Is there a policy about “telemetry”, or shall we create one for Flathub?
tl;dr I submitted an update to a Flatpak, and for that new version I also disabled the telemetry module introduced, solely on privacy grounds: send nothing no privacy issue with it. https://github.com/flathub/org.musescore.MuseScore/pull/50
An there seems to be a disagreement.
While I can understand the goal of a telemetry system, I believe it is a privacy issue and we know nothing about what’s happening with the data. I glanced at what the claim to send as data, but I’m convinced it can be deanonimized, even more in the context that the same application has also a feature where the user login (opt-in) to a remote server to perform tasks.
On overall it would be nice to have a consistent policy telemetry system for Flathub packages in general.
OARS has an “Information Sharing” category which I’ve always interpreted as covering telemetry. In this case it sounds like the MuseScore upstream believes the appropriate level would be:
Moderate: Sharing diagnostic data not identifiable to the user, e.g. profiling data
Whereas you believe it would be:
Intense: Sharing information identifiable to the user, e.g. crash dumps
if the application was maintained by upstream developers, they would prefer to keep it enabled. That’s what I would also do to respect their decision to add telemetry in the first place.
I think there’s a subtle difference in app usage telemetry and app update telemetry, the latter should likely be disabled if possible as it conflicts with the flatpak update mechanism. But as @barthalion says, apps should reflect upstreams policies and choices and declare those up front using tools like OARS.