Missing Privacy Policy #62

maureece commented 2025年09月13日 20:21:36 +02:00

Sunup does not provide a privacy policy for the autopush-rs provider configured as default (currently Mozilla). This does not comply with GDPR, especially since this service is apparently hosted by Google and therefore sends data to an entity subject to US surveillance laws.

Sunup does not provide a privacy policy for the autopush-rs provider configured as default (currently Mozilla). This does not comply with GDPR, especially since this service is [apparently hosted by Google](https://digger.tools/lookup/push.services.mozilla.com) and therefore sends data to an entity subject to US surveillance laws.

s1m commented 2025年09月14日 14:13:56 +02:00

What part of the GDPR are you thinking about ? And what kind of Personally Identifiable Information (PII) is it about ?

By the way I couldn't find any privacy policy for the push service on Mozilla, maybe I can add a link on the README and the store description to this general page: https://www.mozilla.org/privacy/ but autopush don't use, share, or store these data

What part of the GDPR are you thinking about ? And what kind of Personally Identifiable Information (PII) is it about ? By the way I couldn't find any privacy policy for the push service on Mozilla, maybe I can add a link on the README and the store description to this general page: https://www.mozilla.org/privacy/ but autopush don't use, share, or store these data

maureece commented 2025年09月15日 18:39:21 +02:00

Sunup sends Personally Identifiable Information (PII) of users inside the EU, such as the client's IP adress, to a third party outside the EU (Mozilla/Google). It should (at minimum) provide information to the user inside the app about

1. what data is being collected/sent (i.e. IP adress, push token, other device info?),
2. who this data is being sent to (Mozilla/Google) and
3. what this data is being used for/how it is processed (i.e. a short explanation and a link to the corresponding privacy policy of Mozilla/Google).

This is not legal advice and should not be understood as such. If there is no applicable privacy policy available for the Mozilla push service, you should at least refer to the corresponding privacy policy for Google Cloud (of which Bigtable is a part). Please note that there is an additional privacy policy for GCP customers, which also discusses the processing of "Technical and operational details", including "device identifiers, identifiers from cookies or tokens, and IP addresses", "[a]pproximate location data, as may be determined by IP address" and "[i]nferences drawn from the above, like aggregated [...] metrics". They also may disclose this information to third parties for commercial purposes and "in response to legal process or enforceable government requests, including to law enforcement". It is unclear to me whether this privacy policy applies to PII sent to Google Bigtable on behalf of Mozilla, and it would be the responsibility of Mozilla to make this clear to the users of their push service.

In this context, this blog post by the UP team is helpful, since it lists metadata exposed to the server and also explains what inferences can be made from it.

Sunup sends Personally Identifiable Information (PII) of users inside the EU, such as the client's IP adress, to a third party outside the EU (Mozilla/Google). It should (at minimum) provide information to the user inside the app about 1. what data is being collected/sent (i.e. IP adress, push token, other device info?), 2. who this data is being sent to (Mozilla/Google) and 3. what this data is being used for/how it is processed (i.e. a short explanation and a link to the corresponding privacy policy of Mozilla/Google). This is not legal advice and should not be understood as such. If there is no applicable privacy policy available for the Mozilla push service, you should at least refer to [the corresponding privacy policy for Google Cloud](https://cloud.google.com/terms/data-processing-addendum/) (of which Bigtable is a part). Please note that there is [an additional privacy policy for GCP customers](https://cloud.google.com/terms/cloud-privacy-notice), which also discusses the processing of "Technical and operational details", including "device identifiers, identifiers from cookies or tokens, and IP addresses", "[a]pproximate location data, as may be determined by IP address" and "[i]nferences drawn from the above, like aggregated [...] metrics". They also may disclose this information to third parties for commercial purposes and "in response to legal process or enforceable government requests, including to law enforcement". It is unclear to me whether this privacy policy applies to PII sent to Google Bigtable on behalf of Mozilla, and it would be the responsibility of Mozilla to make this clear to the users of their push service. In this context, [this blog post by the UP team](https://unifiedpush.org/news/20250513_push_security_privacy/) is helpful, since it lists metadata exposed to the server and also explains what inferences can be made from it.

s1m commented 2025年09月17日 10:37:16 +02:00

I will add a policy in the next release 👍

PS: I wrote the blog post :)

I will add a policy in the next release 👍 PS: I wrote the blog post :)

s1m commented 2025年09月23日 15:05:24 +02:00

I've also added the privacy policy to weblate: https://translate.codeberg.org/projects/unifiedpush/sunup-android/

I've also added the privacy policy to weblate: https://translate.codeberg.org/projects/unifiedpush/sunup-android/

maureece commented 2025年09月23日 16:14:21 +02:00

Thanks for the commits! I can't seem to figure out how to do a pull request in the Forgejo web client, so this has to suffice:

1. In app/src/main/res/values/strings.xml: Replace therefor with therefore. Also please clarify that the Mozilla push service is hosted by Google.
2. I have added a german translation of the strings on Weblate.
3. The privacy policy linked to in app/src/main/java/org/unifiedpush/distributor/sunup/activities/ui/PrivacyPolicyDialogUi.kt is wrong, as far as I can tell, since it applies only to the Firefox browser and not other services offered by Mozilla. If you want to link to Mozilla, you should use https://www.mozilla.org/en-US/privacy/.
4. Please also link to your blog post, since it explains how the metadata collected by the push service can be used against users.

Thanks for the commits! I can't seem to figure out how to do a pull request in the Forgejo web client, so this has to suffice: 1. In [app/src/main/res/values/strings.xml](https://codeberg.org/Sunup/android/src/branch/main/app/src/main/res/values/strings.xml): Replace `therefor` with `therefore`. Also please clarify that the Mozilla push service is hosted by Google. 2. I have added a german translation of the strings on Weblate. 3. The privacy policy linked to in [app/src/main/java/org/unifiedpush/distributor/sunup/activities/ui/PrivacyPolicyDialogUi.kt](https://codeberg.org/Sunup/android/src/branch/main/app/src/main/java/org/unifiedpush/distributor/sunup/activities/ui/PrivacyPolicyDialogUi.kt) is wrong, as far as I can tell, since it applies only to the Firefox browser and not other services offered by Mozilla. If you want to link to Mozilla, you should use https://www.mozilla.org/en-US/privacy/. 4. Please also link to [your blog post](https://unifiedpush.org/news/20250513_push_security_privacy/), since it explains how the metadata collected by the push service can be used against users.

s1m commented 2025年09月23日 16:30:18 +02:00

This is actually the less wrong link as the other is about many services (their website, Mozilla VPN, Mozilla Monitor, Firefox Relay, etc.) but the one of them that includes the policy about the push service is their Browser, as it is their only service using it.

This is actually the less wrong link as the other is about many services (their website, Mozilla VPN, Mozilla Monitor, Firefox Relay, etc.) but the one of them that includes the policy about the push service is their Browser, as it is their only service using it.

s1m commented 2025年09月23日 16:33:02 +02:00

I'm updating the policy, a moment. And thanks for the typo

I'm updating the policy, a moment. And thanks for the typo

s1m commented 2025年10月01日 11:44:23 +02:00

Sorry I did a wrong thing on weblate and it removed your translation, I got a backup and committed it again, but it doesn't appear as your contribution

Sorry I did a wrong thing on weblate and it removed your translation, I got a backup and committed it again, but it doesn't appear as your contribution