1100133 - Update SeaMonkey privacy page

Status: RESOLVED FIXED

(SeaMonkey :: Project Organization, defect)

Description

[RickieES aka Ricardo Palomares]

Attachment: New SeaMonkey Privacy Policy based on Firefox one

A draft privacy policy strongly based in Firefox one is attached to this bug so it can be used to replace the current one, labeled as Beta.

Although I've tried to make this HTML source to load all resources from seamonkey-project.org by using the <base> tag, without modifying anything else, it seems it only works for images.

Comment 1

[Philip Chee]

Comment on attachment 8523544 [details]
New SeaMonkey Privacy Policy based on Firefox one

I guess the next step is to get this reviewed.

Comment 2

[RickieES aka Ricardo Palomares]

(In reply to Philip Chee from comment #1)
> Comment on attachment 8523544 [details]
> New SeaMonkey Privacy Policy based on Firefox one
> 
> I guess the next step is to get this reviewed.

Oops! Thanks for noticing. :-)

Comment 3

[Jens Hatlak (:InvisibleSmiley)]

Comment on attachment 8523544 [details]
New SeaMonkey Privacy Policy based on Firefox one

First of all sorry for only getting to this now, I should have given you a quick feedback much earlier.

Also I only really skimmed this and will likely not find to check it in detail. Please ask someone else for an in-depth review, especially concerning whether it contains everything it should.

Since header and footer will be provided by the website template/standard page setup, only main content is relevant here.

>                        <p>Suite Updates: Once per day, SeaMonkey sends the following info to 
>                            Mozilla when it checks for suite updates: your SeaMonkey version 
>                            information, language preference, operating system and version.
>                            You can turn off updates by following the instructions you will
>                            find at Help > Customize SeaMonkey > Advanced Preferences > Software
>                            installation, but it may leave you open to security vulnerabilities.</p>

AFAIK English requires capitalization after a colon (in cases like this one). If unsure, please ask a native speaker.

"will find" sounds odd to me here, I'd just say "find".

>                        <p>Add-ons Blocklist: SeaMonkey contacts Mozilla once per day to check for
>                            add-on information to check for malicious add-ons. This includes, for 
>                            example: suite version, OS and version, locale, total number of 
>                            requests, time of last request, time of day, IP address, and the list of
>                            add-ons you have installed. You can turn off meta data updates at any time
>                            by following the instructions you will find at Help > Customize SeaMonkey
>                            > Advanced Preferences > Software installation, but it may leave you open
>                            to security vulnerabilities.</p>

Same as above.

>                        <p>Secure Website Certificates: When you visit a secure website (i.e. 
>                            "https"), SeaMonkey will validate the website's certificate. This may 
>                            involve communicating with a third-party status provider specified by 
>                            the certificate. SeaMonkey sends to this third-party information 
>                            identifying the site's certificate. You can

I think the last "third-party" is wrong (i.e. should be "third party") because there the entity itself is referred to rather than something relating to it.

>                        <p id="sync"><strong>Sync</strong>: <a href="https://www.mozilla.org/firefox/sync/">Firefox Sync</a>
>                            is the brand name of a service that allows you to sync your SeaMonkey bookmarks,
>                            browsing history, passwords, and settings across all of your devices. If you use 
>                            the Sync service, you can read the
>                            <a href="https://services.mozilla.com/privacy-policy/">Firefox Sync privacy notice</a>.</p>

Well actually you can read it whether or not you're using Sync. ;-) How about "please read" instead?

