Evernote CEO Chris O’Neill has had a long couple of days. The company he runs recently ignited a firestorm among its users when it announced a privacy policy change that would have required users to open up all their notes for analysis in order to take advantage of forthcoming machine learning features.
“We let our users down,” he said in an interview. “We really tactically communicated in about as poor a way as we could.”
Evernote is going back to the drawing board and reversing course on the proposed policy. Users won’t have their data shared with employees to help with machine learning unless they explicitly opt in.
“If any human is going to be involved, it’s going to be on an opt-in basis, period,” O’Neill said.
Furthermore, he said that he wanted to be clear that the company isn’t in the business of reading users’ notes. He joined Evernote as a heavy user of its service, and he keeps private information in his own account.
“Evernote never has and won’t read people’s notes without their permission,” he said. “I want to be really clear on that. We’ve not done that. We don’t plan to do that, period.”
Trust matters
This reversal is an important move for Evernote because it’s competing in a tough market against Microsoft, Google, Apple, and a host of other companies to be the service for people to store their notes. When it comes to storing deeply personal data, trust matters.
“We’re not a social media outlet that’s reading your stuff to then schlep ads in front of you,” O’Neill said. “The only thing that matters is trust and the quality of our product. You have to trust us, and you have to find value in our product. And if you don’t, guess what? You don’t pay us.”
Going forward, Evernote is still going to be working on features based on machine learning, though it’s shelving the privacy policy change that kicked off this wave of concern. CTO Anirban Kundu said the company is working on two broad types of functionality.
The first type is a capability can be trained using public data sets and information provided to the company but don’t require data from all of Evernote’s users. An example he gave was a way to extract tasks from meeting notes.
“There’s a defined manner in which you can extract tasks out of a particular meeting note,” Kundu said. “We don’t need to look at your notes to figure out what the task is.”
In order to train that type of machine learning system, Evernote may ask its users to submit notes they’re comfortable sharing with the company as part of a beta program. In addition, users will be able to choose to submit their notes for review if a system didn’t identify them correctly.
There are other machine learning systems that will need to be trained on each user’s behavior for them to work correctly, Kundu said. The way users search is one such example: Every person uses different methods to search, and it will be necessary to train the system on the way a particular user works in order to be useful.
Note data submitted for those purposes would have the identity of the user removed, and the data scientists analyzing it would see aggregated data, not a specific whole note from a user.
“That was always the intention,” Kundu said. “We respect what you put into Evernote too much to think of it in any way besides that.”
If that was the intention all along, why did Evernote change its privacy policy?
Policy details
“Our primary goal with the communication was to be as blatantly transparent as we possibly could, and in the spirit of not trying to get to nuance on it, we just went for the blunt instrument,” said Andrew Malcom, Evernote’s senior vice president of marketing.
Bluntness and a lack of detail—coupled with the fact that Evernote hasn’t yet completely figured out exactly what it plans to do—helped lead to the perfect storm of confusion and dismay when the new privacy policy was announced Wednesday.
It also didn’t help when the company asserted in its privacy policy update that opting out of the machine learning features wouldn’t block employees from viewing user notes for other reasons. Those other reasons don’t include allowing Evernote employees to just look at users notes whenever they want, though.
Instead, the company’s privacy policy allows employees to view notes for the sake of offering technical support at the request of a user, responding to law enforcement requests, and investigating suspected violations of its terms of service. Users can’t opt out of those scenarios.
Those provisions—especially responding to law enforcement requests—are common among other online service providers like Evernote. Apple, Microsoft, and Google, which all offer competing services, also provide data from users’ accounts in response to police requests they deem appropriate.
Public discussion
In some ways, Evernote’s willingness to discuss these issues publicly is a differentiator from its competition.
“The nuanced, every-single-word-is-massaged privacy policies that are overly vague, that intentionally introduce gray areas, that are commonplace among tech companies—that’s not our style,” O’Neill said.
When asked about how OneNote handles user privacy for machine learning, a Microsoft spokesperson refused to provide explicit details. The company’s privacy policy says that Microsoft collects data about users’ usage of OneDrive, which is used for cloud syncing of OneNote files, as well as the content they store inside of it.
A Google spokesperson didn’t offer details beyond the company’s privacy policy, either, which says that the company uses information that it collects to—among other things—improve and develop new services.
Apple didn’t respond to a request for comment, but its privacy policy says the company may also use personal information for internal purposes including “auditing, data analysis, and research to improve Apple’s products, services, and customer communications.”
Evernote’s reversal on its privacy policy means the company will have more to say about the specifics of its machine learning plans and user privacy in the future. At this point, the company is still working out what’s going to happen, including what this change means for Evernote Business customers. The company’s privacy policy won’t be amended yet.