5 ms·

Unroll.me

126 points by nav 9y ago

merricksb 9y ago
Active discussion: https://news.ycombinator.com/item?id=14181152 https://news.ycombinator.com/item?id=14181152
HappyTypist 9y ago
I looked on their website, Frequently Asked Questions, and even hovered over text like "Unroll.me is a free service" in order to find a disclosure. I could not find ANY disclosures whatsoever. Nowhere does Unroll.me disclose that they sell your emails to the highest bidder. I wish we had a FTC that could bankrupt Unroll.me's previous and current founders and executives. Absolutely despicable behaviour.
- gdulli 9y ago
  You can't sign up for the service without agreeing to the privacy policy, which is where you should expect privacy-related concerns to be discussed.
- eganist 9y ago
  Terms of Service pointed me to their Privacy Policy. Privacy Policy indicated the following: > We also collect non-personal information − data in a form that does not permit direct association with any specific individual. We may collect, use, transfer, sell, and disclose non-personal information for any purpose. For example, when you use our services, we may collect data from and about the “commercial electronic mail messages” and “transactional or relationship messages” (as such terms are defined in the CAN-SPAM Act (15 U.S.C. 7702 et. seq.) that are sent to your email accounts. We collect such commercial transactional messages so that we can better understand the behavior of the senders of such messages, and better understand our customer behavior and improve our products, services, and advertising. We may disclose, distribute, transfer, and sell such messages and the data that we collect from or in connection with such messages; provided, however, if we do disclose such messages or data, all personal information contained in such messages will be removed prior to any such disclosure. Damningly, if they're collecting and disclosing transaction details, they're also technically conveying personal information given the ease by which identities can be reversed from this sort of data.
jbmorgado 9y ago
If you have ever used the service, it probably has still almost full access to your gmail account (I noticed it had in mine). You can remove its authorisations at: https://myaccount.google.com/permissions https://myaccount.google.com/permissions
- hoektoe 9y ago
  Thanks for the link for the lazy
nhangen 9y ago
I don't find the practice ethical at all, but that said, don't understand why anyone would be surprised by this. Users are almost always the product. Seems like the Gruber version of outrage porn.
- edw 9y ago
  I disagree. If think it's the false sadness — er, "heartbreak" — expressed by the CEO in response to users being upset that angers Gruber. It's one thing to be a straight up sociopath and run your sociopathic business but quite another to pretend you care one iota about the people who you are monetizing by turning them into a personal data slurry. By the way, folks seem to be intent on down voting your comment into oblivion. That, sadly, seems like increasingly typical behavior here, and elsewhere on the internet. The thinking seems to be: "I don't agree with your opinion therefore I will do my best to make your opinion disappear." Does that make anyone smarter? Perhaps someone was deeply, personally offended — in which case, off with your head, right?
  - gdulli 9y ago
    > That, sadly, seems like increasingly typical behavior here, and elsewhere on the internet. "I'll call someone I've never met a lying sociopath but I draw the line at downvotes!"
  - nhangen 9y ago
    I get it. I just think Gruber is a hypocrite. Wasn't long ago he was invited to an Apple meeting so he could then write a blog post shilling for them. The boundaries broken are not comparable, but I just don't feel that Gruber has any moral high ground to stand on because of his affiliation with members in the industry. In addition, it's not like we haven't seen this act before with company CEO's. This sort of thing happens all of the time, and in every industry. He's a smart guy, but his post seems overly-reactionary. I am less bothered by the CEO's comment than by their monetization strategy, but then again, I don't really see the need for the product in the first place.
eganist 9y ago
Basically a repost of https://news.ycombinator.com/item?id=14180463 https://news.ycombinator.com/item?id=14180463 Had to search my inbox as a sanity check to make sure I hadn't signed up for the service. Turns out I hadn't, but it was pitched on Product Hunt both in April 2015 and May 2016. I'm hoping at least security folks made the mental connection that signing up meant compromising your personal emails. That's the single reason I didn't bother.
- JumpCrisscross 9y ago
