Posts relating to privacy.

2019-02-10 GoodReader EULA

Today I wrote an email...

Hello Support

I just got greeted by the new EULA and it makes me very unhappy. In this age where we are constantly being tracked and spied upon, you are joining the ranks of those who claim to act in my interest but who don’t. If you are not incredibly precise, I’m just going to assume the worst. I’m going to assume that you are going to use the broadest interpretation possible, store all data possible, and lose it or abuse it eventually, like so many other companies, despite your best efforts right now. You know the stories in the news.

I just want an app to read and annotate PDF files. I don’t want this:

“2. Consent to Use of Data: You agree that Licensor may collect and use technical data and related information, including but not limited to technical information about your device, system and application software, and peripherals—that is gathered periodically to facilitate the provision of software updates, product support, and other services to you (if any) related to the Licensed Application. Licensor may use this information, as long as it is in a form that does not personally identify you, to improve its products or to provide services or technologies to you. In some cases, your personal information, including but not limited to e-mail address, may be required to provide certain additional services. In such cases, the Licensor may use this information and store it on its servers to facilitate the delivery of requested services.”

My system? My application software? Which ones? Peripherals? Where does that end? Periodically, even if I have no problems? Other services? Like what? Not limited to my email address? Ugh, ugh, ugh.

Accordingly, I grind my teeth and accept this, hating the app and the company, for forcing this on me, and look for another app that doesn’t do this to me. Perhaps this is the same EULA as before and I just hadn’t read it before? Well, if so, my opinions have changed.

Regards from Switzerland
Alexander Schroeder

As it turns out, they sent back a reply and linked to a (new?) Privacy Policy. I think it was well worded and looks totally like something I can keep using. Thanks!

Hi there

We’re sorry about the impression you may have received based on the legal language of our EULA. It seems that the wording has caused some confusion and anxiety for many users. We are going to add more clarification to the EULA in the next update.

For now, please read our Privacy Policy for more clarification, which I hope will address your concerns:

Section 2 of the EULA states , we “may collect and use technical data and related information, including but not limited to technical information about your device, system and application software, and peripherals—that is gathered periodically to facilitate the provision of software updates,”...etc.

We assure you that the only way we gather data is through voluntary submissions from GoodReader users via e-mail, which the user can choose not to send if they prefer not to. The EULA ensures we have your permission to use the data that you choose to send to us.

The GoodReader app does not, and cannot, automatically gather any information about you, your data, or the way you use GoodReader.

Additionally, please read the full About GoodReader description here:

As stated: “Above all, we value your privacy: GoodReader’s commitment is to never monitor users or activity. We aim to be the most privacy focused iOS productivity tool in the market. We never ask for your personal information and there are no usernames or profiles. Use the tool at your leisure with ZERO monitoring.”

Please know that if you have data stored in GoodReader, accepting the EULA is not the only way to access that data. It is always possible to access data within an app without needing to open or launch the app by using Apple’s USB iTunes File Sharing technique described here:

Best regards,

– [somebody]

GoodReader Support


Add Comment

2018-10-05 Digitale Gesellschaft (CH)

Ich habe soeben die Newsletter der Digitalen Gesellschaft gelesen und war positiv überrascht:

  1. Der Kampf gegen die Vorratsdatenspeicherung wird an den Europäischen Gerichtshof für Menschenrechte (EGMR) in Strassburg weiter gezogen.
  2. Der Nationalrat hat 182 gegen 5 (!) Stimmen für eine gesetzlich festgeschriebene Netzneutralität gestimmt.

Leider wird auch festgehalten, dass die Netzsperren, dieses lausige Mittel, welches mit dem Geldspielgesetz eingeführt wurden, jetzt auch für dokumentierten Kindermissbrauch gelten sollen. Ein schlechte Massnahme wird nun für zwei Probleme verwendet, ohne diese zu lösen. Das etwas gegen den Kindermissbrauch gemacht werden muss, ist ja klar. Aber warum gerade Netzsperren hier das Mittel der Wahl sind, scheint mir vor allem auf Denkfaulheit zu beruhen. Aus dem Auge, aus dem Sinn! Dann muss man sich keine besseren Massnahmen überlegen und vor allem diese auch nicht bezahlen. Und ein weiteres Zeichen der Denkfaulheit ist die Gelassenheit, mit der zukünftigem Machtmissbrauch ein Weg bereitet wird. Wenn dann mal die falsche Regierung an der Macht ist, steht die Netzsperre schon überall zur Verfügung. Nur dass sich dann keiner wundert, wie schnell das gehen kann.

