From 10b2bae67084351a58b6699714cdb3d4255dbc9e Mon Sep 17 00:00:00 2001
From: Christopher Willis-Ford <7019101+cwillisf@users.noreply.github.com>
Date: Wed, 7 Oct 2020 18:17:54 -0700
Subject: [PATCH] update privacy policy to October 5, 2020 copy

---
 src/renderer/privacy.jsx | 243 +++++++++++++++++++++++++++++++++------
 1 file changed, 209 insertions(+), 34 deletions(-)

diff --git a/src/renderer/privacy.jsx b/src/renderer/privacy.jsx
index 4bfa309..ac7aaf0 100644
--- a/src/renderer/privacy.jsx
+++ b/src/renderer/privacy.jsx
@@ -5,55 +5,230 @@ import styles from './privacy.css';
 const PrivacyElement = () => (
     <div className={styles.privacyBox}>
         <h1>Privacy Policy</h1>
+        <i>The Scratch Privacy Policy was last updated: October 5, 2020</i>
         <p>
-            We understand how important privacy is to our community, especially children and their parents. We wrote
-            this privacy policy to explain what information we collect through the Scratch application (the
-            &ldquo;App&rdquo;), how we use it, and what we&apos;re doing to keep it safe. If you have any questions
-            regarding this privacy policy, you can <a
+            The Scratch Foundation (&ldquo;Scratch&rdquo;, &ldquo;we&rdquo; or &ldquo;us&rdquo;) understands how
+            important privacy is to our community. We wrote this Privacy Policy to explain what Personal Information
+            (&ldquo;Information&rdquo;) we collect through our offline editor (the &ldquo;<a
+                href="https://scratch.mit.edu/download"
+                target="_blank"
+                rel="noopener noreferrer"
+            >Scratch App</a>&rdquo;), how we use, process, and share it, and what we&apos;re doing to keep it safe. It
+            also tells you about your rights and choices with respect to your Personal Information, and how you can <a
                 href="https://scratch.mit.edu/contact-us/"
                 target="_blank"
                 rel="noopener noreferrer"
-            >contact us</a>.
+            >contact us</a> if you have any questions or concerns.
         </p>
-        <h2>What information does the App collect?</h2>
+        <h2>What Information Does Scratch Collect About Me?</h2>
         <p>
-            The Scratch Team is always looking to better understand how Scratch is used around the world. To help
-            support this effort, Scratch only collects anonymous usage information from the Scratch App. This
-            information does not include any Personal Information. For purposes of this Privacy Policy, &ldquo;Personal
-            Information&rdquo; means any information relating to an identified or identifiable individual.
+            For the purpose of this Privacy Policy, &ldquo;Information&rdquo; means any information relating to an
+            identified or identifiable individual. The Scratch App automatically collects and stores locally the
+            following Information through its telemetry system: the title of your project in text form, language
+            setting, time zone and events related to your use of the Scratch App (namely when the Scratch App was
+            opened and closed, if a project file has been loaded or saved, or if a new project is created). If you
+            choose to turn on the telemetry sharing feature, the Scratch App will transmit this information to Scratch.
+            Projects created in the Scratch App are not transmitted to or accessible by Scratch.
         </p>
-        <p>
-            The anonymous usage information we collect includes data about what parts of the app you use and basic
-            information about your network that allows us to roughly estimate what part of the world you are located
-            in. We also may collect general information about the device that you are using, such as make, model,
-            operating system and screen resolution. We do not collect device identifiers, such as advertising IDs, MAC
-            addresses, or IP addresses. We do not associate any of this information with an identified or identifiable
-            individual.
-        </p>
-        <h2>How does the Scratch Team use the information it collects?</h2>
+        <h2>How Does Scratch Use My Information?</h2>
+        <p>We use this Information for the following purposes:</p>
         <ul>
             <li>
-                We may use anonymous usage information in research studies intended to improve our understanding of how
-                people learn with Scratch. The results of this research are shared with educators and researchers
-                through conferences, journals, and other publications.
+                <b>Analytics and Improving the Scratch App</b> - We use the Information to analyze use of the Scratch
+                App and to enhance your learning experience on the Scratch App.
             </li>
             <li>
-                We analyze the information to understand and improve Scratch, such as determining which elements are
-                most used and how long users spend in the app.
+                <b>Academic and Scientific Research</b> - We de-identify and aggregate Information for statistical
+                analysis in the context of scientific and academic research. For example, to help us understand how
+                people learn through the Scratch App and how we can enhance learning tools for young people. The
+                results of such research are shared with educators and researchers through conferences, journals, and
+                other academic or scientific publications. You can find out more on our <a
+                    href="https://scratch.mit.edu/research"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                >Research page</a>.
