This was a bad idea when the app was standalone—a no-name Israeli startup snooping into all your traffic—and now it's spyware. This is one major (if not THE) reason not to trust small startups with unclear privacy policies—they are often bought in order to (ab)use the data they have collected and continue abusing it from unsuspecting users. Terrible.
So, as the first tech hire/partner, what can we do to protect our users?
- Expire non-critical data after 30 - 90 days, e.g. activity data, not account data.
- When feasible, have the client encrypt the really private user data, only store encrypted blobs on the server (Protonmail does this).
- Send out a positively worded, subtle email notice to warn the more savvy users of a pending acquisition, as soon as that news is no longer private. Let them disseminate the real sitrep on social media and in the news. We did build a community, after all.
- Propose a data architecture update for great efficiency, in which redundant and superfluous data is cleaned and aggregated, before the big handover.
Are there any other suggestions? I am particularly curious if the laws of any one user's country could be used to complicate or thwart a bulk handover of private user data to a new owner. Europeans, I'm looking at you for advice.
By far the most important protection you can provide is to bind your future abilities with a "Ulysses pact"[1]. Cory Doctorow ave a great talk[2] last year about how important it is to create these limitations when you don't need them, because there is a good chance you won't be strong enough to resist temptation when problems start accumulating. In some situations, it may not even be your choice.
