block-nuke-telemetry/EULA-Analysis.md

Foundry EULA Telemetry Analysis

Tags: #note-type/research #domain/technical #project-type/technical #status/complete #priority/high

Summary

The Foundry EULA explicitly authorizes extensive data collection from your computer and network. Your network captures confirm this telemetry is actively happening, though the actual data volume appears more modest than the EULA permits.

Key EULA Clauses (Sections 19.2 & 19.3)

What Foundry Claims to Collect (Clause 19.2)

The EULA states the Software "may include mechanisms to access and collect limited information" including:

1. License details - Foundry product licenses on your system
2. Computer and network equipment details - Hardware specifications
3. Operating system details - OS version, system registry files
4. Email domain - Domain of computer/network equipment owners
5. Location data - Geographic location of computers running Software
6. Usage profiling - "Profile and extent of use" of Software features

How Foundry Uses This Data (Clause 19.2)

The EULA permits use of collected data for:

(a) Usage modeling - "model the profiles of usage, hardware and operating systems in use collectively across its customer base in order to focus development and support"

(b) Targeted support - "provide targeted support to individual customers"

(c) License enforcement - "ensure that the usage of the Software by Licensee is in accordance with the Agreement and does not exceed any user number or other limits"

(d) Anti-piracy - "confirm the identity of Licensee, to identify unlicensed use of the Software (including use of pirated or other unlicensed copies of the Software) and to assist Foundry (and its resellers and any enforcement bodies) in contacting any unlicensed users"

(e) Service notifications - "advise Licensee about service issues such as available upgrades and maintenance expiry dates"

Critical Authorization (Clause 19.3)

"By downloading or using the Software, you [...] irrevocably authorise Foundry (through the use of the Software) to access such computer(s) and IT systems (including any system registry files) and collect the Information from them and to transmit that Information to Foundry and its resellers (and any enforcement bodies)"

Key points:

• Authorization is irrevocable (you can't take it back)
• Applies to "IT systems" plural - potentially your entire network
• Data shared with "resellers and enforcement bodies"
• Access includes system registry files

Network Capture vs EULA Claims

What We Observed (20-minute capture)

Connection	Purpose	EULA Justification
api.honeycomb.io (17KB, HTTPS)	Usage telemetry, performance metrics, error tracking	Clause 19.2(a) - usage modeling
learn.foundry.com (HTTP, unencrypted)	Documentation availability checks, version reporting	Clause 19.2(e) - service notifications
sentry.foundry.com (process found, not active)	Crash reporting, error dumps	Clause 19.2(b) - targeted support

What We Did NOT Observe (But EULA Permits)

• Email domain collection
• Geographic location transmission
• System registry file access/transmission
• License enforcement data to "enforcement bodies"
• Network equipment enumeration

This doesn't mean it's not happening - these could occur:

• During startup/shutdown (we didn't capture these)
• Periodically (longer than 20-minute window)
• Only when triggered (crashes, license checks)
• In the encrypted Honeycomb payload (we can't see inside)

Privacy Concerns

🚨 Major Issues

1. Unencrypted HTTP

• learn.foundry.com uses HTTP (port 80), not HTTPS
• Exposes Nuke version, IP address, and usage patterns to ISP/network observers
• Violates basic security best practices for data transmission

2. No Opt-Out

• EULA states authorization is "irrevocable"
• No telemetry toggle found in Nuke preferences
• Accepting EULA = accepting all data collection

3. Broad Scope

• "IT systems" (plural) - could mean entire network, not just one computer
• System registry access - can contain sensitive paths, usernames, installed software
• "Enforcement bodies" - unclear who this includes (lawyers? investigators? police?)

4. Third-Party Sharing

• Data shared with "resellers" (potentially dozens of companies worldwide)
• Honeycomb.io is a third-party SaaS platform (data leaves Foundry's control)
• Sentry is another third-party service

5. Location Tracking

• EULA permits collection of "location of the computer(s)"
• Could be used to enforce geographic licensing restrictions
• Potential violation of local privacy laws depending on jurisdiction

⚠️ Moderate Concerns

6. Usage Profiling

• "Profile and extent of use" - tracks which features you use, how often, for how long
• Could reveal workflow patterns, project types, professional activities
• Combined with location data = detailed professional surveillance

7. License Enforcement Priority

• Anti-piracy purpose (19.2d) gives Foundry incentive to collect more data than needed
• "Enforcement bodies" suggests potential legal action based on telemetry

