Versions Compared

Old Version 3

changes.mady.by.user Unknown User (jmclean)

Saved on

compared with

New Version Current

changes.mady.by.user Unknown User (jmclean)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: no longer draft

Purpose

This page provides Incubator-specific guidance on how podlings should understand and apply the ASF’s Privacy Policy in practice. It does not define or restate ASF policy, the authoritative source is the ASF Privacy website and Committers’ FAQ.

Many podlings and mentors are new to ASF processes. This guide helps orient them to common privacy considerations during incubation, such as project websites, analytics, mailing lists, and community tools, and directs them to the appropriate ASF contacts and resources.

...

ASF Privacy Policy Overview

The ASF maintains a central Privacy Policy that covers all Foundation systems and websites. Projects must not publish their own privacy statements or attempt to restate policy in their documentation. Podling websites should include a link to the Apache Software Foundation Privacy Policy. This ensures users always see the current, authoritative version maintained by the ASF Privacy team.

...

Applying ASF Privacy in Practice

1. Setting up project websites

  • Do not include independent privacy or cookie policies.
  • Include a footer link to the official ASF Privacy Policy.
  • Avoid embedding third-party scripts unless reviewed with Infra or the Privacy team.
  • If using JavaScript frameworks or external content (for example, a YouTube embed or a CDN-hosted library), ensure that no personal data is collected or transmitted without user consent.
  • When in doubt, check the Privacy Committers’ FAQ or contact privacy@apache.org.

2. Analytics and tracking

  • ASF provides a Foundation-managed analytics platform (currently Matomo) for apache.org sites.
  • Projects wishing to enable analytics should email privacy@apache.org for setup or to confirm suitability.
  • Do not use Google Analytics or similar third-party tools without written approval from the Privacy team.
  • Never embed tracking pixels, advertising tags, or external monitoring tools without prior review.

3. Mailing lists and public archives

  • Mailing lists are public by default; messages become part of the public record.
  • Avoid sending personal information to mailing lists (e.g., private emails, phone numbers, or internal company data).
  • If you receive a request to remove content for privacy reasons, direct it to privacy@apache.org.

4. Data collection and consent

  • Avoid collecting personal data (such as names, emails, and survey responses) unless it is clearly necessary and complies with ASF privacy guidelines.
  • Use ASF-approved services (e.g., Apache-hosted forms, mailing lists) rather than third-party tools whenever possible.
  • When you need data collection, please clearly describe how the data will be used and for how long it will be retained.
  • Always check with privacy@apache.org if uncertain whether consent is required.

5. Contributor license agreements (ICLAs)

  • Podlings must not collect or handle ICLAs themselves.
  • All ICLAs are submitted directly by contributors to the ASF Secretary, following the process at https://www.apache.org/licenses/icla.pdf.
  • ICLAs contain personal information (e.g., name, email, signature) and are treated as confidential legal records under ASF policy.
  • Never forward or store ICLA forms within project repositories, mailing lists, or private archives.

6. Third-party services

  • Review the Committers’ FAQ before connecting any third-party platform.
  • Common examples:
    • GitHub: Allowed; ASF has a legal data-sharing agreement in place.
    • Slack, Discord, etc.: May be linked to, but not used as an official ASF communication channel.
    • Survey tools: Use ASF-hosted or approved services only, with explicit notice of data collection.

...

Working With ASF Privacy and Infra

...

Summary

ASF privacy policies are centrally maintained and apply to all Apache projects. Podlings are responsible for following those policies in how they operate, communicate, and build their communities. This page is designed to help podlings apply ASF policy, not define it, and to ensure every incubating project meets the Foundation’s privacy and data-handling standards while learning how to operate as an Apache project.

DRAFT waiting for feedback from Privacy

Privacy is a core element of trust within Apache projects.
This guide explains how podlings should handle personal information, follow ASF policies, and align with privacy expectations such as the GDPR, while staying true to ASF values of transparency, respect, and openness.

1. Purpose and Scope

This guide applies to everyone involved in Apache Incubator projects:

  • Podling communities and PPMC members managing mailing lists, websites, and repositories.
  • Conversations on the podling’s private PPMC list (private@<podling>.apache.org) where sensitive topics may be discussed.
  • Contributors and committers interacting with ASF systems and third-party tools.

