Enshrine existing always-email-updates policy into Privacy Statement

[ossguy]

1. What's the name of the policy?

https://github.com/github/site-policy/blob/master/Policies/github-privacy-statement.md

2. Is this issue related to a specific section within one of our policies (e.g. the Terms of Service)? If so, please include a link to the section or subsection.

https://github.com/github/site-policy/blob/master/Policies/github-privacy-statement.md#changes-to-our-privacy-statement

5. Why do you think this section or language needs improvement?

This section implies that the user may have to manually check the GitHub website at least as often as every 30 days in order to know whether the Privacy Statement has changed. Since historically GitHub always updates users by email (in addition to updating the website), make it easier for users to comply by simply stating what already happens in practice.

In particular, "posting a notice on our home page or sending email" should be changed to "posting a notice on our home page and sending email" - the only modification here is "or" -> "and".

With the above change, users will not have to check the GitHub website frequently to see if a change has been made - instead they can rely on receipt of an email to determine whether that has occurred.

[wking]

On Fri, Jul 28, 2017 at 05:46:52PM +0000, Denver Gingerich wrote: In particular, "posting a notice on our home page or sending email" should be changed to "posting a notice on our home page and sending email" - the only modification here is "or" -> "and".

There's similar language a few sections earlier [1]: … and we will notify you on our website or by email before any transfer of your User Personal Information. In both cases, one interpretation is yours, where GitHub may unilaterally decide which channel to use. Another interpretation for conditional email (which I think it more likely) is that the user may have opted out of receiving these types of emails (although I can't find setting for toggling emails for those reasons). I think we can clarify both cases using a pattern like: … on our website and{, if you've enabled {whatever setting},} by email… Where {whatever setting} is a link to the appropriate setting widget, and we skip the whole conditional if there is no way to opt-out of that email. This wording also doesn't distinguish between “on our home page” and “on our website” (e.g. possibly via [2]). For things like policy changes, I think users hitting most github.com pages should be notified of the change without having to hit https://github.com/ itself. [1]: https://github.com/github/site-policy/blob/75c016d80fe819c192f5c953eb3829bee63462a2/Policies/github-privacy-statement.md#how-we-share-the-information-we-collect [2]: https://github.com/notifications

[nsqe]

Since historically GitHub always updates users by email (in addition to updating the website), make it easier for users to comply by simply stating what already happens in practice.

To be fair, GitHub has never updated users by email until about three weeks ago — this is the first time we've ever tried mailing our users about a Terms of Service change, and it was because we were announcing this new site policy repository.

Now that we have established this repository as our primary means of communicating policy changes to our users, we will probably update our Privacy Statement and Terms of Service to refer people to it.

That said, please understand that what this policy means:

We will provide notification to Users of material changes to this Privacy Statement through our Website at least 30 days prior to the change taking effect by posting a notice on our home page or sending email to the email address specified in your GitHub primary account. For changes to this Privacy Statement that do not affect your rights, we encourage visitors to check this page frequently.

...is that we will actually notify you of changes that affect you. You don't have to keep checking the web page and looking at the Terms of Service or Privacy Statement; we'll let you know if something that affects your rights has changed. If something changes that doesn't affect your rights, like us fixing a typo or changing an address, we won't send a notification about that. Because that would get annoying pretty fast.