8. Indefinite Retention

• EULA doesn't specify how long data is kept
• No mention of data deletion upon license termination

✅ Positive Observations

9. Limited Actual Volume

• Only 32KB over 20 minutes observed
• Not "constantly phoning home" during normal use
• Most telemetry uses HTTPS encryption

10. GDPR Compliance Claim

• Clause 19.2 references GDPR and Privacy Notice
• Suggests some legal compliance framework exists

Legal Analysis

Binding Nature

The EULA header explicitly states:

"YOUR ATTENTION IS PARTICULARLY DRAWN TO [...] (D) CLAUSE 19.3 WHERE YOU AUTHORISE FOUNDRY TO USE THE SOFTWARE TO ACCESS AND COLLECT CERTAIN INFORMATION FROM YOUR COMPUTER NETWORKS AND TO TRANSMIT THIS INFORMATION TO FOUNDRY."

By using Nuke, you've legally consented to:

• Remote access to your computer and IT systems
• Collection and transmission of system information
• Sharing data with third parties (resellers, enforcement bodies)
• Irrevocable authorization (can't withdraw consent)

Potential Legal Issues

1. Computer Fraud and Abuse Act (CFAA) - USA

• Authorized access exempts Foundry from CFAA liability
• But: authorization must be "knowing and voluntary"
• Question: Is burying this in page 8 of EULA sufficient notice?

2. GDPR - EU/UK

• EULA claims GDPR compliance
• But: GDPR requires explicit, informed, freely given consent
• Question: Is acceptance of entire EULA valid consent for data processing?
• Question: Can you use Nuke without consenting? (No = not "freely given")

3. CCPA - California

• Right to know what data is collected
• Right to deletion
• Right to opt-out of sale
• EULA doesn't clearly provide these rights

4. Network Administrator Concerns

• Clause 19.3(i): "warrant that you are entitled to control access to the computer(s)"
• If you're on a company/studio network, do you have authority to consent to Foundry accessing the entire network?

Recommendations

1. Block Telemetry (Most Effective)

Use the provided blocking script:

./block_nuke_telemetry.sh

Legal consideration: EULA clause 3 prohibits "circumvent[ing] the license keys or other copy protection mechanisms" - but telemetry blocking is NOT bypassing license protection, just data collection. This should be legally defensible.

2. Network Isolation

Run Nuke on isolated network segment:

• No access to broader IT systems
• Firewall rules blocking Foundry domains
• Limits EULA clause 19.3 exposure to "IT systems"

3. Monitor Ongoing (What You're Doing)

Use monitoring scripts to track:

• What data is actually transmitted
• When it's transmitted
• Volume and frequency
• New domains/endpoints

4. Request Data Under GDPR/CCPA

If you're in EU/UK/California:

Subject Access Request to: privacy@foundry.com

"Under [GDPR Article 15 / CCPA Section 1798.100], I request:
1. All personal data you hold about me
2. Categories of data collected via telemetry
3. Third parties with whom my data has been shared
4. Purpose and legal basis for processing
5. Deletion of all data not required for license validation"

5. Corporate/Studio Users

If using Nuke in a business:

• Review with IT security team
• Assess EULA clause 19.3 network access authorization
• Consider contractual negotiation for enterprise licenses
• Implement network monitoring at perimeter

6. Raise Awareness

• Post findings to VFX communities (od|force, Reddit r/vfx, etc.)
• File feature request with Foundry for telemetry opt-out
• Consider alternatives (DaVinci Resolve Fusion, Natron, etc.)

Conclusion

Your suspicions were correct. The EULA explicitly authorizes:

• Remote access to your computer(s) and IT systems
• Collection of usage data, system information, and location
• Transmission to third parties including "enforcement bodies"
• Irrevocable consent (no opt-out)

What we observed in network captures:

• Confirms telemetry is actively occurring
• Volume appears modest (32KB/20min)
• Some traffic unencrypted (learn.foundry.com)
• Main analytics encrypted via Honeycomb

The real concern: We can only see metadata of encrypted connections. The actual data payload to Honeycomb could include everything the EULA permits:

• System registry dumps
• Hardware enumeration
• Software inventory
• Usage patterns
• Location data

Bottom line: Foundry has granted themselves broad surveillance rights through the EULA. Whether they fully exercise these rights is unknown. Blocking telemetry is legally defensible and recommended for privacy-conscious users.

---

Created: 2025-10-25 Related: nuke_foundry_analysis, block_nuke_telemetry.sh, monitor_nuke_telemetry.sh