DRAFT waiting for feedback from Privacy

Privacy is a core element of trust within Apache projects.
This guide explains how podlings should handle personal information, follow ASF policies, and align with privacy expectations such as the GDPR, while staying true to ASF values of transparency, respect, and openness.

1. Purpose and Scope

This guide applies to everyone involved in Apache Incubator projects:

• Podling communities and PPMC members managing mailing lists, websites, and repositories.
• Conversations on the podling’s private PPMC list (private@<podling>.apache.org) where sensitive topics may be discussed.
• Contributors and committers interacting with ASF systems and third-party tools.

It covers how to protect privacy in communications, data handling, and project governance.

1.1 Key Definitions

• Personal data: Any information that can identify an individual, such as a name, email address, IP address, commit metadata, or message content.
• Processing: Any action performed on personal data, including collecting, storing, sharing, or publishing it.
• Third-party service: Any system not operated or directly controlled by the ASF (for example, Google Forms, Discord, or commercial analytics).
• ASF systems: Services hosted or operated under the apache.org domain or managed by the ASF.
• ICLA (Individual Contributor License Agreement): A legal agreement submitted only to the ASF Secretary that covers licensing of an individual’s contributions to the ASF. It contains personal data and must not be sent to project mailing lists.
• GDPR (General Data Protection Regulation): European Union regulation governing personal data protection. The ASF aligns to GDPR principles (e.g., data minimization, purpose limitation) across its services.
• DPA (Data Processing Agreement): A contract required by privacy laws when a processor handles personal data on behalf of a controller. The ASF may sign DPAs for Foundation-wide services; podlings must not sign their own.
• PPMC (Podling Project Management Committee): The governance body overseeing a podling; sensitive discussions occur on the podling’s private PPMC list.
• Matomo: The ASF-hosted, privacy-respecting analytics platform — the only analytics tool approved for ASF and podling websites.
• Consent-based embed: An integration (e.g., YouTube) implemented so no connection is made to the third-party until the user explicitly consents.

2. Why Privacy Matters

Apache projects operate in public, but contributors still deserve privacy and respect. Maintaining appropriate safeguards:

• Builds trust among contributors and users.
• Reduces legal and reputational risk.
• Upholds ASF values of respectful collaboration and community over code.

Balancing transparency with privacy means sharing enough information for open governance while avoiding unnecessary disclosure of personal data.

3. ASF Privacy Policy

The ASF Privacy Policy governs how the ASF handles personal information. Podlings automatically inherit this policy.

Key points:

• Minimal data collection - only what’s required for ASF operations.
• Legitimate interest - ASF processes contributor data to support open collaboration.
• Security and retention - information is safeguarded and kept only as long as needed.
• Third-party processors - limited, under privacy agreements (e.g., GitHub, mailing lists).
• Access and correction - requests can be submitted via privacy@apache.org.
• Contact - questions can be sent to privacy@apache.org or the ASF Secretary.

4. Personal Information in Public Archives

ASF participation is inherently public, and contributors consent to this by using ASF systems.

• Mailing lists: all public lists are archived and searchable indefinitely.
• Issue trackers and pull requests: comments and contributor IDs are visible.
• Commits and source repositories: every commit includes the author’s name, email address, and timestamp.
  These are permanently stored in public version-control history and mirrored globally.
  Contributors should ensure their commit metadata reflects the identity they wish to make public.
• Websites and documentation: contributor names may appear in change logs or acknowledgements.

Avoid posting private contact details or other sensitive information. Discuss confidential matters only on the private@podling.apache.org list.

Important: Individual Contributor License Agreements (ICLAs) contain personal data and must never be sent to project or podling mailing lists.
They should only be submitted directly to the ASF Secretary as described at https://www.apache.org/licenses/icla.pdf.

ASF does not remove historical archives except in exceptional cases handled by the Privacy Team.

5. Mailing Lists and Moderation

Mailing lists are the foundation of ASF collaboration. Never forward or quote messages from a podling’s private@ list to public lists without consent.

Messages on private@ lists are accessible to PPMC members, mentors, and all ASF Members and are subject to ASF privacy and retention rules.

