Re: Potential Launch of Boost Website: Request for Final Feedback

From: Phil Endecott (spam_from_boost_dev_at_[hidden])
Date: 2024-02-13 15:47:17

Louis Tatta wrote:
> Your insights a few months ago were incredibly helpful, and as we approach
> the launch, we'd value your final review. If you have a moment to look over
> the site again and note any issues or suggestions, it would be of great
> help.

I've read the privacy policy. Who wrote it?

It looks like it may have lost some formatting or links at some point. For
example, the paragraph starting "How do we process your information?" ends
with the phrase "Learn more about how we process your information" 
which is
not a link; should it be a link to a section later in the document?

I'm unclear as to whether this should really be a "C++ Alliance" privacy
policy or a "Boost.Org" privacy policy. Whose website is it?

It says that you don't receive any information from third parties. If you're
not receiving information from Google Analytics, why is it on the page?

There is a sentence "All personal information that you provide to us must
be true, complete, and accurate, and you must notify us of any changes to
such personal information.". This isn't something you can put in a privacy
policy. The privacy policy should be a one-sided statement of what your
policy is; it's not a contract between you and the website visitor.

Apparently you collect location data: "Location Data. We collect location
data such as information about your device's location, which can be either
precise or imprecise. How much information we collect depends on the type
and settings of the device you use to access the Services. For example, we
may use GPS and other technologies to collect geolocation data that tells
us your current location (based on your IP address). You can opt out of
allowing us to collect this information either by refusing access to the
information or by disabling your Location setting on your device. However,
if you choose to opt out, you may not be able to use certain aspects of
the Services."

I hope that including the "precise" "GPS" terminology in there is a mistake
and what you really mean is that you may attempt to guess what country I'm
in from my IP address. If you really are trying to get my precise location,
and you're relying on me actively opting-out, then that's completely
unacceptable (and likely illegal). Please elaborate on what aspects of the
service might not work.

"We may share your information with our business partners to offer you
certain products, services, or promotions" - does that not need explicit
consent?

"By using the Services, you represent that you are at least 18 or that
you are the parent or guardian of such a minor and consent to such minor
dependent’s use of the Services." - that's unacceptable; don't we want to
encourage young people to use Boost? It's also, as mentioned above, not
something that you can put in a privacy policy. It's "terms and conditions".
If you want to ban under-18s from the site you need a T&Cs popup on the
front page, like pr0n websites do.

At the bottom of the page there is a URL: "To request to review, update,
or delete your personal information, please visit:
https://www.boost.org/contact." - but that URL 404s.

** I do not feel that the site can "go live" with this privacy policy 
in place **

I see there is also a "Terms of Use" page which is longer than the privacy
policy page. I don't have time to look at it in detail now, sorry, but
a cursory glance suggests that it is also unacceptable. To be honest, as
it stands now, I would suggest that *no-one who is using Boost in a product
even visit the website* because by doing so you appear to be agreeing 
to a
whole load of terms in which C++ Alliance claim to own all of Boost and
permits us to use it "solely for your personal, non-commercial use or
internal business purpose."

Regards, Phil.