Mehr dazu im Artikel «Löschen statt Sperren» im revidierten Fernmeldegesetz.


Add Comment

2018-07-03 Privancy and Agency

Why personal agency matters more than personal data: „For example, the clothes that we wear are privacy technologies. We also have norms that discourage others from, for example sticking their hands inside our clothes without permission. The fact that adtech plants tracking beacons on our naked digital selves and tracks us like animals across the digital frontier may be a norm for now, but it is also morally wrong, massively rude and now illegal under the GDPR.“


Add Comment

2018-06-07 No More WhatsApp

So, I want to move away from WhatsApp. What should I tell my friends and family?

  • the family already uses Threema so that’s good but sadly it’s not Free Software; they also don’t require a phone number to sign up
  • everybody seems to be recommending Signal but I don’t like the fact that a phone number is required; basically an invitation to chat automatically is an invitation to call
  • apparently Wire has been catching up; if you sign up on the website instead of using the app, you can register without providing a phone number (but see below)

Or we could use XMPP. I could self host.

  • Server would get Prosody (but see below)
  • iOS users would get ChatSecure
  • Android users would get Conversations via F-Droid

@switchingsocial suggested I take a look at Ring. It looks interesting!

@RussSharek suggested Rocket.Chat or Zulip. @Nuntius said that Rocket Chat wouldn’t federate. Well... it might still work, I guess?

Right now, though, Signal doesn’t look too bad after all!

I’ll take another look, tomorrow.

Matrix and Riot

Matrix is the cool new thing but Riot is a client I don’t find appealing. One particular concern I have with Riot is that some of the people I want to chat with teenagers in my RPG group and when I use Riot I’m confronted with a huge list of public rooms and I’d like to avoid that.


The advantage of Wire and Signal over Threema is that they are Free Software. Or parts of them, at least. The advantage of Wire over Signal is that you can sign up with multiple accounts. But I was unable to do it!

I had Wire installed on my phone and decided to try and create a second account. But their website shows you stuff depending on your browser and I could not find a way to do it. When @aendi sent me the direct link to create an account on their website, it showed me a blank page, using Safari on the iPad I get a message telling me to download the latest Google Chrome, Mozilla Firefox, Opera or Microsoft Edge; using Google Chrome on the iPad doesn’t work either, even if using “Desktop Version”. And on the phone itself, I cannot create a second account because the phone number is “in use” and when I try to remove it from my existing account I cannot (and I think there’s a message telling me more somewhere hidden behind the number keyboard on iOS which I can’t read).

Needless to say, this is frustrating. So at this point, Wire is at the same level as Signal, for me: one account tied to my phone number.


Many people have suggested XMPP and some have suggested self hosting. @codingquark suggested installing Prosody on Debian. So I did that. I went through the config file and things were looking good until I came to the section about chatrooms. This is pretty essential for me. After all, that’s what WhatsApp and Threema both offer and it’s the killer feature. It allows family channels (for all the overlapping sets of an international patchwork family), various groups for all the disjoint interest groups, gaming, school, whatever. But XMPP must have added this with a completely different use case in mind. I’m looking at the configuration instructions, which point me to the chatrooms instructions, which point me to the DNS instructions because chatrooms happen on a subdomain. This puts more burdens on me and is very annoying.

Well, I did all that. And after getting all the TLS stuff right, here we are: In ChatSecure, I add an account:, with a password – the same I used to create it using prosodyctl adduser, and click on the check mark...

And watch the logs on the server...

Jun 07 23:49:42 c2s5562d9922ee0	info	Client connected
Jun 07 23:49:42 c2s5562d9922ee0	info	Client disconnected: closed

That’s it. ChatSecure doesn’t realize this, however, and the wait animation keeps spinning. This is super sad!

Perhaps self hosting is not the answer.

@megfault suggested I just use established servers. @nipos suggested, and he told me about two other clients: Zom is supposed to look “like an normal messenger” and then there is Conversations (for Android). I think on iOS the client to use would be ChatSecure.


Comments on 2018-06-07 No More WhatsApp

Regarding TLS...

@algernon said: Interesting. I had no trouble with TLS. Grabbed a cert from LetsEncrypt, prosodyctl --root cert import /etc/letsencrypt/live, and done. The last step is important, ’cos Prosody by default does not have access to the LE certs.