  > signing up meant compromising your personal emails Assuming someone only signed up with their personal address. Curious how many .gov email addresses are in their database...
  - CameronBanga 9y ago
    It only works with major emails services like Gmail, Yahoo, etc, I believe.
    - fmorel 9y ago
      Plenty of agencies on services like Google Apps for Government.
- Freak_NL 9y ago
  > Had to search my inbox as a sanity check to make sure I hadn't signed up for the service. Wouldn't you remember granting a third party full access to your email inbox? That doesn't seem like a trivial decision to make.
  - jrimbault 9y ago
    Past you isn't future you. And checking is near free.
  - eganist 9y ago
    I trust my brain but verify my memories from time to time. :)
accountyaccount 9y ago
Typically I'd expect this data to be anonymized, but when it's your entire inbox how anonymous can it really be?
meagher 9y ago
> If you're not paying, you're the product. Facebook, Google, ..., Unroll.me
- ZeroGravitas 9y ago
  And if you are paying, they can make an extra buck by selling you out too.
spcelzrd 9y ago
Selling data to the highest bidder doesn't surprise me. Users should expect this, but since it's all buried in TOS, only more savvy users are going to know or notice. Maybe it's time for some ethical standards among developers. Dumping email to an insecure server should be something that every developer would refuse. Somebody was just following order.
dickbasedregex 9y ago
Scummy to say the least.
elahd 9y ago
I prodded unroll.me a couple of years ago about their data retention policy. Their answer was sketchy so I ended up not using the service. I'm surprised it took this long for someone with reach to look into them. Original thread: https://twitter.com/elahd/status/575692415132135425 https://twitter.com/elahd/status/575692415132135425 DMs: http://imgur.com/H0UABYa http://imgur.com/H0UABYa
- notwhiteknight 9y ago
  Sounds like you have great evidence for a class-action against them. If they told their users they only retain emails for 7 days, but actually kept every email in an S3 bucket that was then sold illegally to Slice, every user of Unroll.me could sue for breach of contract, damages, etc...
  - jbrooksuk 9y ago
    If you go ahead with this, let me know!
- kdoherty 9y ago
  I have tried the service, and my interactions with it have confirmed all perceived sketchiness: In a moment of desperation, I signed up for this a while back. I found it not to be useful and tried to remove my account with the site, which turns out to be essentially impossible. I ended up revoking access to my email account and continued to receive emails from unroll.me that the service "has lost its connection to your account," which I found hilarious, because in my desperate attempt to get rid of spam, I created more. I've tried to unsubscribe from these unroll.me emails several times before, and the unsubscribe link takes me to a page containing all the subscriptions that the service once found on my account (the one you'd see if you were trying to use the service---so all that data is still there, for sure, and it has been many months), and I have never actually been unsubscribed.
  - elahd 9y ago
    ...and they still have all of your emails! You can't take back the emails they've already archived, which (presumably) is everything that was in your inbox before you disconnected your Gmail account.
jonheller 9y ago
This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number. I remember when the big wave of smart email apps first came out a few years ago, and the horror was the expressed here when it was revealed that these apps basically route all of your email through their servers in order to do processing on it. Sadly at lot of the trepidation about services like that seems to have abated -- or maybe the general population just isn't aware of how intrusive these types of services could be. But I would never allow any third party service to access my email.
- nialo 9y ago
  I think this is correct but maybe not quite far enough. I am much more willing to give out my social security number than my Gmail password.
- jerf 9y ago
