Updating Discourse itself per GDPR etc


#1

Hi, as Snowdrift.coop is also running Discourse (but not quite widely announced yet, still tweaking final settings), we’ve been working to update things as best as we can for GDPR.

The meta.discourse.org forum has lots of topics discussing this, and the main post is:

https://www.discoursehosting.com/your-discourse-forum-and-the-gdpr/

We’re also writing a basically new privacy policy to be a lot less B.S. meaningless liability-avoidance and a lot more human-readable emphasis on informing people and advocating for real privacy.

I thought it might be good to collaborate with you as one of the others in the minority of even Discourse users who are fully privacy-conscious. When we get through a full draft of our policy, you’re welcome to adapt it, etc.

Discourse will itself be getting more GDPR-appropriate updates in the future, and they haven’t yet updated the default Privacy Policy for the software, even though they have their own policy for their instance.


#2

Yes, that sounds like a great idea. Email me or PM me if you want to discuss this privately, but I’m happy to discuss here too.


#3

If it comes up that we need to be confidential or are worried about liability merely in discussing the policy, we can be more private. For now, I see no need for that.

We could merge it so it’s already live, but I’m waiting on feedback from some other folks currently. Meanwhile, here’s a direct link to our draft:

And the merge request has a PDF and HTML rendered version (but may not get updated with every new fix/commit given feedback etc): https://git.snowdrift.coop/sd/snowdrift/merge_requests/128

There’s a bunch of things to mention:

  • Our overall goal is to present and commit to the highest standards as explicitly and clearly as we can
  • We deviated substantially from the boilerplate legalese in Discourse’s own policy. Essentially, we rewrote everything to improve reader experience, aiming for people to truly understand the policy.
  • We aimed to use a mostly-consistent “if you… then…” format to say which actions result in what data-gathering
  • The policy is meant to cover our whole domain, with a Discourse section called out (i.e. we do not do as much tracking outside of Discourse, no logging of how long people spend looking at what etc)
  • We explicitly state that we minimize tracking and isolate the Discourse tracking to just Discourse
  • Although there’s CSS stuff to do to make the best design, I felt overall that bullet-point formatting was often superior design for user readability in this case instead of lots of paragraphs. Adding bold and headers and other visual formatting cues whenever appropriate would be good too.
  • There’s some opt-ins we want but don’t have implemented yet (such as whether stay-logged-in cookies are used on our main site)
  • We went with the conservative interpretation of email and turned off the digest default for new users (and are investigating the best way to say to new Discourse users “hey, there’s no email notifications by default, so if you want any, you have to choose to turn them on”)
  • I want to look into the custom User Field options in Discourse for some of the opt-in stuff
  • We didn’t do any updates to Terms yet, focusing on just Privacy Policy at this time

I’d love to get any feedback, suggestions, questions (picky details about exact words totally welcome!) etc. and hope this is useful to you too. It’s a very complex topic to try to get this right (and go beyond the letter of the law to actually having policies we want people to read and written to actually hold us to high standards and validate people’s rights and privacy in principle).

Hope that’s all clear…


#4

I think it’s great, thanks for sharing. I didn’t see anything that I would be picky about, and it’s easy to understand too.

After also reading the Discourse Hosting post, I’ve set the digest emails to default to “Never” here as well. Though I’ve left the Reply and Direct Message emails enabled, as I think that’s expected behaviour.

To be honest, the Discourse account’s replies on Twitter about GDPR have given me some cause for concern. I do not get good vibes about the company.


#5

I’m not sure which you refer to here, but I think judging anyone by their Twitter postings is troublesome.

I’ve engaged at the meta.discourse.org forum and overall find the Discourse folks to be pretty reasonable. They respond directly, are engaged, care about the product, and hey, it’s 100% FLO, unlike GitLab or others.

It’s clear that privacy hasn’t been their top priority even if they aren’t ignoring it. They have limited bandwidth themselves, and we’d love to eventually help fund them through Snowdrift.coop. As is, they definitely focus on their paid customers, and I just get the impression that they want to avoid any legal liability around GDPR. While they are late, they’ve made it clear that they identified places where IP was tracked and logged where it shouldn’t be, and they are explicitly working to fix that.

I guess my core point is: I don’t feel I can talk to them where they fully get it (the way I can talk to you), but I don’t have bad vibes, I think they’re overall still good folks. They’re not VC-funded and have committed to 100% FLO long-term…