This seems pretty straight forward to me: A) you must have the users consent to store and transmit their password in clear text
B) you need to talk to or hire out a lawyer to make sure the agreement is such that it adequately protects you. On May 22, 2012 9:26 PM, "Alaron" <[email protected]> wrote: > In my application, I use a user's email and password to log them into > another site. That is, I am a 3rd party service. I plaster a nice big > "it's all in cleartext so do this at your own risk" sign, but for my own > safety I do not keep the password past the session. This is obviously > annoying to users and I'd like to change that, but the way I read the > Distribution Agreement, I'm not allowed to. Am I interpreting it correctly? > > If the users provide you with, or your Product accesses or uses, user > names, passwords, or other login information or personal information, you > must make the users aware that the information will be available to your > Product, and you must provide *legally adequate privacy notice and > protection* (*I have no idea what makes for legally adequate notice*) for > those users. Further, your Product may only use that information for the > limited purposes for which the user has given you permission to do so. If > your Product *stores personal or sensitive information provided by users, > it must do so securely* (*I have to send the password across the wire in > cleartext... no idea how to store it securely*) and only for *as long as > it is needed* (*I clear the information when the user leaves the app... > this I want to change*). But *if the user has opted into a separate > agreement with you* (*does putting up the "at your own risk" sign > constitute a separate agreement?"*) that allows you or your Product to > store or use personal or sensitive information directly related to your > Product (not including other products or applications) then the terms of > that separate agreement will govern your use of such information. > > -- > You received this message because you are subscribed to the Google Groups > "Android Discuss" group. > To view this discussion on the web visit > https://groups.google.com/d/msg/android-discuss/-/COewF7nQnhcJ. > To post to this group, send email to [email protected]. > To unsubscribe from this group, send email to > [email protected]. > For more options, visit this group at > http://groups.google.com/group/android-discuss?hl=en. > -- You received this message because you are subscribed to the Google Groups "Android Discuss" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/android-discuss?hl=en.
