[Google Pixel 3 XL Questions & Answers] cb474:
I appreciate your extended response to my post, but I guess I'm not finding it very persuasive.

First of all, your privacy policy, like most such policies, is really more of an explanation of all the ways you can collect and share the data of your users, including with third parties of more or less any nature. It's really not about how your are protecting your users' privacy.

Your response it that although, through the Google sign in you can collect a fair amount of data, you don't actually do that and you don't share it with any third parties. This is an essentially, just trust me, position.

In reality, you have a privacy policy that spells out your right to collect any number of different types of data about your users and share it with almost anyone, but then you assert separately that you don't do that. Well, then, why not write a privacy policy that doesn't give you all these privileges to collect and share data? That would be more reassuring.

In the end, I believe you that you're not collecting and sharing data. But any reasonable person, who cares about their privacy, has to assume that if they policy says their data can be collected and shared, then it may well happen. Just trust me, is not a good privacy policy.

What's more, you say that you need this policy, in case some other party takes over the development of the app in the future and therefore you need to be able to convey to them the right to control the data that you have collected. This is tantamount to admitting that the data you currently collect that you want users to trust you with, may some day be handed over to another party that you ultimately will have no control over. And in fact, this is exactly the sort of thing that happens all the time with businesses being acquired by other parties. It is a classic way that people lose control of their privacy and that things that start with the best of intentions, turn into something quite different in the long run. So this aspect of your privacy policy ought to give people pause. It is a classic mistake that people think they can collect data on people and maintain control over it. Data tends to eventually get abused or shared one way or another, in a fashion not intended by the party that originally collected it. This is why people should just be wary about their data being collected in the first place. Someone who does not understand that risk, when collecting data, is not really being respectful of the privacy of others.

You also say, that you need the Google sign in to help protect against piracy. I appreciate that this is a problem. But there are a lot of apps, millions, that don't use Google sign in, and somehow manage the problem of piracy. So I guess I have trouble accepting that as necessary to solve the problem.

What's more, by using Google sign in, this not only potentially allows your app to collect a lot of data on users, but it is also another way that Google collects data on what users are doing on Android phones. This is why Google makes all these handy technologies available to developers--so that they can then collect data through these technologies on what people are doing.That is an element of privacy that you have no control over, but which the use of Google sign in on your app opens to abuse.

At the end fo the day, there are backup services, at least on the desktop, such as SpiderOak or Tresorit, that go out of their way to not collect data about users. They encrypt all data before it gets uploaded to servers in a zero-knowledge fashion, so that even the app developers don't know what you're doing and can't decrypt the data. They even offer ways to pay for their services anonymously through Bitcoin or even cash payments. Their position is: We want to assure our users that we respect their privacy, by not collecting any information on them and allowing them to be anonymous if they want to. We don't ask them to trust us. We design a system that does not require them to do so. That's what respecting privacy looks like.

If it were possible to use Swift Backup in a way that it operated entirely locally on my device and did not require any online access, I would trust it. Given that by its nature, a backup app has access to a lot of personal data on my phone (because it essentially copies all of my texts, contacts, emails, etc.), I want to be sure I have control over what is happening with that data. An app that needs to sign into Google's servers and relies on backend cloud system that I don't want to participate in, is not something I can trust. It opens avenues for misuse, by the developer, by Google, by backend systems getting hacked, by future third parties that might take over the app. I think people are naive to think their data won't get misused someday, one way or another, even if the original developer has the best of intentions (and one has to assume that in the first place based on nothing more than reassurances).

So I think that if people don't care about their privacy and security, go ahead and use Swift Backup. But if they do care about their privacy--given the privacy policy for Swift Backup and the use of Google Sign In and the fact of there being no way to run the app only locally without online access--there is no reasonable way one can expect real privacy from the use of this app.