  "This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number." Have you ever emailed your social security number, had your social security number emailed to you, or signed up for any sort of service to your gmail account including your paycheck management company, your tax returns, your bank, or anything else that via email password reset could be used to access your social security number? Certainly I'd go so far as to say that almost anybody's "real" gmail account could certainly be leveraged to get the last four digits of your social security number. Given the low entropy of the other 5 numbers given other details [1], even if you can say with a straight face that your email has never had your very, very regex-able social security number in it, it's still got most of the bits, most likely. Perhaps not enough to automatically target you without a bit more machine learning than I think we quite have at the moment, but... getting perilously close, honestly. Someone who really dedicated themselves to taking "gmail inboxes" and writing a system to determine social security numbers from that could probably do pretty well. It wouldn't quite be just "fire some machine learning at it", but the system as a whole seems pretty feasible to me. [1]: http://www.stevemorse.org/ssn/ssn.html http://www.stevemorse.org/ssn/ssn.html . It isn't quite as bad as it seems for many of us, because we didn't all used to get SS numbers at birth, so my SS number does not correspond to my birth. But if you have my last 4 numbers and a handful of other bits of information about where I've lived, it's distressingly few bits between me and my identity getting stolen.
gdulli 9y ago
> operating under the radar The privacy policy is clear and easy to find and understand. You can be annoyed with yourself for not reading it. You can decide the service isn't worth the tradeoffs. You can be annoyed with yourself for being naive about how free products work. But it's illogical and disingenuous to call this "under the radar" or blame the service for your own surprise about how it works. We have free will and a responsibility to understand the agreements we enter into. Admitting so casually that we can't handle those things is a scary thought.
- noja 9y ago
  > You can be annoyed with yourself for not reading it. Do how do you spend reading every click-wrap agreement you accept? We condition users not to read these things, so we can't be surprised when they don't read them.
  - gdulli 9y ago
    > Do how do you spend reading every click-wrap agreement you accept? No, but I don't complain about the consequences. If I agreed to terms that gave my house to unroll.me, they'd never be able to enforce it because it's egregiously inappropriate. I take that much for granted. The actual unroll.me terms are not egregiously inappropriate. They may be distasteful to most people here, but it's not offensive or inappropriate that the terms are allowed to exist.
    - noja 9y ago
      So "do as I say, not as I do"
      - gdulli 9y ago
        That does not apply here. That's obtuse. It would be hypocritical for me to criticize not reading terms and then complaining about those terms if I was doing both those things. Everyone's free to do as I say and do, accept terms and then accept their consequences.
- 9y ago
hncommenter13 9y ago
Someone is selling similar data to investors via Quandl. The source is confidential, however, so it's unclear if this is Unroll.me as well. https://www.quandl.com/alternative-data/email-receipt-data https://www.quandl.com/alternative-data/email-receipt-data
siddhant 9y ago
I find it fascinating that there are services which require access to your complete inbox, irrespective of how useful they might be or what they've written in their privacy policy. Every single email you ever sent/received, and every single email you will send/receive. Maybe I'm being paranoid, but sorry, that's just a huge "no" in my book.
franciskim 9y ago
I used unroll.me once but it didn't really work so I removed it.
timsayshey 9y ago
Great, I'm sold on leaving unroll.me but I think there is a deeper problem here. Email is so insecure and if you're already using Gmail then who knows who Google is selling your emails to. Google is just a lot better about keeping it a secret. Fooling yourself into thinking your emails are secure if you're not using Unroll.me is a joke. Also, please suggest a secure alternative when telling people to leave a service over security. I'd love to switch to something else that gives me some false sense of security but shutting off unroll.me and allowing my inbox to implode with spam is not a great option right now.
- yladiz 9y ago
  Although I've since moved on from Gmail, because I don't like Google having access to all of my emails and harvesting the data from them, I do trust Google as far as sanitizing emails much more than a service like Unroll.me. As far as a different service, I found Unroll.me to be just another annoying email I had to read and found it kinda useless since if I wanted to "roll up" an email, I had to read the daily email to see what it suggests and then add to my rollup list. My solution was to just unsubscribe from any email that I didn't actively read (which was most of them). Especially given that most services are one-click unsubscribe now in the Gmail interface or Mail.app, it's pretty simple compared to a few years ago.
- Oletros 9y ago
  Google has their share of privacy problems, but they don't sell data

