mrkvon
commented
7 years ago Still WIP and messy. Already some insight.
https://onesignal.com/privacy_policy https://onesignal.com/tos
Disclaimer: I'm not a lawyer. I'm a dilletante. I don't fully understand the legal context of the research.
TLDR
onesignal.com collects a lot of data, including email addresses, location, behaviour, probably also the text of the notifications users receive. They try to label the users (i.e. sports fan if you're often around stadiums (how far can this go?)) and predict their behaviour.
They make money by selling the data to their Clients (i.e. to ad companies for making personalized advertising).
They will keep the data as long as they need to meet their purposes.
To say something nice: At least they are quite clear about their attitude in their Privacy Policy. With examples etc. They're rather foggy about it in their FAQ, though.
The questions by @chmac
- I haven't found any mentions about EU Law in Privacy Policy nor ToS.
- They don't force you to provide any info. They get the data when you use the service.
- I haven't found any promise to not sell personal info (look better?). On contrary they sell data i.e. so the clients may do targeted advertising. I'll look for more detail later.
My impression?
I advise not to use this service. I would not choose them for my projects. I perceive them as Big Brother Service. However, i'm rather sensitive to this, so you better make your own judgement.
Slightly more detail
Users = us Clients = brands, ad companies, the ones who pay
-
They collect email addresses, location (mobile location or IP address geolocation), all kinds of system information and configuration, unique identifiers, info about apps people use, how people interact with the apps (timestamps).
-
They collect push notifications which people receive. Would this include the peoples' conversations from email notifications?
-
They label users: i.e. if you're often near sport stadium, you'll become a "sport fan". (Isn't this one creepy?)
-
They try to predict what users will do in future
-
They or their clients (the ones who pay for the data) may connect the data, match ip addresses, email addresses and other info across devices etc.
-
They say they generally hash the email addresses when they provide them to Clients, but don't promise they will.
-
They don't promise anonymization.
Detail with quoting (read the bold text for overview)
SDK - software development kit End Users - trustroots members Clients - onesignal's partners, advertisers, ... (the bodies who want the data)
What they collect
Web SDK
- Web pages visited that have implemented the SDK, and information about those visits (e.g., session duration, time-stamp, referring URLs)
- What push notifications an End User has been sent (is this the actual text of notification, or not? I.e. text of the messages?)
- ... transactions and interactions with apps and websites IP address, from which geographic location may be inferred, as well as system configuration information Email address which we may (in our discretion) hash or otherwise deidentify (they don't promise the deidentifying though!) ... browser [info], such as, browser language type and version of operating system (e.g., Android, iOS); network provider; language setting; time zone A unique cookie identifier, which may uniquely identify an End User (such as in de-identified or anonymous form).
Mobile SDK
[installed] Apps ... [and some usage info] Purchases made within an app. ... transactions and interactions with apps and websites Mobile advertising identifiers, such as iOS IDFAs and Android Advertising IDs (“Mobile IDs”). (They may associate these ids with other data.) Precise Location information, generally an End User’s lat/long data (i.e., GPS-level data) or WiFi information, which we may associate with Mobile IDs, and which may be collected whether or not an app is in use. Email address ... IP address ... [system configuration information] Information associated with or related to devices, such as device type (e.g., mobile, tablet); type and version of operating system (e.g., Android, iOS); network provider; mobile browser (e.g. Safari, Chrome, etc.); language setting; time zone; and network status type (such as WiFi).
How they use it
TODO - they give a lot of detail.
To Provide Services to Marketers, Advertisers and Platforms They Work With
simison
nicksellen
chmac
Would be great to get a clear, concise summary of: