webamp

webamp copied to clipboard

As a user who didn't have time to examine the code, I think it's good to have statements about user data would be handled in webamp.org , since this web-based player can open user's files (music, equalizer presets or skins).

• Is the music loaded into Webamp kept only in the browser's cache, or would it be uploaded to some servers?
• Is the playlist handled the same way? (I.e. Will the server keep a copy of user's playlist?)
• If foreign codecs are supported, will the codecs be run in the user's browser? Or will there be server-based decoding?

Not intended to be a long (and boring) legal document, but short statements in the web page that answers at least these questions for webamp.org server.

This is a fair point. I'll try to answer briefly here as a sketch of some more formal documentation:

Webamp is entirely a browser-based software project. There is no server component. That said, we do make use of some third-party services to gain insight into how the project is being used, and to ensure that it is working properly.

1. Your music/skin/eq presets never leave your browser.
2. Data about how users interact with the website, is logged to Google Analytics to help me understand how people are using it.
3. In the event that we encounter an error, a log report is sent to Sentry with a snapshot of the current state of the application. This includes metadata about the tracks in your playlist, but no actual media contents.

These are true of the demo site, which lives at <webamp.org>, but none of these third party integrations are embedded in the core library which is published to npm: https://www.npmjs.com/package/webamp

If for whatever reason you would prefer an experience that does not include these integrations, it should be very simple to setup your own copy which does not include them. An example can be found here: https://github.com/captbaritone/webamp/tree/master/examples/minimal

Update:

I've just removed the detailed analytics logging. We now only log when you visit and how long you stay (the default Google Analytics logging) rather than logging each interaction.

https://github.com/captbaritone/webamp/commit/967a4d4feac7ab1a910c03fb42e8ca1635fa8f26

Since this topic is now opened, maybe, in addition, it would be a good idea to take a look at complying with the GDPR.

Obviously, I am not a lawyer, but from my experience implementing the requirements that could mean:

1. Anonymize IP in GA - basically add ga('set', 'anonymizeIp', true) after ga('create')
2. Anonymize data sent to Sentry (?) - never done that

If that is done, this is where I have conflicting experience, on some projects we were told that once everything is not personally identifiable, there is no need to do anything more. On the others, it was the same old drill of:

1. Don't collect anything (don't set up GA/Sentry) until it is explicitly accepted.
2. Allow the user to change his mind.

Hey @durasj thanks for following up here.

I've added a commit to anonymize the GA ip, and found that in the Sentry UI I can turn off IP logging, so I've done that as well.

I can't seem to find any consensus as to what exactly they mean by "identifying information". I never intentionally establish any type of "identity" for a user. For now I feel like I've made a best effort to not log anything identifiable so until we as an industry learn more, I think this will do.

One thing that's not clear to me is what the privacy policy needs to include, and how prominent it needs to be, especially considering I don't ever intentionally identify the user in any way. Can I just include it in a context menu? I would really hate to add a prominent link to the extremely minimal UI that I currently have at webamp.org.

@captbaritone My suggestion was to put a small link titled "Privacy Info" or "Privacy Policy" on the bottom of the webamp.org page, similar to how Github and Twitter link have been done. When user clicks it, you can pop up a dialog which you can explain everything privacy related. I don't know if you have a better idea.