Androidacy Module Manager (com.fox2code.mmm.fdroid) may have ads and be nonfree due to mandatory EULA

In order to use this application, the onboarding screen requires accepting an EULA, in addition to the LGPL-3.0. This EULA may be fine as a ToS for the repositories involved (at least the ones Androidacy has authority on), but problematically, it also makes several references to what can and cannot be done using "the Licensed Application".

The EULA page is lovely, for a start: it contains a notice

This article is supported by ads. Please consider subscribing to Ad-Free or Premium to remove ads, get unlimited downloads, and more.

So before coming to the issue of freedom, something about ads: should https://f-droid.org/en/docs/Anti-Features/#Ads be added? Also according to this forum post, there are "ads that pop up in your face, when you try to click download", which I couldn't reproduce because I'm honestly not giving this app root access; however, when I go to a module's page in their default repository, I do get a cookie banner and a notice "You have 9 downloads left today. Please subscribe to Premium or higher to remove ads, get unlimited downloads, and more". On the app's Github page, it is stated

[...] The official Androidacy repository. May display non-intrusive ads.

I think "their official repository", endorsed by them in the app with the words "backed by Androidacy" (albeit disabled by default like everything else) shouldn't display ads without a corresponding anti-feature. Sure, it's technically just a webpage, but pretty integrated... all in all, I'd say the word "ads" is in a bit too many places in this app and the Ads anti-feature might well be warranted.

The potential problem with ads would only require an anti-feature, though; but the EULA itself worries me more, as it contains, under the heading "The Application" or with the term "the Licensed Application" (so, clearly, not a ToS for the service, but an additional license for the app itself), requirements like:

The Licensed Application is not tailored to comply with industry-specific regulations (Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), etc.), so if your interactions would be subjected to such laws, you may not use this Licensed Application. You may not use the Licensed Application in a way that would violate the Gramm-Leach-Bliley Act (GLBA).

This restricts my permission to use the application even though I don't live in any jurisdiction where those Acts would have any bearing. As such, I see it as squarely hindering Freedom 0. As accepting this EULA is mandatory to get past the onboarding screen, I do not really see how F-Droid can include this app unless this EULA is rectified, removed, made non-mandatory, or changed to be limited to the services offered and not the app itself, where it acts as an additional license to the LGPL.

It may be worthwhile to reference #2893 (closed) for a similar issue in another application and how it was eventually solved.

Other potentially problematic passages I've seen in the license:

You acknowledge that Licensor will be able to access and adjust Your downloaded Licensed Application content and Your personal information, and that Licensor's use of such material and information is subject to Your legal agreements with Licensor and Licensor's privacy policy: https://www.androidacy.com/privacy/.

You acknowledge that the Licensor may periodically collect and use technical data and related information about your device, system, and application software, and peripherals, offer product support, facilitate the software updates, and for purposes of providing other services to you (if any) related to the Licensed Application. Licensor may also use this information to improve its products or to provide services or technologies to you, as long as it is in a form that does not personally identify you.

This seems to say that they can update your Licensed Application themselves, without your consent, which I believe is against F-Droid policies (second "Additionally" point). It also grants themselves the right to access some unspecified "personal information" of mine, which I certainly do not want to grant, at least not without a Tracking feature back, and an assurance it doesn't happen by default.

However, It is important to note that the preamble of this EULA does state

By downloading the Licensed Application from Google's software distribution platform ("Play Store"), and any update thereto (as permitted by this License Agreement), You indicate that You agree to be bound by all of the terms and conditions of this License Agreement, and that You accept this License Agreement. Play Store is referred to in this License Agreement as "Services."

On the surface, this would mean that if I've downloaded the app not from Play, but from F-Droid, then I'm not bound to the agreement. But see the comment below on this. I feel "legally" (IANAL) very uncomfortable with this: I still have to explicitly "accept the EULA" by tapping a checkbox before I can continue using the app. A judge might argue that the EULA is crafted for Play and Google because that's the main distribution channel. Is that the case? I simply do not know that, and neither might the judge.

Even then, there is no reason we should tap the box to accept the EULA on the F-Droid version if that EULA is not meant to be legally binding to us. One might reason that the part of is that acts more like a ToS would still be binding, but... the way it's worded about Play, the EULA either applies in its entirety or not at all! So that's not a sound reasoning either.

All in all, that for this app to be safely considered free software, I really think this rather user-hostile EULA should go, or be changed radically, and not hosted somewhere I can't even access with JavaScript off... or even be allowed to copy text from using standard copy/paste functionality to discuss these very issues (come on!).

Edited by Lorenzo Lucchini