In May 2021, Audacity was acquired by Muse group.
On July 2, Muse Group quietly updated Audacity’s privacy policy with new terms copied straight from the Muse Group’s own privacy policy. The new privacy policy states that the app will collect limited personal information to improve the application, and notes the company may share your personal data with law enforcement and sell it to potential buyers.
Audacity doesn’t have accounts or profiles, so it doesn’t know your name, email address, or other personal information. But it will collect things like your IP address, OS version, OS name, CPU details, error codes, and crash reports.
In the “For Legal Enforcement” section, the policy says “Data necessary for law enforcement, litigation and authorities’ requests (if any).” This is ambiguous and up for interpretation. Real IP addresses are stored for one day, and then they are hashed. But that may be enough for local governments to find your location using a data request.
The data is stored in European Economic Area, but personal data might be occasionally shared to the group’s head office in Russia and external counsel in the United States. This means the company will have to comply with data requests from both Russia and the United States.
Interesting. I haven’t been using 3.x Audacity and hadn’t heard of those changes. I use it on a Linux Laptop so I wonder if they can get the same data from that machine. To be honest I use it exclusively for ripping and editing vinyl that I already own, so I doubt I have any legal issues.
That said being a long time technology professional, I go under the assumption that I have no digital privacy and nothing is fully out of reach to LE. It has served me well over the years.