6. GDPR and International Privacy Obligations

The General Data Protection Regulation (GDPR) and similar laws protect personal data. Although the ASF is a U.S. non-profit, it follows GDPR principles:

• Data minimization: collect only what’s necessary.
• Purpose limitation: use data only for ASF purposes.
• Transparency: clearly explain what’s collected and why.
• User rights: ASF honors reasonable access or deletion requests where feasible.
• No profiling: ASF does not track or market to contributors.

Podlings must not collect or process personal data outside ASF infrastructure. If unsure, contact privacy@apache.org before using any external service.

Podlings that temporarily collect voluntary data (such as survey results or event registrations) must delete it once no longer needed and never reuse it for unrelated purposes.

7. Podling Websites and External Services

Podling websites must respect ASF infrastructure and privacy standards:

• Hosted under ASF control (for example, incubator.apache.org/<podling>).
• Include a footer link to the ASF Privacy Policy.
• Collect only limited, voluntary data (e.g., event registration) with a clear purpose and retention.
• Do not embed tracking pixels, advertising, or externally hosted forms.
• Do not embed or link to third-party chat platforms (Slack, Discord, etc.).
  All official communication and decisions must occur on ASF mailing lists.
• Social and community channels must follow ASF privacy principles and be PPMC governed.
• For any analytics or integrations, contact privacy@apache.org for approval.

7.1 Allowed and Prohibited Tools

✅ Allowed

• ASF-hosted services (websites, mailing lists, GitHub under apache/).
• ASF-hosted Matomo analytics (see §7.2).
• Locally served frameworks or libraries (Bootstrap, jQuery, Font Awesome).
• ASF-approved CI/CD and release systems (Jenkins, GitHub Actions, Maven Central).
• Static search using lunr.js, served locally without external requests.
• YouTube embeds that ask for user consent before connecting:
  • https://privacy.apache.org/examples/youtube-html/with-youtube-api.html
  • https://privacy.apache.org/examples/youtube-html/with-youtube-embeds.html

⚠️ Allowed with Review

• Temporary, opt-in forms or surveys whose results go to ASF email or storage.
• Event tools that minimize data collection and clearly state purpose.

🚫 Not Allowed

• ❌ Google Analytics, Tag Manager, Mixpanel, or any external tracking scripts.
• ❌ Advertising or affiliate trackers.
• ❌ Third-party form hosts (Google Forms, Typeform, SurveyMonkey).
• ❌ External newsletter systems (Mailchimp, Substack).
• ❌ Embedded social-media widgets (Facebook, X/Twitter, LinkedIn, Disqus).
• ❌ External CDNs (Google Fonts, Cloudflare, jsDelivr, Bootstrap CDN).
• ❌ Chat embeds or links (Slack, Discord, Zulip, etc.).

Rule of thumb: if it sets cookies, contacts an external server, or tracks users then it’s not allowed on ASF infrastructure.

7.2 Website Privacy and Analytics

Podling websites must be static, privacy-respecting, and under the control of the PPMC.

• ASF-hosted Matomo is the only approved analytics platform.
  • Request activation via privacy@apache.org.
  • Matomo is ASF-operated, cookie-free, and compliant with ASF privacy standards.
• Cookie banners are unnecessary as ASF sites should not set cookies.

⚠️ Reminder: Google Analytics, Tag Manager, and all third-party analytics are strictly prohibited. ASF-hosted Matomo is the only approved solution.

Requesting Matomo Access

1. Email privacy@apache.org with your podling site URL and reporting contact.
2. The privacy team will coordinate setup.
3. You’ll receive a tracking snippet to include in your site footer.

7.3 Data Processing Agreements (DPAs)

ASF may sign Data Processing Agreements (DPAs) with trusted providers when required by law (for example, Algolia for internal search).

Podlings:

• Must not sign or negotiate their own DPAs.
• May only use services covered by ASF’s existing agreements.
• Should contact privacy@apache.org before using any third-party service that processes user data.

This ensures consistent privacy terms and legal protection across all ASF projects.

8. ASF Values and Privacy Culture

ASF privacy expectations reflect the same cultural principles that guide governance:

• Transparency - communicate openly while respecting personal boundaries.
• Meritocracy - evaluate work, not identity.
• Respect - treat contributor data responsibly and avoid unnecessary exposure.
• Community over code - privacy supports trust, which sustains collaboration.

9. Contacts

For questions or concerns about privacy or data handling, contact: privacy@apache.org