From 71af5978ad390f3214dfc04ca5bf8b26a7cc51eb Mon Sep 17 00:00:00 2001 From: Andrew Sliwinski Date: Mon, 21 May 2018 15:55:21 -0400 Subject: [PATCH 01/12] Update privacy policy --- src/views/privacypolicy/privacypolicy.jsx | 561 ++++++++++++++++------ 1 file changed, 406 insertions(+), 155 deletions(-) diff --git a/src/views/privacypolicy/privacypolicy.jsx b/src/views/privacypolicy/privacypolicy.jsx index ea988dda7..0db9ca512 100644 --- a/src/views/privacypolicy/privacypolicy.jsx +++ b/src/views/privacypolicy/privacypolicy.jsx @@ -9,213 +9,464 @@ const Privacypolicy = () => (
+

+ + The Scratch Privacy Policy was last updated: May 23, 2018 + +

- We made Scratch so people like you could create projects, - share ideas, and build a community. To make this happen, - we collect some information for our users. The Scratch Team - understands how important privacy is to our community, - especially kids and parents. We wrote this privacy policy - to explain what information we collect, how we use it, - and what we're doing to keep it safe. If you have any - questions regarding this privacy policy, you can{' '} - contact us. + Scratch understands how important privacy is to our + community, especially kids and parents. We wrote this + Privacy Policy to explain what information we collect + through our website (scratch.mit.edu) (the “Site”), how we + use, process, and share it, and what we're doing to keep it + safe. It also tells you about your rights and choices with + respect to your information, and how you can{' '} + contact us if you have any + questions or concerns.

- Please do not share personal contact information, such as - your name, physical address, email address, phone number, - or anything else that can be used to make contact outside - of the Scratch website. Please report projects, comments, - or forum posts that contain this kind of information so - the Scratch team can remove it, and please remind the - author of our policy. + If you would like to build projects with Scratch without + submitting any Personal Information to us, you can download + the Scratch Offline Editor. Projects + created in the Scratch Offline Editor + {' '}are not accessible by the Scratch Team, and using the + offline editor does not disclose any personally identifying + information to Scratch unless you upload these projects to + the Scratch online community.

-

What information does the Scratch Team collect about me?

-
Account Information:
+

What personal information does the Scratch Team collect about me?

+

+ For the purpose of this Privacy Policy, “Personal + Information” means any information relating to an + identified or identifiable individual. We obtain + Personal Information relating to you from various + sources described below. +

+

+ Where applicable, we indicate whether and why you must + provide us with your Personal Information, as well as + the consequences of failing to do so. If you do not + provide Personal Information when requested, you may not + be able to benefit from our Site if that information is + necessary to provide you with the service or if we are + legally required to collect the information. +

+
Account Information
- In order to build projects or comment on other users' projects, - you need to make an account. During account creation, we ask you - for a username, your country, birth month and year, gender, and - your email address (or your parent or guardian's email address if - you are under 13 years old). We ask that you select a user name - that does not disclose your real name or other information that - could identify you. Other users can see your username and country, - but not your age, gender, or email address. + In order to share projects, create studios, or post + comments, you need to make an account. During account + creation, we ask you for a username, your country, birth + month and year, gender, and your email address (or your + parent or guardian's email address if you are under 16 + years old). We ask that you select a username that does + not disclose your real name or other information that + could identify you. Other users can see your username + and country, but not your age, gender, or email address.
-
User-generated Content:
+
User-generated Content
- All of your Scratch projects, comments, and forum posts are stored - on the Scratch servers. Other users can see your shared projects, - comments, and forum posts, along with your username. Because the - Scratch Team is responsible for moderation, we have access to all - content stored on the Scratch website, including unshared projects. - If you prefer to work on projects in complete privacy, you can use - either the Scratch 2{' '} - or Scratch 1.4 offline editor. + We collect any information that you provide to us when + you create Scratch projects (including unshared + projects), write comments, or post on our forums.
-
Usage Information:
+
Communications
- When you use Scratch, our servers will automatically store a limited - amount of information about how you use the website. This information - includes a number that identifies your computer (the IP address), which - pages you visited, and what browser you are using. + If you contact us directly, we may receive additional + information about you. For example, when you contact our + Customer Support Team, we may receive your name, email + address, phone number, the contents of a message or + attachments that you may send to us, and other + information you choose to provide.
-
Google Analytics:
+
+ Personal Information We Collect Automatically From Your + Use of the Site +
- We also collect some data on where you click and which parts of the - site you visit using Google Analytics. This "click data" helps us figure - out ways to improve the website. Information collected and processed by - Google Analytics includes the user's IP address, network location, and - geographic location. Google Analytics acquires all its information - directly from the user, by installing a cookie (see below) on your - computer, if you have enabled JavaScript. Scratch does not share any - information it collects with Google, and Google does not collect any - personal identifying information about you. + When you use Scratch, we and our third-party service + providers collect information about you and your device + through automated means, such as cookies and web server + logs. By using Scratch, you consent to the placement of + cookies and similar technologies in your browser in + accordance with this Privacy Policy. The information + collected in this manner includes your IP address, + network location, what browser you are using, device IDs + and characteristics, operating system version, language + preferences, referring URLs, and information about the + usage of our site.
-
Cookies:
- When you log in, the Scratch website asks your browser to put an http - "cookie" on your computer. The cookie is actually a small text file - that our site can send to your browser for storage on your computer. - This allows the website to remember that you are logged in when you - go to a different page. + We use this information, for example, to ensure that the + site functions properly, to determine how many users + have visited certain pages, or to prevent fraud. We use + IP address information to derive your approximate + location. We also work with analytics providers, such + as Google Analytics, which use cookies and similar + technologies to collect and analyze information about + use of the site and report on activities and trends. + These services may also collect information about the + use of other websites, apps, and online resources. You + can learn more about Google’s practices by going to{' '} + + https://www.google.com/policies/privacy/partners/. +
+
+ If you do not want information collected through the use + of cookies, most browsers allow you to automatically + decline cookies or be given the choice of declining or + accepting the transfer to your computer of a particular + cookie (or cookies) from a particular site. You may also + wish to refer to{' '} + + http://www.allaboutcookies.org/manage-cookies/index.html. + If, however, you do not accept cookies, you may + experience some inconvenience in your use of Scratch.
+
+ +