126 points by nav 9y ago

Active discussion: https://news.ycombinator.com/item?id=14181152 https://news.ycombinator.com/item?id=14181152

I looked on their website, Frequently Asked Questions, and even hovered over text like "Unroll.me is a free service" in order to find a disclosure. I could not find ANY disclosures whatsoever. Nowhere does Unroll.me disclose that they sell your emails to the highest bidder. I wish we had a FTC that could bankrupt Unroll.me's previous and current founders and executives. Absolutely despicable behaviour.

gdulli 9y ago
You can't sign up for the service without agreeing to the privacy policy, which is where you should expect privacy-related concerns to be discussed.
eganist 9y ago
Terms of Service pointed me to their Privacy Policy. Privacy Policy indicated the following: > We also collect non-personal information − data in a form that does not permit direct association with any specific individual. We may collect, use, transfer, sell, and disclose non-personal information for any purpose. For example, when you use our services, we may collect data from and about the “commercial electronic mail messages” and “transactional or relationship messages” (as such terms are defined in the CAN-SPAM Act (15 U.S.C. 7702 et. seq.) that are sent to your email accounts. We collect such commercial transactional messages so that we can better understand the behavior of the senders of such messages, and better understand our customer behavior and improve our products, services, and advertising. We may disclose, distribute, transfer, and sell such messages and the data that we collect from or in connection with such messages; provided, however, if we do disclose such messages or data, all personal information contained in such messages will be removed prior to any such disclosure. Damningly, if they're collecting and disclosing transaction details, they're also technically conveying personal information given the ease by which identities can be reversed from this sort of data.

jbmorgado 9y ago

If you have ever used the service, it probably has still almost full access to your gmail account (I noticed it had in mine). You can remove its authorisations at: https://myaccount.google.com/permissions https://myaccount.google.com/permissions

hoektoe 9y ago
Thanks for the link for the lazy

nhangen 9y ago

I don't find the practice ethical at all, but that said, don't understand why anyone would be surprised by this. Users are almost always the product. Seems like the Gruber version of outrage porn.

edw 9y ago
I disagree. If think it's the false sadness — er, "heartbreak" — expressed by the CEO in response to users being upset that angers Gruber. It's one thing to be a straight up sociopath and run your sociopathic business but quite another to pretend you care one iota about the people who you are monetizing by turning them into a personal data slurry. By the way, folks seem to be intent on down voting your comment into oblivion. That, sadly, seems like increasingly typical behavior here, and elsewhere on the internet. The thinking seems to be: "I don't agree with your opinion therefore I will do my best to make your opinion disappear." Does that make anyone smarter? Perhaps someone was deeply, personally offended — in which case, off with your head, right?
- gdulli 9y ago
  > That, sadly, seems like increasingly typical behavior here, and elsewhere on the internet. "I'll call someone I've never met a lying sociopath but I draw the line at downvotes!"
- nhangen 9y ago
  I get it. I just think Gruber is a hypocrite. Wasn't long ago he was invited to an Apple meeting so he could then write a blog post shilling for them. The boundaries broken are not comparable, but I just don't feel that Gruber has any moral high ground to stand on because of his affiliation with members in the industry. In addition, it's not like we haven't seen this act before with company CEO's. This sort of thing happens all of the time, and in every industry. He's a smart guy, but his post seems overly-reactionary. I am less bothered by the CEO's comment than by their monetization strategy, but then again, I don't really see the need for the product in the first place.

eganist 9y ago

Basically a repost of https://news.ycombinator.com/item?id=14180463 https://news.ycombinator.com/item?id=14180463 Had to search my inbox as a sanity check to make sure I hadn't signed up for the service. Turns out I hadn't, but it was pitched on Product Hunt both in April 2015 and May 2016. I'm hoping at least security folks made the mental connection that signing up meant compromising your personal emails. That's the single reason I didn't bother.

