Audacity, one of the most popular free audio-editing apps that has been available as an open-source software since May 2000, recently received an updated privacy policy that has raised concerns among users. Some of the users are even calling the app “spyware” for collecting user data specifically for “law enforcement, litigation, and authorities’ requests.” The Audacity team, however, says on its privacy policy page that the extensive data collection is meant for improving the app and for legal enforcement purposes.

The updated privacy policy, released on July 2, underlines that Audacity will collect personal data such as the operating system version, user country based on IP address, CPU, and non-fatal error codes as well as crash reports. All these details are meant to improve the app. However, the privacy policy also mentions that the app will collect “data necessary for law enforcement, litigation and authorities’ requests.” This has raised concerns from some users who have brought the issue into the limelight through a Reddit post.

Audacity’s privacy policy states that it may disclose the personal data collected to any of its staff members, competent law enforcement body, regulatory, government agency, court or other third party, including potential buyers. It also mentions that the data would be shared with Audacity’s “main office in Russia and external counsel in the USA,” as reported by FOSS Post.

The data shared with third parties will include hashed IP addresses, though the privacy policy states that those addresses will be “stored in an identifiable way” for a calendar day. This could be enough to provide exact details about users’ location and networks as a part of the data shared with state authorities.

Audacity’s policy also restricts users below the age of 13 to use the app. This is considered as a violation of the app’s licence that comes under General Public License, that makes software accessible for all users — and not specifically for a particular age group.

Audacity’s privacy policy update comes just over two months after it was acquired by Internet company Muse Group that also owns music and audio apps such as Ultimate Guitar and StaffPad.

When reached out for a comment, Muse Group Strategy Head Daniel Ray redirected Gadgets 360 to a post on GitHub where the company has made a clarification on the privacy policy and said that the user concerns were largely due to “unclear phrasing” in the privacy policy. The company also stated that it is in process to rectify the phrasing.

“We do understand that unclear phrasing of the Privacy Policy and lack of context regarding introduction has led to major concerns about how we use and store the very limited data we collect. We will be publishing a revised version shortly,” the company said.

Muse Group also said that the updated privacy policy did not actually come into force until the next release of Audacity (version 3.0.3) and its current version did not support data collection of any kind.

Speaking on why exactly Audacity requires the collection of users’ personal data including IP addresses, Muse Group said that the collection is particularly aimed to enable automatic updates and opt-in error reporting that both will be available in the next version. The company also mentioned that it used the term “personal data” in the privacy policy update as Europe’s General Data Protection Regulation (GDPR) classifies an IP address as a part of personal data. However, it has not yet addressed other concerns raised by users.

Meanwhile, some users have started calling for a forked version of Audacity on GitHub that would offer all its features but without requiring the collection of any user data. It is certainly possible as the app is available as an open-source software. However, it is not clear when exactly the community would be able to bring that fork. Muse Group may also be able to bring some efforts to put the ongoing criticism to rest.

Gadgets 360 has also reached out to Audacity founders Dominic Mazzoni and Roger Dannenberg for their take on the update. This report will be updated when we hear back.