Stripe and privacy concerns

[MathiasRenner]

@Changaco and the Liberapay Team: Thank you for your great work for Liberapay. I love Liberapay very much, and want continue using and supporting it. But there's one thing I don't understand: Stripe. I don't have a good feeling about Stripe due to privacy concerns.

Some Notes on that:

• I found others being also concerned here: https://social.tchncs.de/@kuketzblog/100547288512637237 (unfortunately, only in german)
• It's a US company, which meanwhile has to stick to the EU-GDPR - but reading the privacy policy I don't get a good feeling (https://stripe.com/de/privacy#how-we-disclose-personal-data)
• Liberapy is FLOSS and supports FLOSS. People like FLOSS because - amongst other reasons - you can self-host it and have data control. So far all of this is a perfect fit. But to me, this beautiful story gets a sad ending with Stripe.

I am sure your decision for Strips is the result of many discussions, and you probably did a deep research about payment methods and provider (for SEPA). So maybe there is just no other solution, which would be very sad to me.

All in all I wanna give you guys just the feedback that me and maybe other FLOSS lovers (which is probably the most interesting of your target groups) might have problems using Liberapay with Stripe.

[trebmuh]

@MathiasRenner just for information (and waiting Changaco full answer), there is also a possibility to use paypal. Even if I can imagine that you'll have the same kind of reluctance to use it.

[MathiasRenner]

@trebmuh Exactly, same thing :-) Stripe and PayPal are in this discussion synonyms to me :-)
IMHO both have high legitimacy. Just for like-minded people an additional privacy-aware payment option would be awesome.

Fun fact: Paypal shares personal data with roughly 600 other companies, which are listed here: https://www.paypal.com/en/webapps/mpp/ua/third-parties-list

[tiotrom]

I don't think when it comes to payment you can find a way that doesn't collect lots of data. Perhaps the best would be a payment solution that doesn't collect a lot of fees and it is easily manageable through Liberapay dashboard.

[trebmuh]

an additional privacy-aware payment option would be awesome

@MathiasRenner : we've been actively searching for a replacement of the previous operator (mangopay) but didn't find one fitting with our needs yet. If someone knows one, please share the knowledge here.

[Changaco]

I agree that Stripe's privacy policy isn't perfect, the section "c. Interest-based advertising." in particular is problematic, however I do not think that Stripe should be avoided. As a payment service provider their primary business model is to charge fees for each transaction they process, so they don't need ads. With public pressure and the GDPR it should be possible to make them abandon any bad thing that they might be doing with user data. My recommendation to any EU citizen who has concerns about using Stripe is to send questions to Stripe's Data Protection Officer, whose email address is [email protected] (according to Stripe's "Privacy Center" page), and if the answer isn't satisfactory, to report Stripe to your national Data Protection Authority.

[axre]

I always thought one argument for using floss is you are in control of your data. Started using Liberapay because of 3 reasons - it's floss, few fees, makes my support easier to manage.

Now there's no argument for using Liberapay.

• it has the same (high) fees as any other donation option
• it has the same privacy concerns
• it's not easier than donating directly (clicking the donate button from PayPal for example)

If people are not using liberapay anymore its not a surprise.

@Changaco oh, a thumbs down? this comment may sound a bit harsh, but its just my (honest) opinion. im still grateful for your work on liberapay. it would be interesting to hear what exactly is the use of liberapay nowadays for you (&others) if its not effciency, privacy & easy managment.

[trebmuh]

@axre we are still looking for a good payment operator and have looked and analyzed a bunch of what's available right now. No luck so far. If you know of a good one, please, let us now.

[IzzySoft]

@trebmuh @Changaco I don't see what @axre wrote is criticizing you – it's simply stating the facts. Most F(L)OSS people avoid Paypal (I wouldn't dare using it myself on either end, donor or receiver); and for those who think different, simply pushing a Paypal button would 1) be less complicated and 2) avoid the "man in the middle" (again, no offense meant). And Stripe isn't an option for most of us either ("Pest or Cholera?").

It's really unfortunate no real alternative seems to exist. Again: no one said you didn't try, or didn't try hard enough – we just state the "status quo" and look what information is available – and what might possibly be done (or even already in the works).

My account is dead since Mango kicked you out. It lived just for about 2 months, and went better for me than Flattr did in years. So it hurts losing you – but currently we ("tin foils" if you want) are dead in the tracks with our accounts. Some are already planning their leave. I just had integrated the LP buttons in my site(s) … but currently don't see how I can use it.

Thanks again for all your affords. And please count our "speaking out" here not as "blaming you" – but rather as "not yet given up hope on LP". 🤞

[Changaco]

It was a good idea to open this issue but I think it's time to close it now. There is no evidence that Stripe is doing anything bad with the data they have, and if there was any evidence then the proper course of action would be to make them stop by using the GDPR. Boycotting Stripe doesn't solve anything, it's only shooting yourselves in the foot.

I've opened a new issue for the possible support of a third payment processor as an alternative to Stripe and PayPal: #1394.

@axre

• In some cases the fees are higher now than they were with Mangopay, but it's only a temporary setback.
• Mangopay required collecting more personal information from donors than Stripe. Also, just because Mangopay is based in the EU doesn't guarantee that they respect the GDPR any better than more global processors like Stripe and PayPal.
• Using Liberapay is easier than donating directly, both for the donor who can manage multiple donations from the same account and for the recipient who doesn't have to handle any aspect of the payment processing.

[Changaco]

Some of the comments on https://framasphere.org/posts/8670207 are about this issue.