>                        <p id="location-services"><strong>Location services</strong>: SeaMonkey 
>                            has a feature that allows sites to request your location (e.g., to allow
>                            those sites to show your location on a map). If a site requests your 
>                            location, SeaMonkey seeks your permission before determining and sharing 
>                            your location. In order to determine your location, SeaMonkey may use 
>                            several pieces of data to determine your location, including your 
>                            operating systems geolocation features, WiFi networks, cell phone towers
>                            or IP address. Estimating your location involves sending some of this 
>                            information to Google's geolocation service, which has its own
>                            <a href="https://www.google.com/privacy/lsf.html">privacy policy</a>.</p>

"operating system's geolocation features"

>                        <p class="inproduct-link" id="crash-reporter"><strong>Crash reporting</strong>:
>                            You have the option to send Mozilla a crash report after SeaMonkey 
>                            crashes. This report contains technical information for us to improve 

That implies that it *will* crash. How about "in case" or "in the event" instead of "after"?

Also "will contain", since the report will only be created in the event a crash happens.

>                        <p id="addons"><strong>Add-ons</strong>: SeaMonkey offers a Get Add-ons 
>                            page of the Add-ons Manager that features popular add-ons and displays 

"offers ... of" sounds odd to me here. Maybe "contains ... in"?

>                            turned off by following
>                            <a href="https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/">these instructions</a>.The

Missing space/line break after full stop.

>                            add-ons manager in SeaMonkey has a search field where you can enter key 
>                            words to perform searches and Mozilla collects these key word searches, 
>                            as well as your SeaMonkey version information, locale, and OS to show you 
>                            recommendations.</p>

Personally I'd always write "keyword" instead of "key word" in such context, but then I'm not a native speaker of the English language. Don't know what's correct or if one is incorrect.

Comment 4

[Philip Chee]

Comment on attachment 8523544 [details]
New SeaMonkey Privacy Policy based on Firefox one

Flagging f? to some native Engrish speakers.

Comment 5

[RickieES aka Ricardo Palomares]

Attachment: Revised SeaMonkey Privacy Policy addressing points raised in comment #3

Comment 6

[Ian Neal]

"When SeaMonkey sends information to Mozilla, their privacy policy describes how we handle that information." - shouldn't it be "...they handle that information"?

Not sure that "SeaMonkey automatically connects to us and our service providers to provide updates, security and other features." is correct. Should it be "SeaMonkey automatically connects to Mozilla and their service providers to provide updates, security and other features." instead?

The section starting "Suite and add-ons updates" has two very similar entries. Is it worth having the two descriptions and then underneath a paragraph on what information is sent, how to disable it and why (in bold) it is better not to?

Everything else seems fine though.

Comment 7

[rsx11m]

Comment on attachment 8534629 [details]
Revised SeaMonkey Privacy Policy addressing points raised in comment #3

>        <div id="content">
>            <div id="side">
>                <ul id="nav">
>                    <li><a href="../">Home</a></li>
>                    <li><a href="../news">News</a></li>
>                    <li><a href="../releases/">Download and Releases</a></li>
>                    <li><a href="../community">Community and Support</a></li>
>                    <li><a href="../doc/">Documentation and Help</a></li>
>                    <li><a href="https://addons.mozilla.org/seamonkey/">Add-Ons</a></li>
>                    <li><a href="http://www.zazzle.com/seamonkeyproject">SeaMonkey Shop</a></li>
>                    <li><a href="https://donate.mozilla.org/page/contribute/seamonkey">Donate</a></li>
>                    <li><a href="../dev/">Development</a></li>
>                    <li><a href="../legal/">Legal Resources</a>
>                        <ul>
>                            <li><a href="../legal/trademark">Trademark Rules</a></li>
>                            <li><a href="../legal/privacy">SeaMonkey Privacy Policy</a>
>                                <ul>
>                                    <li><a href="../legal/third-party">Third-Party Service Providers for SeaMonkey</a></li>
>                                </ul>
>                            </li>
>                        </ul>
>                    </li>
>                    <li><a href="../about">About</a></li>
>                </ul>
>            </div>

Is this something that has to be added to each page individually or is it sourced from somewhere, given that it's supposed to be the same in all pages of the site?