How does the Scratch Team use my personal information?

+

+
Internal and Service-Related Usage
+
+ We use Personal Information for internal and Site-related + purposes, including to operate, provide, and maintain the + Site. +
+
Analytics and Improving the Site
+
+ We and our service providers use Personal Information + that we collect on the Site, such as your location and + your activities on the Site, to monitor and analyze + usage of the Site and to improve and enhance the Site. +
+
Communications
+
+ We may send emails to an email address you provide to us + for customer-service or technical-support purposes, to + send you information about topics or content that we + think may interest you, or updates about the latest + developments or features on the Site. We may also send a + newsletter to the email address you provide to us if you + subscribe to receive the newsletter. Parents and + guardians who register their under-16 year olds for + Scratch may also receive additional updates from the + Scratch Foundation, a non-profit that supports Scratch + educational initiatives. +
+
Aggregate Data
+
+ We may de-identify and aggregate information collected + through the Site for statistical analysis and other + lawful purpose, including in research studies intended + to improve our understanding of how people learn with + Scratch. The results of this research are shared with + educators and researchers through conferences, journals, + and other publications. You can find out more on our{' '} + Research page. +
+
Legal
+
+ We may use your Personal Information to enforce our{' '} + Terms of Use, to defend our + legal rights, and to comply with our legal obligations + and internal policies. We moderate all content posted to + Scratch, including unshared projects, comments, and + forum posts. +
+
+ If you are located in the European Economic Area, we + only process your Personal Information based on a valid + legal ground, including when: +
+
    +
  • + You have consented to the use of your Personal + Information, for example, to receive electronic + marketing communications; +
    • +
  • + We need your Personal Information to provide our + services, including for account registration, to + respond to your inquiries, or for customer support; +
    • +
  • + We have a legal obligation to use your Personal + Information; or +
    • +
  • + We or a third party have a legitimate interest in + using your Personal Information. In particular, we + have a legitimate interest in using your Personal + Information to personalize our services and provide + you with tailored content, conduct business + analytics, and otherwise improve the safety, + security, and performance of our Site. We only rely + on our or a third party’s legitimate interests to + process your Personal Information when these + interests are not overridden by your rights and + interests. +
    • +
+
+
+
-

How does the Scratch Team use my information?

+

How Does Scratch Share my Personal Information?

