7 ms·

Wait, what? Do you have more context? I hadn't heard about this.

by kylec 10y ago

taneq 10y ago
Basically their privacy policy has some very disingenuous wording which makes it sound like they are respecting your privacy, while retaining the right to sell it to third parties. The information they collect is listed quite openly in the first few sections of their privacy policy (link: https://www.pebble.com/legal/privacy https://www.pebble.com/legal/privacy ). It's pretty reasonable that the app needs local access to some of this information, less defensible that it accesses other information (geolocation information, unique device ID numbers, time spent in other apps on your phone?!) and not defensible IMO that they need to hoover it up off your phone. At least they're open about it. Note that they "maintain log files in identifiable form for a period of time for troubleshooting and other purposes" - this is stored in identifiable form indefinitely. The kicker is under "3. Information sharing and disclosure." > As we continue to develop our business, we may sell, buy, merge or partner with other companies or businesses, or sell some or all of our assets. In such transactions, user information may be among the transferred assets. Emphasis mine. Note the way this starts as if it's talking about mergers or acquisitions, then sneaks in "or we might just sell your information to anyone". This bullet point completely negates any restrictions on what they do with your data. (Throughout an 8-email exchange with one of their lawyers, they managed to completely avoid commenting on any issue I raised, despite ample opportunity to set me straight if I was simply misinterpreting the policy. I'm left with no choice but to assume my interpretation is correct and they have no respect whatsoever for their customers' privacy.)
- bigiain 10y ago
  Errrk. That's not good. I wonder if there's a reliable way to ensure the iPhone app cannot "phone home" ever? (Anybody want to make me an offer on a set of three Kickstarter Special Edition Pebbles? The original, the Time, and the new one I don't have yet?)
  - taneq 10y ago
    I was pissed enough about it to write my own Android app for it (I'd been meaning to play with Android dev for a while). It covers the basics (notifications, music player control, install/uninstall apps and watchfaces) but I never got around to more advanced stuff (Phone app integration, phone-side JS, interpreting the streaming data etc.) and they stopped documenting new features sometime around the release of 3.0 so no health integration. I've been meaning to tidy it up and post it somewhere, maybe this will give me some motivation.
    - bigiain 10y ago
      I'd be interested in seeing that if you do - the email in my profile works if you have a list of people to notify...
      - gb_dev 10y ago
        Shameless plug: on android you can use gadgetbridge ( https://github.com/Freeyourgadget/Gadgetbridge https://github.com/Freeyourgadget/Gadgetbridge ). Supports pebble (and miband) and is a complete replacement of the official app (you can setup the pebble after unboxing, upgrade firmwares, install apps and language packs). Functionalities are only limited by the lack of the internet access permission - it was left out on purpose - so things like voice dictation and some apps/watchfaces that need network access do not work. It is available on fdroid if you don't want to build it yourself!
        bigiain 10y ago
        Thanks! (And thanks for GPLing it, I probably won't port it to iOS, but it's nice to know you've chosen to let me if I want to...)
        gb_dev 10y ago
        It would be really cool if you could :) <insert thoughts about the GPL being the best fit for truly free/open source projects, left out because it would have probably started an off-topic flamewar/> Just for your information: our code implements the pebble protocol over BT classic, that is not allowed to run in background on iOS. The new devices (pebble 2 and pebble time 2) will use the same BLE/GATT protocol on android and iOS though: we will have to implement that too (uff ;-) ) but it will ease the life of a dev willing to port it to iOS.
bigiain 10y ago
Not sure what taneq was referring to - but I was very unpleasantly surprised the first time I got the "Pebble Health This Week" email showing me my sleep and step tracking for the last week from their cloud service. That's 100% not something I'd ever intentionally sign up to "share" - which means they either opted me in without consent, or used a dark pattern to trick me into consenting to something I wouldn't have if it'd been clear it meant my watch/app was going to send all my activity/movement data to "someone" with no way for me to know what they were gonna use it for or who they were gonna share it with. I didn't cancel my Kickstarter pledge (my third, I've got the original and the Time) - but I _very_ seriously considered it (and still might just flip it on eBay when it arrives)...
- taneq 10y ago
  Dark patterns: 1) They accept your order without even a mention of the T&C, EULA or privacy policy (at least as far as the checkout, I'm not putting my card number in to check for a popup during the payment process). 2) When you receive the product and go to install the app, in tiny print below the signup form they declare that by signing up, you accept the T&C. (This text is visible here: https://youtu.be/GAYL034-j0I?t=1m19s https://youtu.be/GAYL034-j0I?t=1m19s) 3) By accepting the T&C, you agree to the privacy policy linked from within the T&C. In my book, this is not acceptable behaviour.
- gb_dev 10y ago
  Pebble health data can be synced by gadgetbridge (see my other comment), but we have to adapt to every fw version that changes the message format. This has not yet happened for firmware 4 as we get it when it's publicly available like everybody else. The data synced by gadgetbridge never leaves your device (unless you export it, that is :-) )
- kylec 10y ago
  I don't wear my Pebble much, but your comment has reminded me that the app has read/write access to all the health data on my iPhone. It could have been secretly siphoning that data and uploading it for months without me knowing.