>                <ul>
>                    <li>
>                        <p id="auto-updates">Suite and add-ons updates</p>
>                        <p>Suite Updates: Once per day, SeaMonkey sends the following info to 
>                            Mozilla when it checks for suite updates: Your SeaMonkey version 
>                            information, language preference, operating system and version.
>                            You can turn off updates by following the instructions you will
>                            find at Help > Customize SeaMonkey > Advanced Preferences > Software
>                            installation, but it may leave you open to security vulnerabilities.</p>
>                        <p>Add-ons Blocklist: SeaMonkey contacts Mozilla once per day to check for
>                            add-on information to check for malicious add-ons. This includes, for 
>                            example: Suite version, OS and version, locale, total number of 
>                            requests, time of last request, time of day, IP address, and the list of
>                            add-ons you have installed. You can turn off meta data updates at any time
>                            by following the instructions you find at Help > Customize SeaMonkey
>                            > Advanced Preferences > Software installation, but it may leave you open
>                            to security vulnerabilities.</p>
>                    </li>

I think the last paragraph is wrong here. Bug 635115 - Allow opting out of sending add-on information to the discovery pane without disabling automatic add-on updates. Switching off the "Personalize add-on recommendation" option only disables icons, descriptions, ratings and reviews from AMO according to bug 639722 comment #11, thus add-on and blocklist updates should still work.

>                    <li>
>                        <p id="security">Security</p>
>                        <p>SeaMonkey automatically checks for malicious or forged web pages, broken
>                            add-ons, and third-party issued SSL certificates.</p>

Since bug 1060852 and follow-ups, we have also made the tracking-protection feature available in the Privacy & Security preferences (I don't think it's enabled by default yet, though). Thus, a paragraph similar to "Safe Browsing" should be added for "Tracking Protection" as it's basically using the same mechanism (just a different list).

>                            involve communicating with a third party status provider specified by

"third-party" needs a hyphen here (even in en-US).
 
>                        <p class="inproduct-link" id="crash-reporter"><strong>Crash reporting</strong>:
>                            You have the option to send Mozilla a crash report in case SeaMonkey 
>                            crashes. This report will contain technical information for us to improve 
>                            SeaMonkey including why SeaMonkey crashed, the active URL at time of crash, 
>                            and the state of computer memory during the crash. The crash report we 
>                            receive may include personal information.

Does it? I thought it's only sending non-identifying data (if a complete URL is sent, of course, that could be considered personal information).

>                        <p id="addons"><strong>Add-ons</strong>: SeaMonkey contains a Get Add-ons 
>                            page in the Add-ons Manager that features popular add-ons and displays 
>                            personalized recommendations based on the add-ons you already have 
>                            installed. To display the personalized recommendations, SeaMonkey sends 
>                            information to Mozilla, including the list of add-ons you have 
>                            installed, SeaMonkey version information, and your IP address. This 
>                            communication only happens when the Get Add-ons area is open and can be 
>                            turned off by following
>                            <a href="https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/">these instructions</a>.

This link isn't necessary, we have this option in the preferences UI. Just refer to the Software Installation pane and ask to disable "Personalize add-on recommendation" (which makes me wondering if my understanding of the previous paragraph re add-on updates and blocklists commented on above is wrong).

>        <div id="footer">
>            <ul id="footer-menu">
>                <li><a href="../sitemap">Site Map</a></li>
>                <li><a href="http://www.mozilla.org/security/">Security Updates</a></li>
>                <li><a href="../about">About SeaMonkey</a></li>
>                <li><a href="../about#contact">Contact Us</a></li>
>            </ul>
>            <p class="tLicense">SeaMonkey and the SeaMonkey logo are <a href="../legal/trademark">registered trademarks</a> of the <a href="http://www.mozilla.org/foundation/">Mozilla Foundation</a>.</p>
>            <p class="tLicense">Portions of this content are &copy; 1998&#8211;2014 by individual mozilla.org contributors; content available under a Creative Commons license | <a href="http://www.mozilla.org/foundation/licensing/website-content.html">Details</a>.</p>
>            <ul class="site-tools">
>                <li>Last modified May 07, 2012</li>
>                <li><a href="http://bonsai-www.mozilla.org/cvslog.cgi?file=seamonkeyproject-org/src/legal/privacy.en.html&amp;root=/www/">Document History</a></li>
>                <li><a href="https://doctor.mozilla.org/?action=edit&amp;file=seamonkeyproject-org/src/legal/privacy.en.html">Edit this Page</a></li>
>                <li>(or <a href="http://www.mozilla.org/contribute/writing/cvs">via CVS</a>)</li>
>            </ul>
>        </div>

