• M.Sc. Computer Science Student at University of Stuttgart
  • Assistant at the CERT of the University of Stuttgart
  • Admin of QuantenToast
  • 2 Posts
  • 2 Comments
Joined 1Y ago
cake
Cake day: Jun 25, 2023

help-circle
rss
Gumb is not GDPR compliant - Meeting Manager for Communities
# GDPR Compliance Check For those who haven't heard of it before, [Gumb](https://gumb.app) is > A platform for managing meetings, gatherings, and events for communities of any size. - gump.app/en I have investigated this app because it is used by a club where I am occasionally active. ## Landing Page / Homepage **Fonts**: The landing page is using google fonts, so those fonts are loaded (8 requests) from `fonts.gstatic.com` when opening the website. The first issue here is that google fonts are not listed in the [privacy policy](https://gumb.app/en/privacy-policy/) at all. Second, by a [German court ruling](https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/) google fonts are not compliant with the GDPR: > The use of external font services cannot be based on Art. 6 § 1 p.1 f GDPR, as the use of the fonts is also possible without having to establish a connection from visitors to external servers. - LG München Az. 3 O 17493/20 **Images**: Furthermore the website is loading images from `firebasestorage.googleapis.com` (105 requests). Following the argumentation of the previously mentioned court ruling, using firebase for images could also be considered non-compliant because images could easily be served without having to establish a connection from visitors to external servers. **Youtube Embed**: The website includes a youtube iframe (13 requests to `www.youtube.com`) with an introduction video. While youtube themself offer an iframe option called "Enable privacy-enhanced mode", the Gumb homepage embeds the »normal« iframe that places tracking cookies which again violates the GDPR. The iframe furthermore sends - 6 requests to `play.google.com/log`, - 4 requests to `https://googleads.g.doubleclick.net` - 1 request to `https://static.doubleclick.net` - 4 request to `https://jnn-pa.googleapis.com` **Tracking**: The website uses, as stated in their [privacy policy](https://gumb.app/en/privacy-policy/), *Google Analytics* (GA) which results in a request to `https://region1.analytics.google.com/g/collect...` and `https://www.googletagmanager.com`. However, writing "we use GA" in the privacy policy is not sufficient. GA requires consent from the website visitor. There are a few more unnecessary requests, but I think the point is clear. **All of that is happening without any consent from the visitor!** ## Mobile App Gumb offers mobile Apps for Android and iOS, of which I only checked the Android version. While I can't say for sure that the app violates the GDPR because it immediately asks for credentials, the [Exodus Privacy Report](https://reports.exodus-privacy.eu.org/en/reports/380549/) (of the latest version 1.0.84) still looks rather bad: - Amazon Analytics - Amazon Mobile Analytics - Google Analytics - Google CrashLytics - Google Firebase Analytics - Google Tag Manager ## Web App Next to mobile apps, Gumb offers a web app too. Well, what can I say - there are requests to - `https://fonts.googleapis.com` - `https://www.googletagmanager.com` - `https://region1.analytics.google.com/g/collect...` - `https://www.google.de/ads/...` - `https://stats.g.doubleclick.net/g/collect...` - `https://ipgeolocation.io/` even without being logged in or any given consent. ## Conclusion For a tool from Switzerland with paid subscription plans and the purpose of managing events/meetings etc. it uses a lot of google (tracking) services... Very sad to see as the app looks otherwise really modern and useful. Do today's developers know that applications like Gumb can be implemented without selling their users' soul to google?
fedilink

I get your point. Then, why not start your own instance with rules that you approve? I know, easier said than done, but that’s the nice thing about the Fediverse. Next to the general purpose instances, there are many “themed” ones with focus groups such as musicians, journalists and so on.


You lying to yourself or have unfounded expectations.

Nobody mentioned any expectations hm…

Everything on Mastodon is in plain text, there is no encryption, and servers get mirrored.

That’s 100% correct, and I think it’s important to explain that to non-techy users.

It’s only the login info that stays with the instance […]

Technically yes, but I’d cut the “only” because login info includes the users email. So in case of a raid or data breach, I’d like to know about it.

The entire point of why Mastodon was ever started was censor evertbody that has the wrong opinion. Twitter wouldn’t delete people because of what they believe, so Mastodon was developed to ban IP address so only approved speech could exist on the internet as far as they are concerned and can avoid ackniwledging the real world. A high number of people on there, especially the admins, live in cult

I don’t know what places on Mastodon you’ve visited, but that’s not the point of Mastodon or the Fediverse in general at all. But we don’t have to start a discussion about that since you seem to already have made up your mind about it.


cross-posted from: https://postit.quantentoast.de/post/18942 > I thought this might be of interest to other users as well as admins.
fedilink