             </li>
             <li>
-                We will never share anonymous usage data with any other person, company, or organization, except:
-                <ul>
-                    <li>
-                        As required to comply with our obligations under the law
-                    </li>
-                    <li>
-                        For technical reasons, if we are required to transfer the data on our servers to another
-                        location or organization
-                    </li>
-                </ul>
+                <b>Legal</b> - We may use your Information to enforce our <a
+                    href="https://scratch.mit.edu/terms_of_use"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                >Terms of Use</a>, to defend our legal rights, and to comply with our legal obligations and internal
+                policies. We may do this by analyzing your use of the Scratch App.
             </li>
         </ul>
+        <h2>What Are The Legal Grounds For Processing Your Information?</h2>
+        <p>
+            If you are located in the European Economic Area, the United Kingdom or Switzerland, we only process your
+            Information based on a valid legal ground. A &ldquo;legal ground&rdquo; is a reason that justifies our use
+            of your Information. In this case, we or a third party have a legitimate interest in using your Information
+            (if you choose to allow the Scratch App to send the Scratch team your Information) to create, analyze and
+            share your aggregated or de-identified Information for research purposes, to analyze and enhance your
+            learning experience on the Scratch App and otherwise ensure and improve the safety, security, and
+            performance of the Scratch App. We only rely on our or a third party’s legitimate interests to process your
+            Information when these interests are not overridden by your rights and interests.
+        </p>
+        <h2>How Does Scratch Share My Information?</h2>
+        <p>
+            We disclose information that we collect through the Scratch App to third parties in the following
+            circumstances:
+        </p>
+        <ul>
+            <li>
+                <b>Service Providers</b> - To third parties who provide services such as website hosting, data
+                analysis, Information technology and related infrastructure provisions, customer service, email
+                delivery, and other services.
+            </li>
+            <li>
+                <b>Academic and Scientific Research</b> - To research institutions, such as the Massachusetts Institute
+                of Technology (MIT), to learn about how our users learn through the Scratch App and develop new
+                learning tools. The results of this research or the statistical analysis may be shared through
+                conferences, journals, and other publications.
+            </li>
+            <li>
+                <b>Merger</b> - To a potential or actual acquirer, successor, or assignee as part of any
+                reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any
+                portion of our organization or assets. You will have the opportunity to opt out of any such transfer if
+                the new entity&apos;s planned processing of your Information differs materially from that set forth in
+                this Privacy Policy.
+            </li>
+            <li>
+                <b>Legal</b> - If required to do so by law or in the good faith belief that such action is appropriate:
+                (a) under applicable law, including laws outside your country of residence; (b) to comply with legal
+                process; (c) to respond to requests from public and government authorities, such as school, school
+                districts, and law enforcement, including public and government authorities outside your country of
+                residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of
+                our affiliates; (f) to protect our rights, privacy, safety, or property, and/or that of our affiliates,
+                you, or others; and (g) to allow us to pursue available remedies or limit the damages that we may
+                sustain.
+            </li>
+        </ul>
+        <h2>Children and Student Privacy</h2>
+        <p>
+            The Scratch Foundation is a 501(c)(3) nonprofit organization. As such, the Children&apos;s Online Privacy
+            Protection Act (COPPA) does not apply to Scratch. Nevertheless, Scratch takes children&apos;s privacy
+            seriously. Scratch collects only minimal information from its users, and only uses and discloses
+            information to provide the services and for limited other purposes, such as research, as described in this
+            Privacy Policy.
+        </p>
+        <p>
+            Scratch does not collect information from a student&apos;s education record, as defined by the Family
+            Educational Rights and Privacy Act (FERPA). Scratch does not disclose information of students to any third
+            parties except as described in this Privacy Policy.
+        </p>
+        <h2>Your Data Protection Rights (EEA)</h2>
+        <p>
+            If you are located in the European Economic Area, the United Kingdom or Switzerland, you have certain
+            rights in relation to your Information:
+        </p>
+        <ul>
+            <li>
+                <b>Access, Correction and Data Portability</b> - You may ask for an overview of the Information we
+                process about you and to receive a copy of your Information. You also have the right to request to
+                correct incomplete, inaccurate or outdated Information. To the extent required by applicable law, you
+                may request us to provide your Information to another company.
+            </li>
+            <li>
+                <b>Objection</b> – You may object to (this means &ldquo;ask us to stop&rdquo;) any use of your
+                Information that is not (i) processed to comply with a legal obligation, (ii) necessary to do what is
+                provided in a contract between Scratch and you, or (iii) if we have a compelling reason to do so (such
+                as, to ensure safety and security in our online community). If you do object, we will work with you to
+                find a reasonable solution.
