Live data from Hacker News

The privacy problems hidden in your period tracker

bbc.com

41–50 of 73 posts

Re: The privacy problems hidden in your period tracker

#41
post #16

RudderStack founder here. Although the article doesn't accuse us of doing anything improper, we weren't contacted for comment, so I'd like to clarify our role. We are customer data infrastructure, not a data broker. We do not buy, sell or monetize the customer data that passes through our systems. Our role is analogous to infrastructure: customers choose what data to send, and RudderStack routes that data to the dest…

The article did not accuse you of anything and went so far as to say “There's nothing unlawful going on, and there's no reason to think RudderStack (or any company mentioned in this story) is doing something nefarious.” I’m struggling to understand why you would feel the need to comment. Or why you even think the BBC would have contacted you. This is one of those moments in PR where a response with no reason makes re…

I disagree. The article very clearly makes it sound like there is some reason RudderStack ought to be listed by name in the privacy policy of the Stardust app. When in reality, it would make no more sense to list them by name, than it would make sense to list AWS or CloudFlare or any other technical infrastructure through which customer data passes.

> Mozilla uncovered numerous privacy problems across various apps, but Stardust was the only one found sharing detailed reproductive health data with another company.

> The report found that Stardust sends users' health information to a data management company called RudderStack, which isn't named in its privacy policy. That data includes pregnancy status, birth control, moods, alcohol consumption and specific symptoms like tender breasts and stomach cramps.

> Companies often share data with outside services to process information and analyse user behaviour. There's nothing unlawful going on, and there's no reason to think RudderStack (or any company mentioned in this story) is doing something nefarious.

> However, experts say it's inherently risky when your data spreads to more places. It creates another opportunity for security breaches or legal requests for information. Besides, you may just be uncomfortable with another company seeing your health data.

> A Stardust spokesperson says the company only uses RudderStack as a "technical pipeline" to route data into its own analytics systems, and the app doesn't share anything that could allow RudderStack to identify your name or contact information. "Additionally, RudderStack is contractually prohibited from selling or using it for its own purposes," and RudderStack doesn't store the data long-term, the spokesperson says.

> "People deserve better," says Shoshana Wodinsky, a privacy research analyst who conducted Mozilla's tests. At the very least, she says, you should know what's happening.

Re: The privacy problems hidden in your period tracker

#42

I'm male, and clearly don't know enough about this--are there any benefits for the user that a period tracking app can provide by reaching out to the cloud? I guess backing up your data is an obvious one. I thought entering the information is like 90% of the tracking, everything else is mostly calculation/averaging and none of it needs to live on a server. The Euki app seems like my idea of what it would always be.

Yes, backing up is the most obvious reason to have it live on a server from the user POV. And of course the app vendor will want more lockin and be able to keep the data hostage.

Paying for apps doesn't help as much as expected, as they'll want to keep the revenue stream alive. Solving this conundrum would require to deal with both side of the coin.

The real solution to this would be to give everyone and their dog a standardised online server with legally enforced privacy, and have sandboxed apps manage data in and out in a interexchangeable format, but I feel like I'm asking for peace on earth.

PS: we have banks for money, there should really be something similar for data.

Re: The privacy problems hidden in your period tracker

#43

I'm male, and clearly don't know enough about this--are there any benefits for the user that a period tracking app can provide by reaching out to the cloud? I guess backing up your data is an obvious one. I thought entering the information is like 90% of the tracking, everything else is mostly calculation/averaging and none of it needs to live on a server. The Euki app seems like my idea of what it would always be.

If the vendors cared they'd encrypt it client-side and update at regular intervals so that whatever they stored on the servers was unreadable to them. My understanding is that this data isn't covered by HIPAA, which only covers licensed medical providers; you'd think that such personal information would automatically qualify for privacy protections, but [helpless shrug]

Re: The privacy problems hidden in your period tracker

#44
post #16

Earlier quoted context omitted.

The article did not accuse you of anything and went so far as to say “There's nothing unlawful going on, and there's no reason to think RudderStack (or any company mentioned in this story) is doing something nefarious.” I’m struggling to understand why you would feel the need to comment. Or why you even think the BBC would have contacted you. This is one of those moments in PR where a response with no reason makes re…

I disagree. The article very clearly makes it sound like there is some reason RudderStack ought to be listed by name in the privacy policy of the Stardust app. When in reality, it would make no more sense to list them by name, than it would make sense to list AWS or CloudFlare or any other technical infrastructure through which customer data passes. > Mozilla uncovered numerous privacy problems across various apps, b…

Even the statement, "RudderStack is contractually prohibited from selling or using it for its own purposes," implies that the "contract" is what prevents us from selling customer data. In reality, that's not our business model and not how we operate.

