A Look at Privacy Policies and practices
On this page, I’ll be taking a look at the privacy policies and practices from a range of companies (mostly tech, but occasionally some others), and offering my opinions on how trustworthy they are. I started with a few of the apps I use, and will be adding more over time. Each entry includes a ranking of how user-friendly it is on a scale of 1-10, a recommendation of how/if you should use that company’s services (based on the value of the services provided contrasted with the user-friendliness of their privacy policies), and any specific aspects of the policy worth noting. If you’d like to request that I review a company’s privacy policy not yet listed here, or have questions about a policy I’ve already reviewed, use the contact form on the “About” page to reach out!
I obviously can’t make any guarantees about these companies or their privacy policies, and you should always read for yourself any privacy policies to which you consent.
NOw, let’s get private 😏
Amazon has absolutely no problem with targeted advertising, and their privacy policy was difficult to read. They tease out a lot of the less flattering aspects of their privacy policy, instead electing to make several incomprehensive policies that must be read in conjunction with one another. Want to know what they’re sharing with third party advertisers? There’s a separate policy for that. Want to know what your Echo devices are doing with the recordings Alexa collects? Separate policy. Even combined, Amazon’s policies don’t offer much detail. The vagueness seems to suggest they’re hiding something; they’ve certainly given themselves the legal operating space to do so.
Android
2/10
10/20/19
Android is owned by Google, and is governed by their privacy policy. For more information, see my analysis of Google’s privacy policy.
Apple has a terrific track record when it comes to privacy issues. Their privacy policy could be better if it were written in more plain language, but they make up for the rather dense legalese in the privacy policy by providing a robust and easy to understand privacy website that outlines their customer data protection practices. As demonstrated by their commitment to encrypting iMessages and iCloud data, sandboxing third party apps, provided services like Apple Pay, and standing up to unjust government data requests, it’s clear that they’re the only big tech company that truly cares about protecting their users.
This isn’t great, especially for a bank. They admit to sharing medical information from their insurance customers with other companies. They also use your transaction history and other personal information for advertising purposes (of course, this means that they’re sharing that information with advertising companies, where it is governed by their privacy policies). Their privacy policy sucks in general, but even more so for a financial institution, and they want you to jump through hoops to have any real control over your data (like, they want you to send them letters through the mail rather than having an email option).
Dark Sky impressed me. Weather apps are particularly sensitive, because they require unbound access to your location to work properly and send you notifications, and we’ve seen plenty of weather apps abuse the privileges they’re granted (see: Weather Bug). Dark Sky is probably one of the only ones that doesn't seem like they intend to abuse your location data. They do use all sorts of tracking and cookies on their website, but I don’t know of anyone who uses their website over their app. This one is safe to use without taking any specific precautions.
DuckDuckGo’s privacy policy is summed up in one short sentence: "DuckDuckGo does not collect or share personal information". The rest of the policy is explaining why they do things differently than other search engines and why you should care. This is really the gold standard; they don’t save any of your personal information, and therefore are incapable of sharing it. Now compare that with Google, who saves every term you search, puts it in a neat little package with your name, account info, and IP address, and then shares that package with pretty much whoever asks for it. I have been using DuckDuckGo as my deafult search engine or years, and I would recommend that everyone switches from Google to DDG. If you have an Apple device, you can change the default search engine for Safari in Settings.
ESPN
7/10
10/5/19
ESPN is owned by The Walt Disney Company, and is governed by their privacy policy. For more information, see my analysis of The Walt Disney Company’s privacy policy.
ExpressVPN is doing the lord’s work. They go out of their way to protect your privacy, never collecting any info about your web traffic or anything else that you do while using their service, and they never share anything with advertising companies. They even relocated their company to a country with better consumer privacy laws to protect your data from prying governments. I would highly recommend their VPN service.
Let us first note that Facebook is the only company I’ve reviewed who didn’t put a link to their privacy policy on the front page of their website, instead making it nearly impossible to access by sending you down a rabbit hole of community help forums. I had to use a search engine to even find their privacy policy, which they have conveniently renamed “Data Policy” to make things even less clear. I’ll just hit some of the highlights. They scrape all the text messages from your phone. The save all of the contacts in your phonebook, even if your contacts don’t use Facebook (this helps them construct their shadow profiles). They record everything you do through the Facebook app’s built-in camera. They collect biometric data to identify you via facial recognition. They collect device information about other devices on your network. Any website with a Facebook or Instagram like or share button sends information about what you do on that site (website or search history, transaction info, etc.) to Facebook, even if you don’t have a Facebook account. And to top it all off, they have a long list of entities with whom they may share this information. The best recommendation I can make is to permanently delete your Facebook account. #deletefacebook
I really ought to temper my expectations for financial institutions. I’m starting to wonder if there are any banking options that aren’t going to sell your transaction data to advertising companies; even if it is anonymized like they claim, they still make it hard, and in some cases impossible, to opt out of this sharing.
