software privacy legal-terms
Can RescueTime sell derived data?
<p>Me and my friend were discussing privacy concerns regarding the use of a activity tracking application - Rescuetime. </p>

<p>It's <a href="https://www.rescuetime.com/privacy" rel="nofollow noreferrer">privacy policy</a> says,</p>

<blockquote>
  <p>We will never sell, rent, or otherwise share your personal
  information, with or without personally identifying information.
  Furthermore, we will never share anonymized <strong>selections</strong> of your
  individual data.</p>
</blockquote>

<p>My friend told me that,</p>

<p>"This does not mention anything about data derived from your personal information. That's the problem with legalese — unless explicitly ruling out stuff, it's fair game."</p>

<p>So I was wondering if that was true, can rescuetime legally sell statistics, interpretations, aggregates, derived data etc? Does their policy only claim to never sell the data stored in whole or any subsets of it?</p>

<p>Also this policy states,</p>

<blockquote>
  <p>We may share information about user behavior in the aggregate only.
  For example, we could share information like, "which day of the week
  do people spend the most time in front of their computer?" This type
  of analysis is used to enrich the product, and to represent our domain
  expertise to our audiences.</p>
</blockquote>

<p>Does this mean they can only share it internally? Does it make sense for it be between teams? For enriching their application? Can this sharing include to other companies? Can they sell it? I was thinking they mean they will only use it for improving their product and to market the product, to get investors etc. But they are not limited only to that right? Here audiences is not defined, who could it be?</p>

<p>How enforceable is this privacy policy? The fear of being exposed and losing customer trust is one incentive to adhere to this policy, but can we sue the company for damages? Is this just a list of things it will try to do.</p>

<h2>Yes</h2>

<p>They only guarantee to not sell “personal data” which is data that can be traced back to a specific individual. Aggregated data is not personal data unless the data set is so small that it can identify an individual.</p>
