based.quest – Why I can't enable registrations

Posted on 23/02/2022 16:59:55

If you’ve used any of my services, you have more than likely have had to use it as a guest rather than a registered user. There’s one simple reason why I can’t allow you to. GDPR… and lack of helping the little guy with it.

The case of Matrix

I love Matrix - I would love to contribute to the wider ecosystem of it with my homeserver, but I’ve always had to shut down requests of people wanting to register an account in my homeserver if I do not know them.

The annoyance comes from the fact that Element only covers their own asses. I would love to add a privacy notice and easy methods to remove all user data whatsoever. I would love to open registrations for many services. However, I wouldn’t like to get a GDPR fine for being in violation of the law. You cannot easily readapt the privacy notice for Synapse and Element. They’re written on a scale of a business - the only templates in repositories are ones for Element themselves. I have tried rewriting one of their GDPR and privacy notices to no avail - it’s full of legalese jargon that is hard to read for a normal person.

Okay? Matrix has a deactivate button.

That isn’t GDPR compliant still. It doesn’t fully erase all of your data. It only wipes your profile data, which can still be retrieved from the channels that the user was partaken in. Not only that, but you cannot remove data from other homeservers - this is a huge red flag in data sharing.

What about this other service you’re hosting?

There is even less of a legal notice put up for those. If you find a reasonable legal notice anywhere that can be adapted by an individual, not a business, please let me know.

TL;DR - GDPR non-compliance if I would enable. No safety net either by the bigger projects, only to cover businesses. Smaller projects tend to not even have any documents in first place.

Thanks for reading

• Cernodile