search

konklone / json

A free, in-browser JSON to CSV converter.
https://konklone.io/json/
Other
759 stars 211 forks source link

Make clear any privacy-relevant details about how user data is treated #136

Open mukkino opened 7 years ago

mukkino commented 7 years ago

Hello team. Thank you for this fantastic tool. I find it very handy and love it. As I would like to use it, I need to understand some more about data privacy. Unfortunately my JS and web development skills are not so good and I would like your help and opinion on what leaves my local PC. Scenario: I run the index.html locally on my laptop. I understood so far that 1) the json is uploaded to the cloud in the form of public gist when i save as permalink 2) the json is partially sent to github when I submit an error or fully if I submit the error as permalink 3) there are some Google Analytics in place and I am not sure if personal data is transferred somewhere by any chance. On the other hand I also understand that: 1) if I don't create a permalink data won't leave my laptop 2) errors won't be ever triggered automatically unless I don't decide to share them. Could you please describe a bit somewhere in the page how data privacy is handled? The tool is fantastic and it could be used for many things. Some of them might need some privacy. Are there any other ways my json can leave my PC to the cloud besides the ways I previously described? I think a bit of clarification will be beneficial to the project. Other questions would be: how do I delete a gist that already went to the cloud? What if I don't have the ID anymore? What are the chances for someone to retrieve that gist? What about the data I sent as error? Who can see that? Where it goes? How can I ask to delete it? I think many people are using the tool and are not aware of those data uploads and maybe others I hope you can point out that I missed. Thank you!

konklone commented 7 years ago

Hi @mukkino -- Sorry for taking so long to reply. I've had this in my TODO list to reply for like, 6 weeks now.

You raise a bunch of good points and I've been meaning to address the privacy ramifications on the site for some time.

I understood so far that 1) the json is uploaded to the cloud in the form of public gist when i save as permalink 2) the json is partially sent to github when I submit an error or fully if I submit the error as permalink 3) there are some Google Analytics in place and I am not sure if personal data is transferred somewhere by any chance. On the other hand I also understand that: 1) if I don't create a permalink data won't leave my laptop 2) errors won't be ever triggered automatically unless I don't decide to share them.

That's all correct. JSON is uploaded to GitHub if and only if the user opts in to do so, data is only submitted as an error report if the user opts in to do so. All data conversion is performed locally on the user's device.

The only thing Google Analytics might send related to the data is the gist ID itself, since that's in the URL of permalinks and Google Analytics does transmit the URL being visited.

Saying this explicitly would be helpful. I have very limited energy to devote to this tool, which is why it takes me a while to respond to things like this, but I'm leaving it open, renaming the issue to be more specific, and in general expressing my interest in doing this the next time I can devote a block of time to the tool.

Youphs commented 1 year ago

Hi @mukkino -- Sorry for taking so long to reply. I've had this in my TODO list to reply for like, 6 weeks now.

You raise a bunch of good points and I've been meaning to address the privacy ramifications on the site for some time.

I understood so far that 1) the json is uploaded to the cloud in the form of public gist when i save as permalink 2) the json is partially sent to github when I submit an error or fully if I submit the error as permalink 3) there are some Google Analytics in place and I am not sure if personal data is transferred somewhere by any chance. On the other hand I also understand that: 1) if I don't create a permalink data won't leave my laptop 2) errors won't be ever triggered automatically unless I don't decide to share them.

That's all correct. JSON is uploaded to GitHub if and only if the user opts in to do so, data is only submitted as an error report if the user opts in to do so. All data conversion is performed locally on the user's device.

The only thing Google Analytics might send related to the data is the gist ID itself, since that's in the URL of permalinks and Google Analytics does transmit the URL being visited.

Saying this explicitly would be helpful. I have very limited energy to devote to this tool, which is why it takes me a while to respond to things like this, but I'm leaving it open, renaming the issue to be more specific, and in general expressing my interest in doing this the next time I can devote a block of time to the tool.

Thanks for confirming the above, I have the same questions/concerns about privacy and personal data involved in some of the documents I'm working with. Can I also check if we can delete permalinks created and if so - how?

konklone commented 1 year ago

Permalinks haven't been a feature for a long time, as GitHub disabled anonymous gists (which was how those permalinks were persisted under the hood). But even when they were enabled, I don't believe they were delete-able on GitHub at all, because they were anonymous. So there would have been no way to remove them then, or now, in an automatic way. I think things like that contribute to why GitHub got rid of the feature.

If you have a particular anonymous gist you would like to see GitHub delete, I recommend writing support@github.com and asking for help there.