+

+ We disclose information that we collect through the Site to + third parties in the following circumstances: +

  • - We collect age and gender data so that we know who is using our - website. + To third-party service providers who provide services + such as website hosting, data analysis, information + technology and related infrastructure provisions, + customer service, email delivery, and other services.
  • - If you forget your password, we will ask you to disclose to us - your birth month and year so that we can verify your account, and - your email address so that we can send you a new password. + We may also disclose your Personal Information with your + permission. We may seek your permission in various ways. + For example, we may present you with an “opt-in” prompt + when you register to use the Site or access certain + content.
  • - We will use your email address to respond to messages you send us - or to communicate with you about the Scratch service or your account. + To a potential or actual acquirer, successor, or + assignee as part of any reorganization, merger, sale, + joint venture, assignment, transfer, or other + disposition of all or any portion of our organization or + assets. You will have the opportunity to opt out of any + such transfer if the new entity’s planned processing of + your information differs materially from that set forth + in this Privacy Policy.
  • - We send out occasional email updates about Scratch to the confirmed - email address on your account. Scratch will never sell or share your - email address without your permission. You can unsubscribe from these - updates by clicking the unsubscribe link found at the bottom of the - email. -
    • -
  • - Parents and guardians who register their under-13 year olds for - Scratch may also receive additional updates from the{' '} - Scratch Foundation, - a non-profit that supports Scratch educational initiatives. - The Scratch Foundation will never sell or share your email - address without your permission. You can unsubscribe from these - updates by clicking the unsubscribe link found at the bottom of - the email. -
    • -
  • - If we detect repeated abusive behavior from your account, IP address, - or email address, we may share your account name, IP address, and the - time and content of the abusive behavior with the IP address owner - (such as a school or internet service provider). -
    • -
  • - We may use de-identified location, age, gender, and usage data - in research studies intended to improve our understanding of - how people learn with Scratch. The results of this research are - shared with educators and researchers through conferences, - journals, and other publications. You can find out more on our{' '} - Research page. -
    • -
  • - We may disclose some of the information we collect to third-party - service providers that help us manage communications to and from - the Scratch website and improve website performance. We are - satisfied that these service providers have privacy policies that - restrict them from further disclosing any of your information. -
    • -
  • - Other than as described above, we will never share personally - identifiable information about you with any other person, - company, or organization, except: -
      -
    • - As required to comply with our obligations under the law. -
      • -
    • - For technical reasons, if we are required to transfer the - data on our servers to another location or organization. -
      • -
    -
    • -
  • - Scratch reserves the right to share user information with the - appropriate authorities (including schools, school districts, - and law enforcement, when necessary) for the purposes of protecting - the safety of users, other individuals, or the security of the site. + If required to do so by law or in the good faith belief + that such action is appropriate: (a) under applicable + law, including laws outside your country of residence; + (b) to comply with legal process; (c) to respond to + requests from public and government authorities, such + as school, school districts, and law enforcement, + including public and government authorities outside your + country of residence; (d) to enforce our terms and + conditions; (e) to protect our operations or those of + any of our affiliates; (f) to protect our rights, + privacy, safety, or property, and/or that of our + affiliates, you, or others; and (g) to allow us to + pursue available remedies or limit the damages that we + may sustain.
-
+
-

How can I update my personal information?

+

Third Party Services

- You can update your password, email address, and country through - the Account Settings page. - You can also reset your password through the{' '} - Account Reset{' '} - page. You cannot change your username, but you can make a new - account and manually copy your projects to the new account. + This Privacy Policy applies only to the processing of your + Personal Information by Scratch. It does not address, and we + are not responsible for, the privacy, information, or other + practices of any third parties, including any third party + operating any site or service to which the Site links. The + inclusion of a link on the Site does not imply endorsement + of the linked site or service by us or by our affiliates.

+
+
+ +

Your Rights and Choices

+

+
+
Updating Your Information
+
+ You can update your password, email address, and country + through the Account + Settings page. You can also reset your password + through the Account + Reset page. You cannot change your username, but you + can make a new account and manually copy your projects + to the new account. +
+
+ If you want to delete your account, login to Scratch, + and then click your username in the top right-hand + corner. Select "Account Settings," then click the "I + want to delete my account" link at the bottom of the + page. Deleting your account hides all information from + public view, but does not remove all of your information + from our servers. If you want to have all of your + information removed from our servers, please contact + help@scratch.mit.edu for assistance. +
+
Marketing Communications
+
+ If you decide at any time that you no longer wish to + receive marketing communications from us, please follow + the unsubscribe instructions provided in any of the + communications. You may also opt out from receiving + email from us by sending your request to us by email at + help@scratch.mit.edu. Please be aware that, even after + you opt out from receiving marketing communications from + us, you may continue to receive administrative messages + from us regarding the Site. +
+
Your Data Protection Rights (EEA)
+
+ In certain jurisdictions, you have the right to request + access and receive information about the Personal + Information we maintain about you, to update and correct + inaccuracies in your Personal Information, to restrict + or object to the processing of your Personal + Information, to have the information blocked, + anonymized, or deleted, as appropriate, or to exercise + your right to data portability to easily transfer your + Personal Information to another company. Those rights + may be limited in some circumstances by local law + requirements. In addition to the above-mentioned rights, + you also have the right to lodge a complaint with a + competent supervisory authority subject to applicable + law. +
+
+ Where required by law, we obtain your consent for the + processing of certain Personal Information collected by + cookies or similar technologies, or used to send you + direct marketing communications, or when we carry out + other processing activities for which consent may be + required. If we rely on consent for the processing of + your Personal Information, you have the right to + withdraw it at any time and free of charge. When you do + so, this will not affect the lawfulness of the + processing before your consent withdrawal. +
+
+ To update your preferences, ask us to remove your + information from our mailing lists, or submit a request + to exercise your rights under applicable law, please + contact us as specified in the “How to Contact Us” + section below. +
+
+
+
+ +

