I'm old fashioned and like my privacy

[PuzzledUser]

I fear this is going to come across as ungracious, however, I came here to buy Pro as I love the trial and want to support your efforts Istvan. However, I have concerns:

1. Paddle's privacy policy says they have a legitimate interest in carrying out — Processing for the purpose of conducting surveys, satisfaction reports and market research
2. This whole SaaS lark makes me nervous. If Paddle has a problem, my purchase goes pop, as your software is dependant on their black box online licensing magic.
3. Sentry has quite a list of categories (Affiliate companies, Third-party services providers, Third-party go-to-market partners, Third-party advertising and analytics partners, Third-party platforms, etc.) to whom they share personal data too.
4. I'm no Sparkle fan, but I guess I gotta suck up its data collection tendencies...

I don't suppose you have another option (like a checkbox to prevent your 3rd party tools Hoovering up your user's data) to support your work whilst giving me extra features (without selling my soul to these helpful little devils)? 👴

[waydabber]

Hi @PuzzledUser - I fully understand your concern. However you are right, I don't see many alternatives. :/ Basically any solution that involves online payment and processing is by nature like this. Providing invoices and getting actual buyer information (and then keeping the records for this and taxing and refund reasons) is simply required by law. I could maybe do crypto only but that would make the entire thing basically unsustainable + the whole international taxing thing is so complicated that I can't even begin to figure out how to do it. Paddle handles all payment, processing and taxing aspects and so far they acted graciously whenever I had an issue. I did opt out of all things regarding "community building", market research and similar stuff (precisely because I don't want to have any user data with me, to me this would only be a complication and would require various GDPR things to do which is not really that inspiring... :)). So for sure, Paddle's database (since they are resellers) has the data and they are using it according to their Privacy Policy, but again, all online marketplaces are like this - the upside of Paddle doing all this is that all user and licence data is outside of my or the app's scope, it is handled by a (fairly secure) blackbox created by a specialized (and supposedly professional) team which has much better chance of keeping things safe than if I'd attempt to collect all the data, handle all the paperwork and give out licenses. So I think if you have to choose between trusting Paddle and me doing it, you are still better off with Paddle (not because I'd want to mishandle any data but I am not a data security expert and might not be that good at protecting stuff as a dedicated team who does this full time).

Sentry is simpler matter in a sense that the app is configured in a way that it does not send any user data with crash reports (which is easy to do since the app itself does not collect or handles any data, it is really unable to do so). I do see the raw crash reports so I can confirm that this is the case. I also configured Sentry to send only actual crashes, not any other telemetry, so (luckily, as the app is rather stable) I don't receive much reports. The reports may contain some hardware information (model, OS version etc) and sometimes other hardware identifiers if it is relevant to the crash, but since I can't tie it to users and reports are rare, this cannot be used for anything nefarious in practice.

But as it is probably obvious, I am not a security expert so I might be wrong or naive about any or all of this stuff. :)

[DennisSchiefer]

I'd like to piggyback on this discussion @waydabber with some similar concerns (if you prefer, I can also open a new discussion for better visibility):

• Did I understand this correctly: The app only talks once with Paddle for activation, afterwards there is no more communication unless there is a substantial hardware change detected? And I assume there is some dialog box before actually sending something to Paddle? I am asking since external network connections to non-approved sites are very much discouraged for us.
• Also, is the hardware information send to Paddle? This would unfortunately make the tool non-usable for me.
• In the same vein, you mentioned that crash reports include hardware information. For this reason, could you add a check box to opt out of crash reports?

[waydabber]

The app will communicate with Paddle regarding activation of Trial, fetching Paddle product data initially and if it can, it will periodically check the license. If this is a real issue in the environment you work in, the app might not be the best choice (but a really protected environment should simply not allow any outgoing communication except for approved destinations).

I might release a stripped down, free version of the app that does not include any Pro features to begin with at a binary level. This version will not have Paddle included (obviously). This is just a plan/idea right now, will probably do this at the end of the development cycle of the 1.x versions when transitioning to 2.x.

Yes, I can add a check box to opt out of crash reports, thanks for the suggestion! - #1650

[waydabber]

I'll add an option to disable Paddle as well, but that will force the app to a non-Pro mode. This might be useful for folks who don't want to purchase the app anyway and want full isolation. #1657

[waydabber]

I should also add a direct link to the Privacy Policy (and License Terms, but that's an other topic) inside the app. - #1659

[DennisSchiefer]

Thank you, much appreciated!

[waydabber]

Further clarified what requires network communication and where are the relevant privacy policies under Settings/General:

[Cassian-Andor]

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

[waydabber]

Hi there - if you try this, let me know what happens. I think the app should stay activated at least for a while. Paddle's framework is sadly not really that crackproof though, which is a shame - this results in a number of cracked Paddle apps are out there on various shady sites. These may contain other surprises as well, like some extra malware etc.

[waydabber]

Note: just posted a version with these privacy features, it should not wait till 2.0.x.