[maxidorius]

(One of the author of the research doc that triggered this blog entry here)

It's good to finally see a reply, and it's good to see you are addressing some of the issues we have highlighted. It's a shame it took a whole research document posted on Hacker News and other websites to start getting your attention. I am personally surprised about this blog entry (and reply to some extend), given that the research doc was labeled as "FUD" by the lead dev.

Now that we have it, and that you answered in a blog post, there is one question we asked several times and that you still did not answer, even in our GDPR data request: Given that the research document clearly highlights that users are totally unaware of how their personal data was collected, how its going to be used, and that they did not given consent (e.g. storing their email addresses for a lookup query mechanism) under EU GDPR: 1. Under which lawful basis do you collect, process and allow others to use such data? 2. Are you going to keep storing/using all the data you have collected using all the methods highlighted in the research doc, or will you purge all that was collected without clear knowledge and consent of the users?