-hosted network Mode”

    Sentry is only used for bug tracking and I don’t have any issue or privacy concerns with that.

    I had already looked on their website for a privacy policy and the only one I could locate was a website only privacy policy. I learned later that the application privacy policy is buried as a link somewhere within the website privacy policy. This is not very easy to find.

    I reviewed the application privacy policy and it conflicted with their answer stating that a user could opt out of information sharing with Amplitude by using “local only” or “self-hosted”. So I pointed this out and posted this reply to them:

    “Also, app privacy policy section for Amplitude states: Amplitude Analytics Purpose: deliver behavioral and app usage data. Opt-out possible: NO”

    This is the response I received:

    “Indeed this is outdated information, as it was written before self-hosting and local-only mode were properly configurable. Opt-out is now possible using these methods, and we will be updating the policy accordingly.”


  • I looked at some of these on my own and found:

    • graylog provides data privacy and protection services for companies offering software as a service (SaaS). So this seems legit to me and needed for their core functionality. It is not a marketing or data analytics company.

    • amplitude appears to be a data analytics company and on the surface is not needed and Anytype should explain this.

    • sentry appears to be an application error tracking company and this seems a legit connection

    • api2 seems like a generic server name and likely needed for their core functionality, this seems legit to me

    • telemetry also seems like a generic server name; however, the purpose, based on its name does not seem to be needed. Anytype should explain this as well.