Data Retention

- If you want to delete your account entirely, log in to Scratch, - and then click your username in the top right-hand corner. Select - "Account Settings," then click the "I want to delete my account" - link at the bottom of the page. + We take measures to delete your Personal Information or keep + it in a form that does not allow you to be identified when + this information is no longer necessary for the purposes for + which we process it, unless we are required by law to keep + this information for a longer period. When determining the + retention period, we take into account various criteria, + such as the type of services requested by or provided to + you, the nature and length of our relationship with you, + possible re-enrolment with our services, the impact on the + services we provide to you if we delete some information + from or about you, mandatory retention periods provided by + law and the statute of limitations.

-

How does the Scratch Team protect my information?

+

How does the Scratch Team protect my personal information?

- The Scratch Team has in place physical and electronic procedures - to protect the information we collect on the Scratch website. We - strictly limit individual access to the Scratch servers and the - data we store on them. However, as effective as these measures - are, no security system is impenetrable. We cannot completely - guarantee the security of our database, nor can we guarantee that - the information you supply will not be intercepted while being - transmitted to us over the Internet. + The Scratch Team has in place administrative, physical, and + technical procedures that are intended to protect the + information we collect on the Scratch website against + accidental or unlawful destruction, accidental loss, + unauthorized alteration, unauthorized disclosure or access, + misuse, and any other unlawful form of processing of the + Personal Information in our possession. For example, we + strictly limit access to the Scratch servers and the data we + store on them. However, as effective as these measures are, + no security system is impenetrable. We cannot completely + guarantee the security of our databases, nor can we + guarantee that the information you supply will not be + intercepted while being transmitted to us over the Internet.

-

Notifications of Changes to the Privacy Policy

+

Notifications of changes to the Privacy Policy

- We review our security measures and Privacy Policy on a periodic - basis, and we may modify our policies as appropriate. We may also - change or update our Privacy Policy if we add new services or - features. If we make any changes to our privacy practices, we will - amend this Privacy Policy accordingly and post the amended policy - on the Scratch website. We encourage you to review our Privacy - Policy on a regular basis. + We review our security measures and Privacy Policy on a + periodic basis, and we may modify our policies as + appropriate. If we make material changes, we will notify you + through the Site or by sending you an email or other + communication. We encourage you to review our Privacy Policy + on a regular basis. The “Last Updated” date at the top of + this page indicates when this Privacy Policy was last + revised. Your continued use of the Site following these + changes means that you accept the revised Privacy Policy. +

+
+
+ +

International Cross-Border Data Transfer

+

+ Scratch is based in the United States. Personal Information + that we collect may be transferred to, and stored at, any of + our affiliates, partners, or service providers which may be + inside or outside the European Economic Area, including the + United States. By submitting your personal data, you agree + to such transfers. +

+
+
+ +

What can I do to help protect privacy on Scratch?

+

+ Please do not share personal contact information (such as + your name, physical address, email address, or phone number) + in projects, comments, profiles, studios, or forum posts. + Please let us know if you see this kind of information by + using the “Report” link which appears on the page. It is + also important that you maintain the security and control + of your account credentials, and not share your password + with anyone. +

+
+
+ +

Contact Us

+

+ The Code-to-Learn Foundation d/b/a The Scratch Foundation is + the entity responsible for the processing of your Personal + Information. If you have any questions about this Privacy + Policy, or if you would like to exercise your rights to your + Personal Information, you may contact us at{' '} + help@scratch.mit.edu or + via mail at: +

+

+ Scratch Foundation
+ ATTN: Privacy Policy
+ 7315 Wisconsin Ave.
+ 4th Floor West
+ Bethesda, MD 20814