You can play 8-Ball with your iMessage buddies in peace — Game Pigeon doesn’t seem to be collecting any information they shouldn’t be.
Google’s business model depends on them collecting such massive amounts of data that there’s almost no way they could’ve had a privacy policy strong enough to suggest that they’re sufficiently protecting that data, and they don't. They store any data you create with or upload to your google account (all your photos, every email you send or receive, all the documents you have in Docs, Sheets, and Slides, your entire Google Drive, everything). They also collect information about what you do on the internet, including what ads you see and interact with, which websites you visit, all of your search terms, all the YouTube videos you watch, and who you communicate with. If you have Google apps on your phone, tablet, or laptop, depending on your device settings, they can save audio and video recordings. If you have an Android device, they can do all that and more, including periodically logging what apps you use on your phone. This gives them a ton of Information, which they use to create profiles for all of their users, and then use those profiles for targeted advertising; they then tailor your search results to achieve maximum engagement (the more links you click, the more money they make), censoring your search results for the sake of their own bottom line. They even assist other companies seeking to track users across the internet with their Google Analytics service. If you have google accounts that you don’t have to have because they’re given to you by your school or company, delete them. This is one of the worst companies you could chose to trust with your data.
I was really impressed by Grindr as well. I expected to find a pile of hot garbage instead of a privacy policy, but it seems like they take a decent amount of care in keeping their users’ information restricted to a need to know basis, and they’re particularly careful when it comes to health and identity related information (HIV status, “tribes,” etc). That said, I would still recommend changing the location settings to only allow access while you’re using the application, as opposed to giving them constant access.
Hinge
8/10
9/2/19
Hinge is owned by Match Group, and is governed by their privacy policy. For more information, see my analysis of Match Group’s privacy policy.
0/10
9/4/19
Instagram is owned by Facebook, and is governed by their privacy policy. For more information, see my analysis of Facebook’s privacy policy.
I know a lot of parents love this app because it allows them to keep track of their teenagers, and I don’t really think that a lot of the functionality it provides in the first place is appropriate, but you can read more about that here. In regards to their privacy policy, it’s atrocious. They track all sorts of information they have no reason to be logging, including detailed location data for your whole family, and then they share that info with advertisers and insurance companies. I can’t stress this enough: delete Life360. If you need a way to stalk your kids, use Apple’s built in ‘Find My’ apps; they don’t offer as much intrusive data (like the speed someone is driving), but they will still let you see where they are, and as long as they’re somewhere safe, that’s all you really need to know.
I enjoy using Lose It!, especially when I’m focused on a health goal, so it was nice to find out that they aren’t abusing the sensitive health data to which their users give them access.
I don’t use Match.com, nor do I know anyone who does, but tons of people use their other services like Tinder and Hinge, so it was worth checking into. Honestly, this privacy policy was pretty good. It seems like the biggest danger here is what other users of the service could do with the information you make publicly available.
MyFitnessPal
1/10
10/21/19
MyFitnessPal is owned by Under Armour, and is governed by their privacy policy. For more information, see my analysis of Under Armour’s privacy policy.
This one isn’t pretty. They pretty much say they’re going to sell your data to whoever they want, which is concerning given the personal nature of the data they have access to (watch history, interests, etc). I won’t be using Netflix as much going forward. And I certainly won’t be using it on any devices that have Netflix built in (namely smart tv’s) without carefully reading the manufacturer's privacy policies as well, because Netflix admits that those manufacturers are given nearly-unfettered access to most of the data Netflix collects. At this point, I’d only use it on an Apple TV, through the iOS and Android apps, or through a web browser. Definitely no smart tv’s.
This is a great, fully capable photo editing app that you sent have to worry about.; they essential collect no personal information at all. This is as good as it gets.
I wasn’t terribly impressed with this one, but it wasn’t awful. I would say the best course of action here is to try and use it sparingly, or at least make sure you’ve tightened down the privacy settings they offer.
They don’t have much going for them. There isn’t much information they aren’t willing to sell to other companies. If you’re going to keep this app, at least change the location permissions to only allow access while using the app.
SleepWatch has a pretty good privacy policy. I was pleased to see that none of the data they use to process your sleep patterns is shared with any third parties, and if you use the iOS app, you should be safe to use their app without fear.
This one was pretty middle of the road. Ultimately, I think it’s probably best to reduce your use of Snapchat and other Snap services where possible, but I don’t think you need to jump ship altogether. I didn’t delete the app or my account, but I’m now using iMessage for a lot of conversations I used to use Snapchat for.
Squarespace is alright. They aren’t super protective of your information but it doesn’t seem like they’re going out of their way to screw you over.
