Me and my friend were discussing privacy concerns regarding the use of a activity tracking application - Rescuetime.
It's privacy policy says,
We will never sell, rent, or otherwise share your personal information, with or without personally identifying information. Furthermore, we will never share anonymized selections of your individual data.
My friend told me that,
"This does not mention anything about data derived from your personal information. That's the problem with legalese — unless explicitly ruling out stuff, it's fair game."
So I was wondering if that was true, can rescuetime legally sell statistics, interpretations, aggregates, derived data etc? Does their policy only claim to never sell the data stored in whole or any subsets of it?
Also this policy states,
We may share information about user behavior in the aggregate only. For example, we could share information like, "which day of the week do people spend the most time in front of their computer?" This type of analysis is used to enrich the product, and to represent our domain expertise to our audiences.
Does this mean they can only share it internally? Does it make sense for it be between teams? For enriching their application? Can this sharing include to other companies? Can they sell it? I was thinking they mean they will only use it for improving their product and to market the product, to get investors etc. But they are not limited only to that right? Here audiences is not defined, who could it be?
How enforceable is this privacy policy? The fear of being exposed and losing customer trust is one incentive to adhere to this policy, but can we sue the company for damages? Is this just a list of things it will try to do.
