Evernote's Future & Privacy

[mz123 42]

Dear Evernote,

Now that you have reverted your planned Privacy Policy changes after user and media backlash, I have some simple suggestions.

1. Don't let this happen again. Realize that your users are vocal, and somewhat unique compared to typical users of services from Google and Microsoft. Evernote users care about privacy.
    
2. Recognize that existing views within Evernote, and perhaps a developing subculture within the company, did not recognize the error and proposed the Privacy Policy change. Those same people or subcultures may attempt to degrade users' privacy again in other ways in the future. You need to actively address this, or it will bite you again. You can't just say "oops, we messed up on a communication detail". That's not what happened here. What happened is that Evernote temporarily forgot that its users owned their data and that Evernote is supposed to care about privacy. Policies were changed with legal review. Programmers implemented an opt-out feature. This happened with organizational consent.
    
3. Damage has been done to your reputation and to users' confidence. Merely reverting your privacy policy is not enough. Be proactive! You should recognize the uniqueness of your user base and the use cases for your product. How about offering encryption of notebooks? Isn't Evernote positioned as users' "Second Brain"? Can you think of anything people want to keep private more than the contents of their brains? Given this, to not offer easy to use whole-notebook encryption at this point is almost unthinkable, especially when your competitors do.

If you don't agree with the above, then perhaps you should articulate a new business model and product vision

What do you say? Do you want to remain your users' Second Brain that they trust and can rely on? Don't just say it. Act on it. Implement features that will provide your users with evidence that is the case.

[DTLow 5,736]

11 minutes ago, mz123 said:

Given this, to not offer easy to use whole-notebook encryption at this point is almost unthinkable, especially when your competitors do.

Notebook encryption has been posted as a feature request.  It would be more constructive to go to the request below and show your support by adding your vote (voting buttons are in the upper left corner of the discussion)

 

[mz123 42]

1 minute ago, DTLow said:

Notebook encryption has been posted as a feature request.  It would be more constructive to go to the request below and show your support by adding your vote (voting buttons are in the upper left corner of the discussion)

 

 

I did do that and wouldn't discourage anyone from voting on that feature. However, I disagree it would be more constructive. Evernote has been aware of that request for years, and their latest expression of thinking on that topic was the new Privacy Policy proposal. That's hardly an indication that they listened to their user base! Adding votes to that feature is probably not terribly constructive at all, at this point.  

I want to spur their thinking on this. I posted the reasons why they should use the recent debacle as a way to pivot and implement features that improve their product in a meaningful way and inspire confidence. I hope they reconsider their strategy and feature development in the context of what recently transpired. I hope you would support that.

 

[DTLow 5,736]

18 minutes ago, mz123 said:

I hope you would support that

I added my vote to the encrypted Notebook request.

I was willing to participate in the Machine Trading program, but felt "opt in" should not be the default.

Can't support all this FUD and whining about privacy.  I already encrypt my sensitive data, and I trust Evernote or I would not upload my data to their severs

[jefito 5,589]

What? Users of Google and Microsoft products don't care about privacy? How did I miss that memo?

I think that actually most would agree that this was a indeed a communication screwup, and that the machine learning stuff should be opt-in (which, if it offers some real, discernible benefits, I probably will, at least for my personal Evernote account; otherwise I'll ignore it). The powers-that-be at Evernote got that stuff wrong, and fortunately they they owned up and reversed themselves on those points. Beyond that, I don't need to expend a lot of harrumphing and fingerpointing about it; it's a lot more productive and satisfying to me to help other forum users with using Evernote effectively. Have I lost trust in Evernote? No, not really. I've weighed its benefits against the risks, and the benefits have won out (much like my use of Gmail). I'm still in.

[Ricky 11]

The viable competitors I can think of our Google keep and OneNote. And neither of those offer encryption that you can create from the smartphone. One note on the desktop might offer that but I don't remember seeing that. Anyway OneNote sucks compared to Evernote in my opinion, images you create on the desktop are noticeably blurry on the android and syncing is not as reliable. Evernote is still the best option out there when it comes to the most detailed features and having everything in one place.  But obviously I agree with you that Evernote needs to be more careful when it comes to users privacy. 

[mz123 42]

2 hours ago, jefito said:

What? Users of Google and Microsoft products don't care about privacy? How did I miss that memo?

I think that actually most would agree that this was a indeed a communication screwup, and that the machine learning stuff should be opt-in (which, if it offers some real, discernible benefits, I probably will, at least for my personal Evernote account; otherwise I'll ignore it). The powers-that-be at Evernote got that stuff wrong, and fortunately they they owned up and reversed themselves on those points. Beyond that, I don't need to expend a lot of harrumphing and fingerpointing about it; it's a lot more productive and satisfying to me to help other forum users with using Evernote effectively. Have I lost trust in Evernote? No, not really. I've weighed its benefits against the risks, and the benefits have won out (much like my use of Gmail). I'm still in.

I think we can all admit that the typical (I didn't say "all") user of Google and Microsoft products doesn't care too much about privacy. Same goes for Facebook. I still say that Evernote users, and Evernote as a company, certainly seem to care more. If that weren't true, they wouldn't be upgrading to Windows 10 or shipping all their data to the cloud. I'm speaking in generalizations. I see Evernote as catering to a different kind of user, and suggesting a different approach to privacy.

The fact that this policy was approved, indicates there was a broad difference between what the "you own your date" mantra states, and the culture in the company.

[Fernelius 10]

We really need to see Evernote support full notebook encryption with key management and use limited to the client side (unless someone decides to access these notebooks from the web interface).  With state hacking of personal and political committee email, hackers making their way into Yahoo twice, hackers gaining access to various retail outlets, hackers gaining access to the U.S. DOD security clearance application site a few years ago, and countless other events, we must assume that Evernote files are vulnerable to actors outside of the Evernote team -- even if we assume there is little or no vulnerability from internal actors.  If the system is going to be a "second brain" or substantial repository of our thoughts, experiences, and other data, we need to have a better level of protection than currently afforded.  Encryption using strong methods (AES-256, etc.) provides a much, much higher level of protection; though, this again is not a sure guarantee.  There are organizations trying to defeat these standards as well.