Actions needed to keep app on WMF Google Play Store account

[misaochan]

WMF has been talking to me about the actions needed in order to keep our app on their Google Play Store account. The list of actions we have agreed upon is as follows:

• Nicolas, myself, and anyone with access to the crash reports forum will have to sign NDAs. If anyone wishes to relinquish crash report forum access instead of signing the NDA, that's fine too.

• Modify disclaimer for app store listing - I will do this shortly based on Aeryn (WMF lawyer)'s recommendations

• Modify disclaimer for About page in app - we will need to do a release for this to be effective

• Finish drafting new privacy policy - https://github.com/commons-app/apps-android-commons/wiki/Privacy-policy (must mention Mapbox). Add a privacy statement #520 could be useful here.

• Implement OAuth for login OAuth? #819 - waived

• Release modifications to production, inform WMF that everything on our side is complete

• Security reviews - the WMF Android team will be reviewing our app for security concerns shortly, and will schedule further reviews in the future, but there is nothing we need to do on that point currently.

[misaochan]

Disclaimer for app store listing (drafted by Aeryn with my input):

[Name of App] is an open-source app created and maintained by grantees and volunteers of the Wikimedia community to allow the Wikimedia community to contribute content to Wikimedia Commons. Wikimedia Commons, along with the other Wikimedia projects, is hosted by the Wikimedia Foundation. The Wikimedia Foundation is pleased to support community developers by offering the app here, but the Foundation did not create and does not maintain this app. For information about the app, including its privacy policy, see the information at the bottom of this page. For information about the Wikimedia Foundation, visit us at wikimediafoundation.org.

Disclaimer for About page in app:

[Name of App] is an open-source app created and maintained by grantees and volunteers of the Wikimedia community. The Wikimedia Foundation is not involved in the creation, development, or maintenance of the app.

[misaochan]

@nicolas-raoul , any idea how we can draft a proper privacy policy without legal assistance?

[nicolas-raoul]

My idea is to just take the WMF one, replace the name and nature of the project, then remove the many irrelevant parts.

…

On Sep 26, 2017 18:18, "Josephine Lim" ***@***.***> wrote: @nicolas-raoul <https://github.com/nicolas-raoul> , any idea how we can draft a proper privacy policy without legal assistance? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#891 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAGFBryKx3EE1edlv-zkt-hWBkHFjsL4ks5smMFWgaJpZM4PhdZQ> .

[misaochan]

Yeah, I think that should be OK as long as we mention Mapbox as well?

Where should we host our privacy policy once we have drafted it? Is the GitHub wiki sufficient?

[nicolas-raoul]

Yes, Github Wiki is good enough I think, and it is the most flexible option. Once things settle down we can think of moving it to the official website.

…

On Wed, Sep 27, 2017 at 3:32 PM, Josephine Lim ***@***.***> wrote: Yeah, I think that should be OK as long as we mention Mapbox as well? Where should we host our privacy policy once we have drafted it? Is the GitHub wiki sufficient? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#891 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAGFBrj_dIZpirR1orpn2EhXO4fL-fB9ks5smggcgaJpZM4PhdZQ> .

[misaochan]

Sounds good to me!

[misaochan]

I've been reading up on how other apps handle their privacy policies - what do you guys think about using guidelines or templates similar to https://www.iubenda.com/blog/privacy-policy-for-android-app/ and https://www.iubenda.com/blog/warning-google-play-developer-policy-violation-action-required-policy-issue/ for writing ours? I wonder if that may be an option, as the WMF one looks rather long and convoluted and it's hard to know which parts pertain to us.

I'm also somewhat surprised that the Wikipedia app doesn't appear to have its own privacy policy on the Play Store and just uses the standard Wikimedia one. I would have thought that they would have needed to disclose the Android-specific sensitive permissions, etc. (I was initially hoping to be able to use theirs as a guideline, lol)