It covers how to protect privacy in communications, data handling, and project governance.

1.1 Key Definitions

  • Personal data: Any information that can identify an individual, such as a name, email address, IP address, commit metadata, or message content.
  • Processing: Any action performed on personal data, including collecting, storing, sharing, or publishing it.
  • Third-party service: Any system not operated or directly controlled by the ASF (for example, Google Forms, Discord, or commercial analytics).
  • ASF systems: Services hosted or operated under the apache.org domain or managed by the ASF.
  • ICLA (Individual Contributor License Agreement): A legal agreement submitted only to the ASF Secretary that covers licensing of an individual’s contributions to the ASF. It contains personal data and must not be sent to project mailing lists.
  • GDPR (General Data Protection Regulation): European Union regulation governing personal data protection. The ASF aligns to GDPR principles (e.g., data minimization, purpose limitation) across its services.
  • DPA (Data Processing Agreement): A contract required by privacy laws when a processor handles personal data on behalf of a controller. The ASF may sign DPAs for Foundation-wide services; podlings must not sign their own.
  • PPMC (Podling Project Management Committee): The governance body overseeing a podling; sensitive discussions occur on the podling’s private PPMC list.
  • Matomo: The ASF-hosted, privacy-respecting analytics platform — the only analytics tool approved for ASF and podling websites.
  • Consent-based embed: An integration (e.g., YouTube) implemented so no connection is made to the third-party until the user explicitly consents.

2. Why Privacy Matters

Apache projects operate in public, but contributors still deserve privacy and respect. Maintaining appropriate safeguards:

  • Builds trust among contributors and users.
  • Reduces legal and reputational risk.
  • Upholds ASF values of respectful collaboration and community over code.

Balancing transparency with privacy means sharing enough information for open governance while avoiding unnecessary disclosure of personal data.

3. ASF Privacy Policy

The ASF Privacy Policy governs how the ASF handles personal information. Podlings automatically inherit this policy.

Key points:

  • Minimal data collection - only what’s required for ASF operations.
  • Legitimate interest - ASF processes contributor data to support open collaboration.
  • Security and retention - information is safeguarded and kept only as long as needed.
  • Third-party processors - limited, under privacy agreements (e.g., GitHub, mailing lists).
  • Access and correction - requests can be submitted via privacy@apache.org.
  • Contact - questions can be sent to privacy@apache.org or the ASF Secretary.

4. Personal Information in Public Archives

ASF participation is inherently public, and contributors consent to this by using ASF systems.

  • Mailing lists: all public lists are archived and searchable indefinitely.
  • Issue trackers and pull requests: comments and contributor IDs are visible.
  • Commits and source repositories: every commit includes the author’s name, email address, and timestamp.
    These are permanently stored in public version-control history and mirrored globally.
    Contributors should ensure their commit metadata reflects the identity they wish to make public.
  • Websites and documentation: contributor names may appear in change logs or acknowledgements.

Avoid posting private contact details or other sensitive information. Discuss confidential matters only on the private@podling.apache.org list.

Important: Individual Contributor License Agreements (ICLAs) contain personal data and must never be sent to project or podling mailing lists.
They should only be submitted directly to the ASF Secretary as described at https://www.apache.org/licenses/icla.pdf.

ASF does not remove historical archives except in exceptional cases handled by the Privacy Team.

5. Mailing Lists and Moderation

Mailing lists are the foundation of ASF collaboration. Never forward or quote messages from a podling’s private@ list to public lists without consent.

Messages on private@ lists are accessible to PPMC members, mentors, and all ASF Members and are subject to ASF privacy and retention rules.

6. GDPR and International Privacy Obligations

The General Data Protection Regulation (GDPR) and similar laws protect personal data. Although the ASF is a U.S. non-profit, it follows GDPR principles:

  • Data minimization: collect only what’s necessary.
  • Purpose limitation: use data only for ASF purposes.
  • Transparency: clearly explain what’s collected and why.
  • User rights: ASF honors reasonable access or deletion requests where feasible.
  • No profiling: ASF does not track or market to contributors.

