I have a website that you need an account to access. The signup process is very simple and all you need is a username and password. There is nothing stopping the user from entering a username having nothing to do with them. They could enter whatever they want and be 100% anonymous. Another thing is I am putting an app using the same login system in the app store. In the app store review guidelines it says you must have a privacy policy if you offer even a free subscription? Does that include a login in my scenario where it is only a username and password?
2 Answers
Many people use the same username + password on many sites. I'd expect that you keep passwords safe (storing the password salted + hashed, and if you don't know what that means then stop right now until you know it), and I'd want a privacy policy that states this clearly.
And you wouldn't need a username + password if there wasn't something stored about that user, right? So I'd want a privacy policy about whatever you store as well.
answered Dec 24, 2015 at 1:00
You should probably have a privacy policy, with at least the following things:
- Do you collect the IP address form the site? If so, what do you do with the IP address?
- Do you collect any data specific to that user when he is using the app?
- Are there cookies? What do you do with them?
- If you are in the USA, you need to warn the user that he can not register when he is under 13 years old because of the COPPA (Children Online Privacy Protection Act).
Warning: I'm not a lawyer, and in fact, I have never had any higher eductation related to law.