Wait, what? Do you have more context? I hadn't heard about this.

by kylec 10y ago

Wait, what? Do you have more context? I hadn't heard about this.

taneq 10y ago

Basically their privacy policy has some very disingenuous wording which makes it sound like they are respecting your privacy, while retaining the right to sell it to third parties. The information they collect is listed quite openly in the first few sections of their privacy policy (link: https://www.pebble.com/legal/privacy https://www.pebble.com/legal/privacy ). It's pretty reasonable that the app needs local access to some of this information, less defensible that it accesses other information (geolocation information, unique device ID numbers, time spent in other apps on your phone?!) and not defensible IMO that they need to hoover it up off your phone. At least they're open about it. Note that they "maintain log files in identifiable form for a period of time for troubleshooting and other purposes" - this is stored in identifiable form indefinitely. The kicker is under "3. Information sharing and disclosure." > As we continue to develop our business, we may sell, buy, merge or partner with other companies or businesses, or sell some or all of our assets. In such transactions, user information may be among the transferred assets. Emphasis mine. Note the way this starts as if it's talking about mergers or acquisitions, then sneaks in "or we might just sell your information to anyone". This bullet point completely negates any restrictions on what they do with your data. (Throughout an 8-email exchange with one of their lawyers, they managed to completely avoid commenting on any issue I raised, despite ample opportunity to set me straight if I was simply misinterpreting the policy. I'm left with no choice but to assume my interpretation is correct and they have no respect whatsoever for their customers' privacy.)

bigiain 10y ago
Errrk. That's not good. I wonder if there's a reliable way to ensure the iPhone app cannot "phone home" ever? (Anybody want to make me an offer on a set of three Kickstarter Special Edition Pebbles? The original, the Time, and the new one I don't have yet?)
- taneq 10y ago
  I was pissed enough about it to write my own Android app for it (I'd been meaning to play with Android dev for a while). It covers the basics (notifications, music player control, install/uninstall apps and watchfaces) but I never got around to more advanced stuff (Phone app integration, phone-side JS, interpreting the streaming data etc.) and they stopped documenting new features sometime around the release of 3.0 so no health integration. I've been meaning to tidy it up and post it somewhere, maybe this will give me some motivation.
  - bigiain 10y ago
    I'd be interested in seeing that if you do - the email in my profile works if you have a list of people to notify...
    - gb_dev 10y ago
      Shameless plug: on android you can use gadgetbridge ( https://github.com/Freeyourgadget/Gadgetbridge https://github.com/Freeyourgadget/Gadgetbridge ). Supports pebble (and miband) and is a complete replacement of the official app (you can setup the pebble after unboxing, upgrade firmwares, install apps and language packs). Functionalities are only limited by the lack of the internet access permission - it was left out on purpose - so things like voice dictation and some apps/watchfaces that need network access do not work. It is available on fdroid if you don't want to build it yourself!
      - bigiain 10y ago
        Thanks! (And thanks for GPLing it, I probably won't port it to iOS, but it's nice to know you've chosen to let me if I want to...)
        gb_dev 10y ago
        It would be really cool if you could :) <insert thoughts about the GPL being the best fit for truly free/open source projects, left out because it would have probably started an off-topic flamewar/> Just for your information: our code implements the pebble protocol over BT classic, that is not allowed to run in background on iOS. The new devices (pebble 2 and pebble time 2) will use the same BLE/GATT protocol on android and iOS though: we will have to implement that too (uff ;-) ) but it will ease the life of a dev willing to port it to iOS.

bigiain 10y ago

Not sure what taneq was referring to - but I was very unpleasantly surprised the first time I got the "Pebble Health This Week" email showing me my sleep and step tracking for the last week from their cloud service. That's 100% not something I'd ever intentionally sign up to "share" - which means they either opted me in without consent, or used a dark pattern to trick me into consenting to something I wouldn't have if it'd been clear it meant my watch/app was going to send all my activity/movement data to "someone" with no way for me to know what they were gonna use it for or who they were gonna share it with. I didn't cancel my Kickstarter pledge (my third, I've got the original and the Time) - but I _very_ seriously considered it (and still might just flip it on eBay when it arrives)...

taneq 10y ago
Dark patterns: 1) They accept your order without even a mention of the T&C, EULA or privacy policy (at least as far as the checkout, I'm not putting my card number in to check for a popup during the payment process). 2) When you receive the product and go to install the app, in tiny print below the signup form they declare that by signing up, you accept the T&C. (This text is visible here: https://youtu.be/GAYL034-j0I?t=1m19s https://youtu.be/GAYL034-j0I?t=1m19s) 3) By accepting the T&C, you agree to the privacy policy linked from within the T&C. In my book, this is not acceptable behaviour.
gb_dev 10y ago
Pebble health data can be synced by gadgetbridge (see my other comment), but we have to adapt to every fw version that changes the message format. This has not yet happened for firmware 4 as we get it when it's publicly available like everybody else. The data synced by gadgetbridge never leaves your device (unless you export it, that is :-) )
kylec 10y ago
I don't wear my Pebble much, but your comment has reminded me that the app has read/write access to all the health data on my iPhone. It could have been secretly siphoning that data and uploading it for months without me knowing.