JumpCrisscross 9y ago
> signing up meant compromising your personal emails Assuming someone only signed up with their personal address. Curious how many .gov email addresses are in their database...
- CameronBanga 9y ago
  It only works with major emails services like Gmail, Yahoo, etc, I believe.
  - fmorel 9y ago
    Plenty of agencies on services like Google Apps for Government.
Freak_NL 9y ago
> Had to search my inbox as a sanity check to make sure I hadn't signed up for the service. Wouldn't you remember granting a third party full access to your email inbox? That doesn't seem like a trivial decision to make.
- jrimbault 9y ago
  Past you isn't future you. And checking is near free.
- eganist 9y ago
  I trust my brain but verify my memories from time to time. :)

accountyaccount 9y ago

Typically I'd expect this data to be anonymized, but when it's your entire inbox how anonymous can it really be?

meagher 9y ago

> If you're not paying, you're the product. Facebook, Google, ..., Unroll.me

ZeroGravitas 9y ago
And if you are paying, they can make an extra buck by selling you out too.

spcelzrd 9y ago

Selling data to the highest bidder doesn't surprise me. Users should expect this, but since it's all buried in TOS, only more savvy users are going to know or notice. Maybe it's time for some ethical standards among developers. Dumping email to an insecure server should be something that every developer would refuse. Somebody was just following order.

dickbasedregex 9y ago

Scummy to say the least.

elahd 9y ago

I prodded unroll.me a couple of years ago about their data retention policy. Their answer was sketchy so I ended up not using the service. I'm surprised it took this long for someone with reach to look into them. Original thread: https://twitter.com/elahd/status/575692415132135425 https://twitter.com/elahd/status/575692415132135425 DMs: http://imgur.com/H0UABYa http://imgur.com/H0UABYa

notwhiteknight 9y ago
Sounds like you have great evidence for a class-action against them. If they told their users they only retain emails for 7 days, but actually kept every email in an S3 bucket that was then sold illegally to Slice, every user of Unroll.me could sue for breach of contract, damages, etc...
- jbrooksuk 9y ago
  If you go ahead with this, let me know!
kdoherty 9y ago
I have tried the service, and my interactions with it have confirmed all perceived sketchiness: In a moment of desperation, I signed up for this a while back. I found it not to be useful and tried to remove my account with the site, which turns out to be essentially impossible. I ended up revoking access to my email account and continued to receive emails from unroll.me that the service "has lost its connection to your account," which I found hilarious, because in my desperate attempt to get rid of spam, I created more. I've tried to unsubscribe from these unroll.me emails several times before, and the unsubscribe link takes me to a page containing all the subscriptions that the service once found on my account (the one you'd see if you were trying to use the service---so all that data is still there, for sure, and it has been many months), and I have never actually been unsubscribed.
- elahd 9y ago
  ...and they still have all of your emails! You can't take back the emails they've already archived, which (presumably) is everything that was in your inbox before you disconnected your Gmail account.

jonheller 9y ago

This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number. I remember when the big wave of smart email apps first came out a few years ago, and the horror was the expressed here when it was revealed that these apps basically route all of your email through their servers in order to do processing on it. Sadly at lot of the trepidation about services like that seems to have abated -- or maybe the general population just isn't aware of how intrusive these types of services could be. But I would never allow any third party service to access my email.

