Request to Add Vector Privacy

Greetings, everyone!

I came across this site through Awesome Privacy on GitHub! They have an integration on their site that works with the TOSDR rating and I thought that was really neat. I was looking where I could apply to have Vector Privacy added, which is a free, open-source, encrypted, privacy messenger app. I will link below the website, documentation, and privacy policy. Please let me know if this is the correct place to post and request or how I can go about doing so if this is incorrect. Thanks!

Website: https://vectorapp.io
Docs: https://docs.vectorapp.io (GitBook)
GitHub: GitHub - VectorPrivacy/Vector: Privacy is a basic human right. · GitHub
Privacy Policy: Privacy Policy - Vector

I’ve added the service, I saw it was already proposed. Please use the this form for in the future Add new Service - ToS;DR

You can help create the summary and rating for Vector here: Terms of Service; Didn't Read - Phoenix

Very strange that you don’t seem to have terms of service btw.

1 Like

@YuurinB can you provide us with a logo?

1 Like

@shadowwwind A logo has been added. Don’t ask me how I gat my hands on it (Inspect SVG → Edit as SVG → Copy data → Save to SVG file → Convert to PNG using inkscape).

1 Like

@YuurinB @shadowwwind I have reviewed the service. Will have to wait for other curator/staff’s approval.

Here is a 512x512 logo for Vector Privacy. Apologies for the delay.

Great! Yeah, once you have an .svg, it’s easy to make any other variation. Also, there are a lot of free tools online now you can just convert + optimize images to save yourself time, but I also manually export in Figma and Adobe Illustrator a lot of the time.

Thank you, I have started to go through them all and commenting on some to clarify. Please give me about 24 hours to make sure these are addressed accurately, then we can ship. Thanks again for your help.

I’m more of a terminal guy but good to know!

1 Like

Thanks but we rely on peer reviewing from Curators and/or Staff (other than whoever submitted the point). We review terms based on what the documents specify, hence our excerpt system; contextual information is not likely to change any reviews. Services we review are responsible for giving all the necessary context in their terms, since they are final and legally binding.

We don’t wait (nor do we have an obligation to do so) for contextual information to review our docs, given the aforementioned reasons. We operate independently.

With all that being said, don’t feel discouraged from giving information! Any context is good.

2 Likes

Understood, thanks for sharing. I am new to TOSDR, but really like what you all have built and maintaining. The peer review process makes sense. With that said, I have added notes. There are several things that are incorrect, but I also understand it may be challenging and a bit vague to understand based just off the privacy policy alone. I appreciate you all’s time and effort. If there’s anything else I can do or provide or recommendations to update and request to update on TOSDR, please let me know.

can every user just download any users message? is not stored who a message is for or by whom it is?
does the encrypted message contain information about the sender? (also if its is encrypted)

continuing Terms of Service; Didn't Read - Phoenix

It is decentralised and every message is technically downloadable, but without decryption, you’ve downloaded nothing to make any sense of. Even if you collected every event ever broadcast, you can’t read it, act on it, or use it, possession means nothing without access. The sender’s public key is never exposed, and a recipient tag without a sender is context-free, it’s a dead end, not a data point.

More Info:
Vector uses MLS (https://openmls.tech/) there is also more information on the Gitbook documentation: Privacy | Vector Messenger | Vector Privacy.

Possession means nothing now.

That should be clearly communicated with users.

Do you do perfect forward secrecy?

Can nodes see both the sender and recipient of each message?

Side note, I am also not sure how encrypted data is handled under GDPR, I know hashes of PII like email addresses is still considered PII.