Split from discussion in I found my Homey app listed on LG ThinQ PLAY without any prior notice
Where there forms a new Topic: Collecting user data in Homey (Community) Apps
That Post and ~ 18 Post mostly about this collecting of userdate / IP Addresses of Geo Data.
At least for me that doesn’t really matter. I collect data about my app users as well to get insight into which countries the app is most popular in (based on GeoIP), how often the users update the app, which platform version (Homey 2016-2019 or Homey 2023+) the users are using, etc. There’s nothing wrong with collecting telemetry IMO.
Why? The users already downloaded the app and you request that LG basically remotely uninstalls it? That would break many Flows (or however ThinQ calls them). I don’t think LG can legally do that.
I know Apple and Google can do it too, but that only happens upon finding malware inside the apps or on government request.
I assume you also explicitly inform them about that? Otherwise, you might have a GDPR-issue.
LG doesn’t collect (just) telemetry data.
Yes.
That’s not my problem, though. If Athom/LG distributed my apps without my consent, they were wrong to do so in the first place.
It is anonimized though using a random UUID. So each installation sets a UUID in the app settings and uses that to announce itself on the service. Then the service turns the IP into a country using a GeoIP API and stores that to a database. But no, the users aren’t informed about any data collection, it happens automatically when the app starts
Example:
I don’t think that’s relevant.
IP addresses are personal data under the GDPR.
That might be a problem.
Well, there are many websites that collect IPs in server logs even without consent, so I guess that won’t be much of an issue
Not sure what to do about it though, since unlike Google Play and the Galaxy Store, the Athom app store does not allow a privacy policy link
That’s typically not an argument that the Autoriteit Persoonsgegevens is susceptible to.
Stop collecting IP addresses 
The IPs themselves are not collected, only after they get sent to a GeoIP service. So the cloud telemetry service sends the IPs to ipinfo.io, and then the country from there gets stored. But I don’t think it’s needed anymore since Homey collects it automatically now and shows the countries in the Developer Tools (since the recent Developer Tools update)
The telemetry service also collects type IDs and definitions from unsupported devices to help improve the app
@smarthomesven you are walking onn thin ice mate!
Well, I still think remotely removing an app on a device where it’s already installed is not a good thing to do. If any company could just kill/remove apps that are already installed, it would be very bad for the users
IP adresses are regarded as personal data under GPDR! - The ice gets thinner and thinner.
Thats really bad now!
Do your users know, that you send their personal data to a third party? Have you their consent? How does your contract with that third party look? - I have been through that. And believe me: If anybody wants your balls they get’ em.
Haven´t read all posts yet. But better be silent now…
The IP is not collected. Only the country that it gets from the GeoIP service is stored. But I think I can remove that as well now since Homey has a map of countries built in to the developer tools since the latest update. It was primarily used to track app installs in countries, giving more insight into where the app is popular
And my website also collects IPs in server logs for all visitors, nginx does it by default at least in access.log. The telemetry service collects them as well and stores them for 12 hours on Vercel Observability
That’s only allowed if your app has a privacy notice/policy that is shown to the users of your app the moment you start collecting that information.
It does not, but there’s almost nobody who visits my website anyway. Primarily the bots 
And Vercel Observability can’t be turned off, so I guess it’s comliant with GDPR
“I guess” is not a legal defense.
Well, there are many websites on Vercel. Even sites without any privacy notice, so that should be fine. AFAIK every single webhost collects server logs for abuse prevention, etc.
II know the comparison is way to harsh but: Just because some people commit crimes it does not mean this ligitimates it for anybody else.
There is a little difference between logs required for server’s normal work and especially extracting/collecting the IP addresses in database:
Then the service turns the IP into a country using a GeoIP API and stores that to a database.