Again, wondering if that's a global definition somewhere (especially the "Last modified May 07, 2012" looks like it should come from a script).

Looks good otherwise!

Comment 8

[rsx11m]

(In reply to Jens Hatlak (:InvisibleSmiley) from comment #3)
> Since header and footer will be provided by the website template/standard
> page setup, only main content is relevant here.

Ok, this answers my first and last points.  ;-)

Comment 9

[RickieES aka Ricardo Palomares]

(In reply to Ian Neal from comment #6)
> "When SeaMonkey sends information to Mozilla, their privacy policy describes
> how we handle that information." - shouldn't it be "...they handle that
> information"?

Addressed in forthcoming new version.

> Not sure that "SeaMonkey automatically connects to us and our service
> providers to provide updates, security and other features." is correct.
> Should it be "SeaMonkey automatically connects to Mozilla and their service
> providers to provide updates, security and other features." instead?

Also fixed in next version.

> The section starting "Suite and add-ons updates" has two very similar
> entries. Is it worth having the two descriptions and then underneath a
> paragraph on what information is sent, how to disable it and why (in bold)
> it is better not to?

I've found too may differences between the two paragraphs to mix them. Perhaps someone can make a proposal?

Comment 10

[RickieES aka Ricardo Palomares]

(In reply to rsx11m from comment #7)
> Comment on attachment 8534629 [details]
> Revised SeaMonkey Privacy Policy addressing points raised in comment #3
> >                <ul>
> >                    <li>
> >                        <p id="auto-updates">Suite and add-ons updates</p> (...)
> >                        <p>Add-ons Blocklist: SeaMonkey contacts Mozilla once per day to check for
> >                            add-on information to check for malicious add-ons. This includes, for 
> >                            example: Suite version, OS and version, locale, total number of 
> >                            requests, time of last request, time of day, IP address, and the list of
> >                            add-ons you have installed. You can turn off meta data updates at any time
> >                            by following the instructions you find at Help > Customize SeaMonkey
> >                            > Advanced Preferences > Software installation, but it may leave you open
> >                            to security vulnerabilities.</p>
> >                    </li>
> 
> I think the last paragraph is wrong here. Bug 635115 - Allow opting out of
> sending add-on information to the discovery pane without disabling automatic
> add-on updates. Switching off the "Personalize add-on recommendation" option
> only disables icons, descriptions, ratings and reviews from AMO according to
> bug 639722 comment #11, thus add-on and blocklist updates should still work.


Addressed in forthcoming version.


> 
> >                    <li>
> >                        <p id="security">Security</p>
> >                        <p>SeaMonkey automatically checks for malicious or forged web pages, broken
> >                            add-ons, and third-party issued SSL certificates.</p>
> 
> Since bug 1060852 and follow-ups, we have also made the tracking-protection
> feature available in the Privacy & Security preferences (I don't think it's
> enabled by default yet, though). Thus, a paragraph similar to "Safe
> Browsing" should be added for "Tracking Protection" as it's basically using
> the same mechanism (just a different list).


Added in next version.


> 
> >                            involve communicating with a third party status provider specified by
> 
> "third-party" needs a hyphen here (even in en-US).


Fixed, too.