+            </li>
+            <li>
+                <b>Deletion</b> - You may also request the deletion of your Information, as permitted under applicable
+                law. This applies, for instance, where your Information is outdated or the processing is not necessary
+                or is unlawful; where you withdraw your consent to our processing based on such consent; or where you
+                have objected to our processing. In some situations, we may need to retain your Information due to
+                legal obligations or for litigation purposes. If you want to have all of your Information removed from
+                our servers, please contact <a
+                    href="mailto:help@scratch.mit.edu"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                >help@scratch.mit.edu</a> for assistance.
+            </li>
+            <li>
+                <b>Restriction Of Processing</b> - You may request that we restrict processing of your Information
+                while we are processing a request relating to (i) the accuracy of your Information, (ii) the lawfulness
+                of the processing of your Information, or (iii) our legitimate interests to process this Information.
+                You may also request that we restrict processing of your Information if you wish to use the Information
+                for litigation purposes.
+            </li>
+            <li>
+                <b>Withdrawal Of Consent</b> – Where we rely on consent for the processing of your Information, you
+                have the right to withdraw it at any time and free of charge. When you do so, this will not affect the
+                lawfulness of the processing before your consent withdrawal.
+            </li>
+        </ul>
+        <p>
+            In addition to the above-mentioned rights, you also have the right to lodge a complaint with a competent
+            supervisory authority subject to applicable law. However, there are exceptions and limitations to each of
+            these rights. We may, for example, refuse to act on a request if the request is manifestly unfounded or
+            excessive, or if the request is likely to adversely affect the rights and freedoms of others, prejudice the
+            execution or enforcement of the law, interfere with pending or future litigation, or infringe applicable
+            law. To submit a request to exercise your rights, please contact <a
+                href="mailto:help@scratch.mit.edu"
+                target="_blank"
+                rel="noopener noreferrer"
+            >help@scratch.mit.edu</a> for assistance.
+        </p>
+        <h2>Data Retention</h2>
+        <p>
+            We take measures to delete your Information or keep it in a form that does not allow you to be identified
+            when this Information is no longer necessary for the purposes for which we process it, unless we are
+            required by law to keep this Information for a longer period. When determining the retention period, we
+            take into account various criteria, such as the type of services requested by or provided to you, the
+            nature and length of our relationship with you, possible re-enrollment with our services, the impact on the
+            services we provide to you if we delete some Information from or about you, mandatory retention periods
+            provided by law and the statute of limitations.
+        </p>
+        <h2>How Does Scratch Protect My Information?</h2>
+        <p>
+            Scratch has in place administrative, physical, and technical procedures that are intended to protect the
+            Information we collect on the Scratch App against accidental or unlawful destruction, accidental loss,
+            unauthorized alteration, unauthorized disclosure or access, misuse, and any other unlawful form of
+            processing of the Information. However, as effective as these measures are, no security system is
+            impenetrable. We cannot completely guarantee the security of our databases, nor can we guarantee that the
+            Information you supply will not be intercepted while being transmitted to us over the Internet.
+        </p>
+        <h2>International Data Transfer</h2>
+        <p>
+            We may transfer your Information to countries other than the country where you are located, including to
+            the U.S. (where our Scratch servers are located) or any other country in which we or our service providers
+            maintain facilities. If you are located in the European Economic Area, the United Kingdom or Switzerland,
+            or other regions with laws governing data collection and use that may differ from U.S. law, please note
+            that we may transfer your Information to a country and jurisdiction that does not have the same data
+            protection laws as your jurisdiction. We apply appropriate safeguards to the Information processed and
+            transferred on our behalf. Please contact us for more information on the safeguards used.
+        </p>
+        <h2>Notifications Of Changes To The Privacy Policy</h2>
+        <p>
+            We review our Privacy Policy on a periodic basis, and we may modify our policies as appropriate. We will
+            notify you of any material changes. We encourage you to review our Privacy Policy on a regular basis. The
+            &ldquo;Last Updated&rdquo; date at the top of this page indicates when this Privacy Policy was last
+            revised. Your continued use of the Scratch App following these changes means that you accept the revised
+            Privacy Policy.
+        </p>
+        <h2>Contact Us</h2>
+        <p>
+            The Scratch Foundation is the entity responsible for the processing of your Information. If you have any
+            questions about this Privacy Policy, or if you would like to exercise your rights to your Information, you
+            may contact us at <a
+                href="mailto:help@scratch.mit.edu"
+                target="_blank"
+                rel="noopener noreferrer"
+            >help@scratch.mit.edu</a> or via mail at:
+        </p>
+        <div className="vcard">
+            <div className="org">Scratch Foundation</div>
+            <div className="fn">ATTN: Privacy Policy</div>
+            <div className="adr">
+                <div className="street-address">201 South Street</div>
+                <span className="locality">Boston</span>, <span className="region">MA</span> <span
+                    className="postal-code"
+                >02111</span>
+            </div>
+        </div>
     </div>
 );