Hacker News Reader

Comment by cosinetau | Hacker News Reader

This product is dangerous to privacy. It's easy to imagine how this data could be exploited if Monica is sold to Facebook, Google, etc.

How are you working to guarantee my data is protected from any manner use outside my own?

View on HN

> How are you working to guarantee my data is protected from any manner use outside my own?

From the README on Github:

"We provide a hosted version of this application on https://monicahq.com.

If you prefer to, you can simply clone the repository and set it up yourself on any hosting provider, for free. I'm just asking that you don't try to make money out of it yourself."

So to guarantee the privacy of your data, set it up on your own server (maybe even locally hosted if you're that paranoid) and you're set.

THIS! I had privacy concerns, but you just blew them away. If I can host this in my own server, I'm sold. HUGE THANKS!

As these things go, the privacy policy is excellent, and can be read in under a minute:

https://monicahq.com/privacy.html

It's not excellent. Nothing about data security, encryption at rest, and a whole load of things that would be covered by GDPR (yes the service is registered in Canada, but GDPR standards should be the benchmark now for what is considered acceptable for anything).

This is an intriguing idea as a concept but feels like it isn't a sufficient focus. The privacy page hasn't been updated in 18 months either, yet the release notes mention encryption at rest (with very little detail) being added in October 16.

Just as a data point, this is the first time I ever heard about GDPR. Not sure it's "the minimum acceptable standard for anything".

It will be if you want to operate in Europe.

If you have users in the EU/EEA then you _will_ have to comply, or risk a fine of up to €20,000,000 or 4% of your _global_ turnover (whichever is larger).

That is not a good privacy policy. Founder needs to talk to a lawyer, or the EFF.

For instance:

> Monica runs on Linode and I'm the only one, apart from Linode's employees, who has access to those servers.

This speaks to nothing about future use, which is what my question specifically asked.

Good point.

My question is about this line:

> When you close your account, we will immediately destroy all your personal information and won't keep any backup.

I'd love to hear how you're purging users from your backups, and how long you keep backups.

Not loading now.

If this bothers you just host it yourself, that's why it's open source

That's a good solution for someone like me, who can roll my own, but not someone like my parents who have no idea how to do that. That does not bode well for privacy. Your suggestion is half-assed.

well, i haven't looked too closely, but i guess i'd be ok to run your own if this bugs you too much. there are links to the github repo on the site.

Reply on news.ycombinator.com