Addition of a unique anonymous installation ID with limited persistence

[gerald-hartig]

Is your feature request related to a problem? Please describe.

In order to gain a better understanding of our user base, NV Access is going to add an optional, random, anonymous, rotating installation identifier to NVDA. This information is a powerful development and fundraising tool, as it helps us to identify usage patterns, allocate resources more effectively and is instrumental to our fundraising efforts.

Describe the solution you'd like

If the user has opted-in to providing telemetry on update checks, the locally stored UUID is sent as part of the request. On the first of every month, all UUIDs are reset in order to maintain user anonymity and privacy.

Describe alternatives you've considered

• A UUID stored in a local file
• A UUID stored in the windows registry
• A persistent vs. monthly rotating identifier
• A persistent hardware serial hash that is tied to hardware components

Additional context

Changes will also be required in the NV Access analytics infrastructure to handle the additional information sent in the update check.

[XLTechie]

(If I didn't say it before, as I think I was ill around the time you came on: welcome Gerald!) I am wondering about the need for the rotating aspect of this. In the major operating systems (I am thinking iOS specifically, but others as well), the advertising IDs, which are similarly used for component tracking, can be reset by the user, or turned off completely. Obviously NVDA offers the option to turn it off completely, but why force it to rotate, if the user doesn't care about that level of data gathering by NV Access? Why not provide a "Reset identifier" button to do this whenever the user wants, and then provide an on, off, auto-rotate option along side? Separately, I wonder if rotating actually solves anything? If NVDA profiles my system under the old ID, that is added to the database, and then it re-profiles under the new ID with the identical information, can't an easy comparison determine both IDs represent the same user? It strikes me as an illusion of further anonymization.

[gerald-hartig]

Hi @XLTechie apologies for the long delay in responding. We've had many internal discussions on how to best balance the privacy of users with the needs to slightly improve our usage statistics gathering. Some users reacted to the persistent nature of the identifier, and so the solution arrived on through consultation with the community was having the ID automatically rotate. We don't want to build up a profile on people and to figure out exactly who has which installations of NVDA. It's in nobody's interest. That's part of the reason why we don't even keep IP information associated with update checks. By having the identifier automatically reset, we're trying to make it clear that we're not interested in building up a profile on people and every month everyone gets a clean identity again.