1h ago
Compliance settings for cloud integration
There is a thread about this already, but it doesn't really have upvotes, and I think this is a much larger issue than "just annoying", so I'm opening a new thread here.
The thing is: I am not allowed to send work-releated information to unapproved cloud services, especially not unpaid services outside Europe without a data processing agreement compliant with our customer contracts.
It is a major violation if I accidentally submit JS errors to OpenAI because I click the highlighted button on the error message, and that error message has internal information in it. Also, this is simply not behaviour that I would expect form a notes and TODO app, which usually contains sensitive information about users and their work and private lives.
I think that such cloud-based AI features (and any other non-AI feature that can send data to 3rd-party services) should be opt-in. And even if it is just opt-out, the setting should at least be available in the settings window, not just as a hidden setting through the command bar.
I've learnt to trust NotePlan, especially since a lot of cloud sync happens through CloudKit. The AI integration is a violation of that trust in my opinion.
I'm not against such integrations in general, but they shouldn't send data away unexpectedly, and it shouldn't be possible to trigger them unintentionally.
Pending
Just want to add: It's very intransparent to do things like in this screenshot. I basically wrote a template that causes an error in the templatejs block, and this is the error message I got because of that when inserting the template. I'm not getting a proper error message that I could debug, instead the default is to send it to an AI (I don't want to vibe-code my templates, I'm an actual programmer, thank you – I can ask the AI later, but usually it's even faster to see the error message instead of having to read through AI boilerplate text, as 90% of these are just typos or missed semicolons). But even if we ignore this detail: I would expect the highlighted button to hide the error message, not transmit the data I was processing to a third party (where NotePlan doesn't even know whether I never have agreed to their TOS btw). Yes, the error message told me this would be transmitted (although I don't know what "error details" means exactly here). However, such errors also tap into my prompt fatigue and I just click the highlighted button. It's a dark pattern at least, and a lack of transparency about privacy impacts at worst (whether or not this would have GDPR implications I don’t know). It should be much clearer that data would be transmitted. What if my prototype of this template contains an API key in plain text? What if the error message contains PII of a customer? What if the error details contain an API key that I just copy-pasted from my password manager? Suggestion: Show full error details in the error pop-up, including the error message, (and optionally, format the pop-up properly). Make the dialog have three buttons: - the left, grey one "Analyze with ChatGPT". - the middle, grey one "Insert details to current note" (which is equivalent to the current "no", where it renders the error details into the note). - the right, highlighted one "Dismiss", without inserting anything into the note. And if the user clicks the ChatGPT button, show OpenAIs TOS with "I Agree" / "I do not Agree" buttons. (may store the agreement and not show it again in this case)