Not terrific. They’re pretty willing to sell you out, as well. I didn’t delete this app, but I don’t use it anymore unless the line to order at the drive thru or inside is insanely long. And be sure to set the location permissions to ask every time they want your location, rather than giving them more generous access.
I was extremely disappointed by Target. They’re my favorite store in the world, but after reading this hot mess, I’m not sure if I’ll even go back. I certainly won’t ever use their in-store Wi-Fi, because they admit to logging every website you visit and everything you search for. They also admit to combining that information with the data they have about your purchases and searches on their website and in their apps to create comprehensive profiles of their customers. They then sell those profiles to other companies to use however they want. They also admit to collecting biometric data from facial recognition cameras in their stores. It’s outrageous. I deleted the Target app from my phone, and I’d encourage you to do the same. IF I go back to a Target store, I’ll be wearing a mask and paying with cash.
If you’re like me, you may have on or two tiles that you use maybe once a month when you can’t find your keys. The trackers aren’t very accurate, and the batteries die after a year and you have to replace the whole tile, which is $25+. The app sends your location data and personal info (sometimes anonymized, sometimes not) to Facebook to use for advertising. The only way to stop this sharing is to delete your account and stop using your tiles. So, that’s what I’m gonna do. The service that the Tile trackers provide simply isn’t worth the data you’re providing them.
Tinder
8/10
9/2/19
Tinder is owned by Match Group, and is governed by their privacy policy. For more information, see my analysis of Match Group’s privacy policy.
Tumblr isn’t terrible, but it’s a bit messy. It’s another case where anything you make public is out there forever. In addition to that, they also aren’t particularly reassuring that one of the companies affiliated with them (of which there are many, including Yahoo! and Verizon, because they keep getting bought) aren’t going to do something shady with your personal information.
Twitter does engage in targeted advertising, and there is a vast multitude of ways that they collect the data they use and share for such purposes. On the bright side, they do claim that they don’t use any information related to your sex life, political beliefs, religion, or race for targeted advertising. While their privacy policy is easy to read, it was rather long, which makes it a bit less readable. Despite the fact that the policy itself isn’t extraordinarily alarming, the fact that Twitter keeps having “accidents” where they use personal data for advertising that users didn’t agree to must be taken into account when judging their privacy practices.
Under Armor
1/10
10/21/19
Under Armor offers a few online services that people use to track their health and fitness, most notably an app called MyFitnessPal. Their privacy policy was extremely long and vague, but it explains that they DO use your private data (fitness goals, height, weight, measurements, fitness level, heart rate, sleep data, BMI, biometric data) for serving targeted ads, which is a huge problem. If you use MyFitnessPal, stop. I personally like the Lose It! app, and they do their due diligence to protect your privacy. If you just like their clothes, buy them in stores, don’t shop their website.
This one is hard because Verizon is generally acknowledged to have the best wireless coverage, but there are some really concerning aspects of their privacy policy. They have access to almost everything you do on your phone. Every website you go to, every call you make or receive, your location, every SMS text message you send or receive (if you have an iPhone, always use iMessage when possible; Apple encrypts iMessage messages so that carriers can’t see them). Verizon also shares your name and phone number with directory and caller ID companies, which then make that information available publicly. If you have Verizon, go to your account privacy settings and restrict them as much as they’ll allow you to. Definitely don’t sign up for any of their programs that seem to give you free stuff.
Walmart
5/10
10/25/19
Walmart does use targeted advertising based on your purchase history, so my recommendations for Walmart shoppers are as follows: don’t use their in-store Wifi, only use the store pickup option if you absolutely have to, pay with cash (since they don’t accept Apple Pay), and don’t participate in programs like Savings Catcher (now retired), eReceipts, or any other thing that is supposed to save you money by showing them everything you purchase and allowing them to connect it to your online account. Another point to note — there are some instances where your information may be governed by separate privacy policies, including their health services (clinics, pharmacies, vision centers, etc.), financial services (layaway, credit offers, etc.), licensing services (hunting and fishing licensing), etc.
The Walt Disney Company owns a lot of companies, including all of the Disney-named companies, obviously, but also others like ESPN, ABC, and more. The only Walt Disney company I have any regular interaction with is ESPN, and I don’t need an account to set favorite teams and get score alerts, so they aren’t able to collect a ton of personal information from me, but if you do need an account for whatever Disney services you’re using, be sure to restrict the information they can collect, because they do use it for targeted advertising.
Waze
2/10
10/20/19
Waze is owned by Google, and is governed by their privacy policy. For more information, see my analysis of Google’s privacy policy.
0/10
9/4/19
WhatsApp is owned by Facebook, and is governed by their privacy policy. For more information, see my analysis of Facebook’s privacy policy.
As a health company, it’s important that Withings respects the data they’re processing, and based on their privacy policy, they do.