Granted, that statement came from our customer and not incorrect, but these small things can be mis-interpreted.

Re: The privacy problems hidden in your period tracker

#45

I'm male, and clearly don't know enough about this--are there any benefits for the user that a period tracking app can provide by reaching out to the cloud? I guess backing up your data is an obvious one. I thought entering the information is like 90% of the tracking, everything else is mostly calculation/averaging and none of it needs to live on a server. The Euki app seems like my idea of what it would always be.

Yes, backing up is the most obvious reason to have it live on a server from the user POV. And of course the app vendor will want more lockin and be able to keep the data hostage. Paying for apps doesn't help as much as expected, as they'll want to keep the revenue stream alive. Solving this conundrum would require to deal with both side of the coin. The real solution to this would be to give everyone and their dog a…

> PS: we have banks for money, there should really be something similar for data.

It's very hard to imagine a government who would have this too far up their list of priorities. Switzerland maybe. Then Germany, France. Maybe. It's hard to imagine it catching on between the monied interests who can influence government and the lack of consumer awareness of the problem it is solving.

Re: The privacy problems hidden in your period tracker

#47

I'm male, and clearly don't know enough about this--are there any benefits for the user that a period tracking app can provide by reaching out to the cloud? I guess backing up your data is an obvious one. I thought entering the information is like 90% of the tracking, everything else is mostly calculation/averaging and none of it needs to live on a server. The Euki app seems like my idea of what it would always be.

Yes, backing up is the most obvious reason to have it live on a server from the user POV. And of course the app vendor will want more lockin and be able to keep the data hostage. Paying for apps doesn't help as much as expected, as they'll want to keep the revenue stream alive. Solving this conundrum would require to deal with both side of the coin. The real solution to this would be to give everyone and their dog a…

Not quite what you're suggesting, but at least Nextcloud (and other open self-hosting platform) servers are a thing.

All you need is for the app to provide the option of saving to local storage – your cloud server software provides a local storage endpoint and does the rest.

Re: The privacy problems hidden in your period tracker

#48

I would never trust any private health data to an app. I don't care what promises or claims they make. The technology is fundamentally untrustable, and even if a vendor is doing the right thing today, they (or any intermediary) could change tomorrow.

> even if a vendor is doing the right thing today,

... they could fail to realize that they were hacked last year.

Sadly, the same issues apply to the copies of your private health data in your doctor's computer, your insurance company's computer, your hospital's computer, your pharmacy's computer, etc.

Avoiding the app reduces the attack surface. With the minor moral victory of not having gone out of your way to make it easy for the enemies of your privacy.

Re: The privacy problems hidden in your period tracker

#49

I'm male, and clearly don't know enough about this--are there any benefits for the user that a period tracking app can provide by reaching out to the cloud? I guess backing up your data is an obvious one. I thought entering the information is like 90% of the tracking, everything else is mostly calculation/averaging and none of it needs to live on a server. The Euki app seems like my idea of what it would always be.

Yes, backing up is the most obvious reason to have it live on a server from the user POV. And of course the app vendor will want more lockin and be able to keep the data hostage. Paying for apps doesn't help as much as expected, as they'll want to keep the revenue stream alive. Solving this conundrum would require to deal with both side of the coin. The real solution to this would be to give everyone and their dog a…

> PS: we have banks for money, there should really be something similar for data.

There is, but the majority of HN participants hate the existing banks with a white-hot passion, and rail against those banks, and prefer to store their cash under their mattress, and their photos in Chad's garage, and they actively discourage everyone else from trusting banks, especially the biggest ones.

Re: The privacy problems hidden in your period tracker

#50

Earlier quoted context omitted.

Yes, backing up is the most obvious reason to have it live on a server from the user POV. And of course the app vendor will want more lockin and be able to keep the data hostage. Paying for apps doesn't help as much as expected, as they'll want to keep the revenue stream alive. Solving this conundrum would require to deal with both side of the coin. The real solution to this would be to give everyone and their dog a…

> PS: we have banks for money, there should really be something similar for data. There is, but the majority of HN participants hate the existing banks with a white-hot passion, and rail against those banks, and prefer to store their cash under their mattress, and their photos in Chad's garage, and they actively discourage everyone else from trusting banks, especially the biggest ones.

I don't think "majority", although the word might describe certain topics/threads that have a bit of selection-bias.
Post reply on HN