nialo 9y ago
I think this is correct but maybe not quite far enough. I am much more willing to give out my social security number than my Gmail password.
jerf 9y ago
"This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number." Have you ever emailed your social security number, had your social security number emailed to you, or signed up for any sort of service to your gmail account including your paycheck management company, your tax returns, your bank, or anything else that via email password reset could be used to access your social security number? Certainly I'd go so far as to say that almost anybody's "real" gmail account could certainly be leveraged to get the last four digits of your social security number. Given the low entropy of the other 5 numbers given other details [1], even if you can say with a straight face that your email has never had your very, very regex-able social security number in it, it's still got most of the bits, most likely. Perhaps not enough to automatically target you without a bit more machine learning than I think we quite have at the moment, but... getting perilously close, honestly. Someone who really dedicated themselves to taking "gmail inboxes" and writing a system to determine social security numbers from that could probably do pretty well. It wouldn't quite be just "fire some machine learning at it", but the system as a whole seems pretty feasible to me. [1]: http://www.stevemorse.org/ssn/ssn.html http://www.stevemorse.org/ssn/ssn.html . It isn't quite as bad as it seems for many of us, because we didn't all used to get SS numbers at birth, so my SS number does not correspond to my birth. But if you have my last 4 numbers and a handful of other bits of information about where I've lived, it's distressingly few bits between me and my identity getting stolen.

gdulli 9y ago

> operating under the radar The privacy policy is clear and easy to find and understand. You can be annoyed with yourself for not reading it. You can decide the service isn't worth the tradeoffs. You can be annoyed with yourself for being naive about how free products work. But it's illogical and disingenuous to call this "under the radar" or blame the service for your own surprise about how it works. We have free will and a responsibility to understand the agreements we enter into. Admitting so casually that we can't handle those things is a scary thought.

noja 9y ago
> You can be annoyed with yourself for not reading it. Do how do you spend reading every click-wrap agreement you accept? We condition users not to read these things, so we can't be surprised when they don't read them.
- gdulli 9y ago
  > Do how do you spend reading every click-wrap agreement you accept? No, but I don't complain about the consequences. If I agreed to terms that gave my house to unroll.me, they'd never be able to enforce it because it's egregiously inappropriate. I take that much for granted. The actual unroll.me terms are not egregiously inappropriate. They may be distasteful to most people here, but it's not offensive or inappropriate that the terms are allowed to exist.
  - noja 9y ago
    So "do as I say, not as I do"
    - gdulli 9y ago
      That does not apply here. That's obtuse. It would be hypocritical for me to criticize not reading terms and then complaining about those terms if I was doing both those things. Everyone's free to do as I say and do, accept terms and then accept their consequences.
9y ago

hncommenter13 9y ago

Someone is selling similar data to investors via Quandl. The source is confidential, however, so it's unclear if this is Unroll.me as well. https://www.quandl.com/alternative-data/email-receipt-data https://www.quandl.com/alternative-data/email-receipt-data

siddhant 9y ago

I find it fascinating that there are services which require access to your complete inbox, irrespective of how useful they might be or what they've written in their privacy policy. Every single email you ever sent/received, and every single email you will send/receive. Maybe I'm being paranoid, but sorry, that's just a huge "no" in my book.

franciskim 9y ago

I used unroll.me once but it didn't really work so I removed it.

timsayshey 9y ago

Great, I'm sold on leaving unroll.me but I think there is a deeper problem here. Email is so insecure and if you're already using Gmail then who knows who Google is selling your emails to. Google is just a lot better about keeping it a secret. Fooling yourself into thinking your emails are secure if you're not using Unroll.me is a joke. Also, please suggest a secure alternative when telling people to leave a service over security. I'd love to switch to something else that gives me some false sense of security but shutting off unroll.me and allowing my inbox to implode with spam is not a great option right now.

yladiz 9y ago
Although I've since moved on from Gmail, because I don't like Google having access to all of my emails and harvesting the data from them, I do trust Google as far as sanitizing emails much more than a service like Unroll.me. As far as a different service, I found Unroll.me to be just another annoying email I had to read and found it kinda useless since if I wanted to "roll up" an email, I had to read the daily email to see what it suggests and then add to my rollup list. My solution was to just unsubscribe from any email that I didn't actively read (which was most of them). Especially given that most services are one-click unsubscribe now in the Gmail interface or Mail.app, it's pretty simple compared to a few years ago.
Oletros 9y ago
Google has their share of privacy problems, but they don't sell data