e-foundation

/e/ is a free and open source Android based mobile operating system and associated online services.

8.3/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? No

10/10

Does the service allow you to permanently delete your personal data? Yes, using an automated mechanism

5/5

Does the service allow third-party access to private personal data? No

10/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

"We do not share, disclose or otherwise distribute any data to third parties."

"As a non-profit, we rely on donations and e.foundation allows you to make a donation. Those transactions are processed by third parties, and not e.foundation. e.foundation does not receive any financial information, which is transmitted from you to our third party vendors for processing. The name of the third party will be displayed at the time of the transaction."

Notes

"Mozilla receives publicly observable data about WiFi access points, Bluetooth beacons and cell towers around you, your estimated latitude and longitude, the date and information about your heading, speed and altitude. This information is stored locally on your device until an Internet connection is established. The data is then deleted from your device and sent to Mozilla."

When does the policy allow law enforcement access to personal data? When reasonably requested

3/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

"IP addresses are logged for the minimum legal duration."

"When you connect to our servers to update /e/OS, we collect some visitors statistics such as your IP address, only for our internal use. This information is not disclosed unless legally obliged to do so."

"All data on your "own" /e/ server is encrypted and never shared, sold or traded to any third party. We will only disclose the limited user data we possess unless legally obliged to do so."

Transparency

Does the policy outline the service's general security practices? Yes

2/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

"Your personal information is contained behind secured networks at our partners and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive information you supply is encrypted via Secure Socket Layer (SSL) technology."

"We implement a variety of security measures when you place an order and enter, submit, or access your information to maintain the safety of your personal information."

"All data on your "own" /e/ server is encrypted and never shared, sold or traded to any third party."

Is the policy's history made available? No

0/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? Yes

5/5

Collection

Does the service collect personal data from third parties? No

10/10

Is it clear why the service collects the personal data that it does? Yes

10/10

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? N/A (no data used for non-critical purposes)

10/10

Does the policy list the personal data it collects? Yes, exhaustively

10/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

"Applications: there is no systematic mining of the data sent to you other than to provide you with search results. There is no manual processing or transfer to any third party. IP addresses are logged for the minimum legal duration."

"Location: we don't collect or keep any information about your GPS location. To be able to locate you when you use the onboard maps application or other services requiring your location, we do so by leveraging the Mozilla Location Services API. This means that Mozilla receives your approximate location when you ask us to locate you. If you do not want to report crowd-sourced data to Mozilla, you can set your location services to 'off' or 'device only'. In addition, Mozilla may receive certain temporary data such as your IP address. This data is deleted after being used as follows: for security purposes to protect against certain types of attack. to assist in providing you with an approximate location."

"OTA updates: when you connect to our servers to update /e/OS, we collect some visitors statistics such as your IP address, only for our internal use. We use these statistics internally, for example, to know which country users come from or which smartphones variants are being updated. These statistics are not providing us any personal identifiable information."

"We collect information from you when you create an account on our gitlab space, when you post or edit code source, comment, or post an issue. This information is used to identify your profile and contributions on this developer portal."

Last Updated

March 1, 2021

Sources

Source #1 ↗

Contributors

erotavlas