-

The Scratch Privacy Policy was last updated: November 2016

 From f6a11e1c436a35cdfe056ae8ae1ce5eb4c94b866 Mon Sep 17 00:00:00 2001 From: Andrew Sliwinski Date: Mon, 21 May 2018 15:55:42 -0400 Subject: [PATCH 02/12] Update default 'opt-in' state for teacher registration --- src/components/registration/steps.jsx | 1 + 1 file changed, 1 insertion(+) diff --git a/src/components/registration/steps.jsx b/src/components/registration/steps.jsx index b97960df6..4f090a8e0 100644 --- a/src/components/registration/steps.jsx +++ b/src/components/registration/steps.jsx @@ -1246,6 +1246,7 @@ class EmailStep extends React.Component { value help={null} name="subscribe" + value={false} valueLabel={ this.props.intl.formatMessage({id: 'registration.optIn'}) } From 244a76149bc16a14b23aa26a6e99278c22b7c7e7 Mon Sep 17 00:00:00 2001 From: Andrew Sliwinski Date: Mon, 21 May 2018 17:04:50 -0400 Subject: [PATCH 03/12] Resolve lint issues --- src/components/registration/steps.jsx | 1 - src/views/privacypolicy/privacypolicy.jsx | 38 +++++++++++------------ 2 files changed, 19 insertions(+), 20 deletions(-) diff --git a/src/components/registration/steps.jsx b/src/components/registration/steps.jsx index 4f090a8e0..a1d752f99 100644 --- a/src/components/registration/steps.jsx +++ b/src/components/registration/steps.jsx @@ -1243,7 +1243,6 @@ class EmailStep extends React.Component { validations="equalsField:user.email" /> ( Scratch understands how important privacy is to our community, especially kids and parents. We wrote this Privacy Policy to explain what information we collect - through our website (scratch.mit.edu) (the “Site”), how we - use, process, and share it, and what we're doing to keep it - safe. It also tells you about your rights and choices with - respect to your information, and how you can{' '} + through our website (scratch.mit.edu) (the "Site"), + how we use, process, and share it, and what we're doing + to keep it safe. It also tells you about your rights and + choices with respect to your information, and how you can{' '} contact us if you have any questions or concerns.

@@ -62,8 +62,8 @@ const Privacypolicy = () => ( comments, you need to make an account. During account creation, we ask you for a username, your country, birth month and year, gender, and your email address (or your - parent or guardian's email address if you are under 16 - years old). We ask that you select a username that does + parent or guardian's email address if you are under + 16 years old). We ask that you select a username that does not disclose your real name or other information that could identify you. Other users can see your username and country, but not your age, gender, or email address. @@ -133,7 +133,7 @@ const Privacypolicy = () => (

How does the Scratch Team use my personal information?

-

+

Internal and Service-Related Usage
We use Personal Information for internal and Site-related @@ -282,7 +282,7 @@ const Privacypolicy = () => (

Your Rights and Choices

-

+

Updating Your Information
@@ -297,13 +297,13 @@ const Privacypolicy = () => (
If you want to delete your account, login to Scratch, and then click your username in the top right-hand - corner. Select "Account Settings," then click the "I - want to delete my account" link at the bottom of the - page. Deleting your account hides all information from - public view, but does not remove all of your information - from our servers. If you want to have all of your - information removed from our servers, please contact - help@scratch.mit.edu for assistance. + corner. Select "Account Settings," then click + the "I want to delete my account" link at the + bottom of the page. Deleting your account hides all + information from public view, but does not remove all of + your information from our servers. If you want to have + all of your information removed from our servers, please + contact help@scratch.mit.edu for assistance.
Marketing Communications
@@ -446,10 +446,10 @@ const Privacypolicy = () => ( via mail at:

- Scratch Foundation
- ATTN: Privacy Policy
- 7315 Wisconsin Ave.
- 4th Floor West
+ Scratch Foundation
+ ATTN: Privacy Policy
+ 7315 Wisconsin Ave.
+ 4th Floor West
Bethesda, MD 20814

From 59ca64579ebffa6051aa0fb5df277fb11e68ae49 Mon Sep 17 00:00:00 2001 From: Andrew Sliwinski Date: Tue, 22 May 2018 09:24:36 -0400 Subject: [PATCH 04/12] Fix typo --- src/views/privacypolicy/privacypolicy.jsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/views/privacypolicy/privacypolicy.jsx b/src/views/privacypolicy/privacypolicy.jsx index f65f16af1..6ae2cb680 100644 --- a/src/views/privacypolicy/privacypolicy.jsx +++ b/src/views/privacypolicy/privacypolicy.jsx @@ -456,7 +456,7 @@ const Privacypolicy = () => (