@ckeen said: If you have enabled http_upload and http you can try that port with a web browser to check whether the certificate is correct. The default port is: 5281 for TLS

Regarding encryption:

@algernon said: I used the Prosody 0.11 packages via stretch-backports, the default config worked out of the box. The “roster” and “pep” modules need to be enabled for OMEMO. For encryption to work, you will have to first log in with a client that supports encryption (Dino, Empathy, Conversations, Converse.js were the ones I found working, Movim did not support OMEMO).

@ckeen said: The conversations client site has a list of peps you should enable for the best experience. and compare with

@algernon also posted their config. Very cool.

Thank you both! 🙂

– Alex Schroeder 2019-03-13 08:42 UTC

Add Comment

2018-05-27 Privacy Policies

I’ve been writing some privacy policy statements...

I will need a few more: Community Wiki, Campaign Wiki, etc. But they’ll all be basically copies of the Oddmuse Wiki Privacy Statement. I might have to adapt the markup but basically that’s it. From an admin perspective, they’re all set up the same way: they use the same software and the logs all use the same logrotate configuration.


Add Comment

2018-05-27 Facebook

I need a new link collection, I think. It all started with a Mastodon thread by @paul talking about Facebook.

Facebook accused of conducting mass surveillance through its apps. «The lawsuit claims the ability to read text messages on Android phones was also partially disclosed, presented to users as a way to make logging in easier, but Facebook deployed it to collect a range of other messages and the associated metadata. [...] Facebook has not fully disclosed the manner in which it pre-processes photos on the iOS camera roll, meaning if a user has any Facebook app installed on their iPhone, then Facebook accesses and analyses the photos the user takes and/or stores on the iPhone, the complainant alleges.»

Zuckerberg set up fraudulent scheme to 'weaponise' data, court case alleges. «A company suing Facebook in a California court claims the social network’s chief executive “weaponised” the ability to access data from any user’s network of friends – the feature at the heart of the Cambridge Analytica scandal. A legal motion filed last week in the superior court of San Mateo draws upon extensive confidential emails and messages between Facebook senior executives including Mark Zuckerberg.»

These links concern the same case: «The company that has filed the case, a former startup called Six4Three, is now trying to stop Facebook from having the case thrown out and has submitted legal arguments that draw on thousands of emails, the details of which are currently redacted.» (ibid) This company does seem rather shady and I think it needs to be reiterated that all of this is alleged and not proven. «Six4Three lodged its original case in 2015 shortly after Facebook removed developers’ access to friends’ data. The company said it had invested $250,000 in developing an app called Pikinis that filtered users’ friends photos to find any of them in swimwear.»

Comment by @switchingsocial: «If this week’s allegations are true, FB’s income depends mostly on selling personal data to companies. Apparently FB technically avoid “selling it” by giving it away, but only give it away to companies that buy lots of ads. If it is true, then in effect they are exchanging personal data for ad revenue, and the ads themselves are irrelevant except as a payment method for data sales.»

Facebook Has Many Sins To Atone For, But 'Selling Data' To Cambridge Analytica Is Not One Of Them. «The real problem was in how all of this was hidden. It comes back to transparency. Facebook could argue that this information was all “public” – which, uh, okay, it was, but it was not public in a way that the average Facebook user (or even most “expert” Facebook users) truly understood. So if we’re going to bash Facebook here, it should be for the fact that none of this was clear to users.» I’d argue that transparency is not the goal. Ethical behavior is. Thus, we want to use transparency to enforce ethical behavior. That is why there is some extra bashing due after the bashing for a lack of transparency.

Facebook Knows How to Track You Using the Dust on Your Camera Lens. Summary by @switchingsocial: “They even patented a method for analysing dust/scratches on camera lenses, to identify the person taking the picture.”


Comments on 2018-05-27 Facebook

Thanks for gathering this all together!

(test commenting too)

– At PresGas at freeradical dot zone 2018-05-27 15:30 UTC

You’re welcome. 😀

– Alex Schroeder 2018-05-27 15:47 UTC

Add Comment

2018-05-25 Libratone Speakers Privacy Policy

I own two Libratone Loop speakers. Libratone is a Danish company.

There is an app that comes along with them which you can use to set some speaker parameters. This used to be fine, I felt. Years ago, I suddenly had to register in order to use the app. I hated that.

With the GDPR I got many mails, including one by Libratone, linking to their Privacy Policy. At the very top:

One of the key features of the App is to connect you to personalized audio content based on your listening preferences and interactions with the App (which is described more fully below). If you are not interested in this feature, you should not sign up to use the App and you should delete the App from your device. This will not affect your ability to stream audio content to your Product via Bluetooth, Wi-Fi or any other means of connectivity (connectivity options vary between models).

