There was a really nice blog post and intro from the new product manager for Audacity some months ago talking about the new governance, and he seemed very earnest and positive, but looking at this privacy agreement, I'd wonder how much executive power earnest people could have in it.
Thinking the solution to this may be a privacy patch that carves out this data collection code. I really don't want to have to comb through sources or binaries for watermarking features and other spy tools.
One thing that does not appear mentioned in the table of data they collect is When they collect your OS and IP address, and what other metadata about your project files gets collected.
Let's say I am processing some sensitive media, or even analyzing politically provocative materials, do hashes of it or identifiable information about my content get sent to Audacity that can be compared online?
Given the Data Controller in that privacy agreement is regstered in Russia, if I use Audacity to do audio forensics on purported Russian propaganda media, does that mark out my IP/OS and identifiers to them? This seems like an extreme question, but the tools that are going to be used to fight deepfakes are going to (or were going to) include tools like Audacity.
Under what they collect about you:
> "Data necessary for law enforcement, litigation and authorities’ requests (if any)"
So an unspecified blob of law enforcement data, which is anything they want. This is not a privacy commitment. I can see why there was some controversy on the project.
The obvious question is, "we're a commercial service who is now responsible for this, and things are complicated, so what would you have us do?"
The answer is: facilitate completely offline, and anonymous use of the open source parts of the code, potentially by allowing users to flag privacy invading code as off at compile time.