Podlings must not collect or process personal data outside ASF infrastructure. If unsure, contact privacy@apache.org before using any external service.

Podlings that temporarily collect voluntary data (such as survey results or event registrations) must delete it once no longer needed and never reuse it for unrelated purposes.

7. Podling Websites and External Services

Podling websites must respect ASF infrastructure and privacy standards:

  • Hosted under ASF control (for example, incubator.apache.org/<podling>).
  • Include a footer link to the ASF Privacy Policy.
  • Collect only limited, voluntary data (e.g., event registration) with a clear purpose and retention.
  • Do not embed tracking pixels, advertising, or externally hosted forms.
  • Do not embed or link to third-party chat platforms (Slack, Discord, etc.).
    All official communication and decisions must occur on ASF mailing lists.
  • Social and community channels must follow ASF privacy principles and be PPMC governed.
  • For any analytics or integrations, contact privacy@apache.org for approval.

7.1 Allowed and Prohibited Tools

✅ Allowed

  • ASF-hosted services (websites, mailing lists, GitHub under apache/).
  • ASF-hosted Matomo analytics (see §7.2).
  • Locally served frameworks or libraries (Bootstrap, jQuery, Font Awesome).
  • ASF-approved CI/CD and release systems (Jenkins, GitHub Actions, Maven Central).
  • Static search using lunr.js, served locally without external requests.
  • YouTube embeds that ask for user consent before connecting:
    • https://privacy.apache.org/examples/youtube-html/with-youtube-api.html
    • https://privacy.apache.org/examples/youtube-html/with-youtube-embeds.html

⚠️ Allowed with Review

  • Temporary, opt-in forms or surveys whose results go to ASF email or storage.
  • Event tools that minimize data collection and clearly state purpose.

🚫 Not Allowed

  • ❌ Google Analytics, Tag Manager, Mixpanel, or any external tracking scripts.
  • ❌ Advertising or affiliate trackers.
  • ❌ Third-party form hosts (Google Forms, Typeform, SurveyMonkey).
  • ❌ External newsletter systems (Mailchimp, Substack).
  • ❌ Embedded social-media widgets (Facebook, X/Twitter, LinkedIn, Disqus).
  • ❌ External CDNs (Google Fonts, Cloudflare, jsDelivr, Bootstrap CDN).
  • ❌ Chat embeds or links (Slack, Discord, Zulip, etc.).

Rule of thumb: if it sets cookies, contacts an external server, or tracks users then it’s not allowed on ASF infrastructure.

7.2 Website Privacy and Analytics

Podling websites must be static, privacy-respecting, and under the control of the PPMC.

  • ASF-hosted Matomo is the only approved analytics platform.
    • Request activation via privacy@apache.org.
    • Matomo is ASF-operated, cookie-free, and compliant with ASF privacy standards.
  • Cookie banners are unnecessary as ASF sites should not set cookies.

⚠️ Reminder: Google Analytics, Tag Manager, and all third-party analytics are strictly prohibited. ASF-hosted Matomo is the only approved solution.

Requesting Matomo Access

  1. Email privacy@apache.org with your podling site URL and reporting contact.
  2. The privacy team will coordinate setup.
  3. You’ll receive a tracking snippet to include in your site footer.

7.3 Data Processing Agreements (DPAs)

ASF may sign Data Processing Agreements (DPAs) with trusted providers when required by law (for example, Algolia for internal search).

Podlings:

  • Must not sign or negotiate their own DPAs.
  • May only use services covered by ASF’s existing agreements.
  • Should contact privacy@apache.org before using any third-party service that processes user data.

This ensures consistent privacy terms and legal protection across all ASF projects.

8. ASF Values and Privacy Culture

ASF privacy expectations reflect the same cultural principles that guide governance:

  • Transparency - communicate openly while respecting personal boundaries.
  • Meritocracy - evaluate work, not identity.
  • Respect - treat contributor data responsibly and avoid unnecessary exposure.
  • Community over code - privacy supports trust, which sustains collaboration.

9. Contacts

For questions or concerns about privacy or data handling, contact: privacy@apache.org