I guess I don’t get to use those speaker parameters. Let’s hope they didn’t make much of a difference.

Now I want to delete my account with them and I can’t find the link. Should I just send them mail? Wouldn’t that be great: a barrage of counter-spam for all the people out there.

At least all those emails must have alerted people all over the world that something regarding privacy was going on?


Add Comment

2018-05-24 Ads

About twenty something years ago I might I have said that ads are bad because they are so damn irrelevant to my life. I didn’t think it through. Now technology has made it possible to serve me relevant ads by going Big Brother on me and I still hate ads!

I find it hard enough these days to walk through the Zurich main station with all their moving ads distracting me left and right. I hate the noise so I wear headphones. I hate the ads so soon I will need to wear ad-blocking glasses! All ads do is add temptation to my life and if I then deny myself the indulgence, the ads add misery and unhappiness to my life where just moments ago I was happily ignorant and content.


Comments on 2018-05-24 Ads

Your writing is really good at connecting yourself with other human beings. We all are here to connect with each other. I ride the bus to “people watch” and maybe connect with a person or two. Try that out; focus on the humans around you and not the distractions. I know it is easier said than done.

It is funny as my kids tell me “You really know everyone, don’t you?!?” ...but that is me just not getting distracted from the crap marketing and other things and just being in the moment with the rest of us.

– At PresGas at freeradical dot zone 2018-05-25 02:52 UTC

I love people watching when I’m on holidays. I once spent days with a friend in Florence just watching the tourists. I guess I’m a Flâneur wanna-be: “the man of leisure, the idler, the urban explorer, the connoisseur of the street.” (Wikipedia) But also this: “to remain hidden from the world” (Baudelaire, quoted on that page). Such a wonderful article.

There’s also being in public early in the morning or late in the evening, tired, exhausted. Social contact, people talking to me, and ads trying to gain my attention seep my energy. I don’t mind as much when I’m happy and fit and full of energy. But during my commute, not so much.

Also, thanks for the kind words. :)

I guess you could just provide the URL to your Mastodon profile as the homepage URL below and it would link your name automatically. Mentioning Mastodon accounts works as well, e.g.

– Alex Schroeder 2018-05-25 08:29 UTC

The End of the Ad-Supported Web: “This started with the “information overload” complaints from 20 years ago and continued with the incessant slideshows, notifications, click bait and eventually fake news: everything that can steal a couple more minutes of the free web users’ time is financially rewarded: the content itself becomes an excuse for the ads that surround it.”

– Alex Schroeder 2018-12-17 06:26 UTC

Add Comment

2018-05-14 Advertising

I just read a blog post about the GDPR and ads that I would like to share. Somewhere in the middle there is this image.


And below it: «It was a survey of ad industry people: “300+ publishers, adtech, brands, and various others…” Pause for a moment and look at that chart again. Nearly all those proffesionals in the business would not accept what their businesses do to other human beings.»

Pause for a moment, yes indeed.

And yes, I try to use ad blockers at all times.


Comments on 2018-05-14 Advertising

From a toot on Mastodon I wrote: Changing jobs is hard and there is hardship all over the world. People working in adtech will suffer for sure and that makes me sad, yes. But they worked in adtech, tracking me, selling my data to the highest bidder, circumventing my blockers, inventing permanent cookies, exploiting the bugs in my browsers, they have been real and active enemies of my online life for a great many years and for this evil intent and their callousness I shudder in disgust.

– Alex Schroeder 2018-05-15 10:50 UTC

Some great messages in this thread [1][2], and a link to If digital advertising sneezes, will content marketing catch a cold?

– Alex Schroeder 2018-05-16 08:08 UTC

DSGVO-Beschwerden gegen Android, Instagram, Whatsapp und Facebook: Max Schrems legt los

– Alex Schroeder 2018-05-25 09:20 UTC

GDPR mayhem: Programmatic ad buying plummets in Europe.

– Alex Schroeder 2018-05-26 21:44 UTC

Add Comment

2018-03-17 Oddmuse and the EU

I have started working on a plan for Oddmuse regarding the EU Data Protection Directive, today. You can read about it on the Oddmuse Wiki.

The basic idea is that I want to get rid of IP numbers as far as possible. I got rid of hostnames a while back already. But IP numbers are still to be found all over the place.

My plans:

  1. run the script for all my sites
  2. work on the remaining issues as listed on link above


Add Comment



Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.