> >                        <p class="inproduct-link" id="crash-reporter"><strong>Crash reporting</strong>:
> >                            You have the option to send Mozilla a crash report in case SeaMonkey 
> >                            crashes. This report will contain technical information for us to improve 
> >                            SeaMonkey including why SeaMonkey crashed, the active URL at time of crash, 
> >                            and the state of computer memory during the crash. The crash report we 
> >                            receive may include personal information.
> 
> Does it? I thought it's only sending non-identifying data (if a complete URL
> is sent, of course, that could be considered personal information).


I think that's one reason. The other would be, IIRC, that you can provide your email address to be contacted for further details (that's definitely personal information). :-)


> >                        <p id="addons"><strong>Add-ons</strong>: SeaMonkey contains a Get Add-ons 
> >                            page in the Add-ons Manager that features popular add-ons (...)
> >                            This 
> >                            communication only happens when the Get Add-ons area is open and can be 
> >                            turned off by following
> >                            <a href="https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/">these instructions</a>.
> 
> This link isn't necessary, we have this option in the preferences UI. Just
> refer to the Software Installation pane and ask to disable "Personalize
> add-on recommendation" (which makes me wondering if my understanding of the
> previous paragraph re add-on updates and blocklists commented on above is
> wrong).

Link removed and replaced by indications to the built-in help.

As I said, the content is based on the current Firefox Privacy Page. Still, I applied your suggestions about the previous paragraph and they sounded totally reasonable to me, so you're probably right.

I'm going to upload the full new version and a diff to the previous one.

Thank you very much for your feedback!

Comment 11

[RickieES aka Ricardo Palomares]

Attachment: SeaMonkey Privacy Policy.html addressing issues in comments #6 and #7

Comment 12

[RickieES aka Ricardo Palomares]

Attachment: Diff between previous proposed version and current one

Comment 13

[RickieES aka Ricardo Palomares]

I probably should have asked for feedback 9 days ago, sorry.

Comment 14

[Philip Chee]

Comment on attachment 8561101 [details]
SeaMonkey Privacy Policy.html addressing issues in comments #6 and #7

> You can change your preferences by following the instructions you find at
> You can change your preferences by following the instructions at
> 
> Visit https://support.mozilla.org/en-US/kb/tracking-protection-firefox  to learn
> Visit https://support.mozilla.org/kb/tracking-protection-firefox  to learn
> (Don't hard code the locale. Let the website autodetect the locale)
> 
> If you disable this feature, SeaMonkey cannot prevent you from being tracked by those known sites.
> If you disable this feature, SeaMonkey cannot protect you from being tracked by those known sites.
> ..............................................^^^^^^^

Comment 15

[RickieES aka Ricardo Palomares]

Attachment: Revised SeaMonkey Privacy Policy addressing points raised in comment #14

Comment 16

[RickieES aka Ricardo Palomares]

Perhaps some of you can help to check in the page into the website. :-?

Comment 17

[Jens Hatlak (:InvisibleSmiley)]

Attachment: changes.patch

Before it can be committed, the file needs to be adapted to the actual source format of the website, i.e. before header and footer get added through the website build scripts. I did that for you with the attached, including reformatting (2-space indentation, paragraph tags on their own lines).

Please verify that everything is as expected (don't be scared by the amount of changes; I neither changed any words from your patch nor kept anything of the old contents).

mcsmurf: Please check as well.

All: I already updated the staging website with the attached. So if you have the relevant information, you may check the result of the attached patch using the staging site yourself. Otherwise, please ask someone (e.g. on IRC in a private channel/session) but please don't post any credentials on Bugzilla.

Comment 18

[RickieES aka Ricardo Palomares]

Comment on attachment 8570597 [details] [diff] [review]
changes.patch

Thank you for taking the time to adapt the file. It looks fine to me.

Comment 19

[Jens Hatlak (:InvisibleSmiley)]

Checking in privacy.en.html;
/www/seamonkeyproject-org/src/legal/privacy.en.html,v  <--  privacy.en.html
new revision: 1.4; previous revision: 1.3
done