7 ms·

From the privacy policy: "Analytics Our iOS application can send analytics to our analytics providers: Segment and Amplitude. We do not track or store any pers

From the privacy policy: "Analytics Our iOS application can send analytics to our analytics providers: Segment and Amplitude. We do not track or store any personal information in our analytics. Instead, we ask Apple to generate a unique deviceID which we use as a unique token for analytics purposes. Our analytics are 100% anonymous."

lmkg 8y ago
And where does Segment send it to? My experience with Segment is that it's not an analytics tool, but rather a tool that provides a single API for sending data to your fifteen different analytics tools.
- way66 8y ago
  Segment sends the data to Amplitude. Pierre, CEO, Jumbo.
jklinger410 8y ago
So yes.
- cal5k 8y ago
  Apple actually does a really good job of making it hard for developers to track a specific device (if they want to get approved for the App Store, that is).
  - tokyodude 8y ago
    How do they do this? How is the device not trivially trackable ?
    - gruez 8y ago
      >How is the device not trivially trackable ? List a few ways it's "trivially trackable".
      - Nextgrid 8y ago
        Correlating device type & OS version, IP address and time of access is a pretty good way to connect the dots between “anonymised” IDs. If the same IDs always show up in quick succession from the same IP and device type/version chances are it’s the same person just checking multiple apps on their phone. Time of access and IP address can be used to infer where the person lives (to a certain degree or accuracy), when they are working, etc.
        way66 8y ago
        Yes, UNLESS you don't collect device type, OS version and IP address in the first place, which we don't. Pierre, CEO Jumbo
gregdunn 8y ago
I feel like a unique ID isn't enough to protect your identity from an analytics provider, especially if they're receiving analytics on you from multiple sources.
- Nextgrid 8y ago
  Exactly. They just have to correlate device type & OS version & IP address & date/time to have a pretty good idea of which other apps (& their “unique” IDs you have). The more they do it the more they can narrow it down, until they reach the point where they have a set of IDs that only ever come from the same device/version, IP address as well as very similar times of day.
  - way66 8y ago
    No, because we've designed protection against collecting IP address, device type and OS. We don't use any SDK from Segment, Amplitude, or any third party analytics. Our iOS app only sends a device UUID, an event name (user:opened:app) and some event properties (not personal information). Someone should feel free to reverse-engineer our network requests to confirm what I'm saying. Also, let's talk about IP address. We have a CloudFlare worker that sits between our app and our analytics proxy (which role is to send data to Segment). And this worker from Cloudflare is a piece of code that removes the user ip address from the request made to our proxy, hosted on Heroku. Here is the worker code: https://gist.github.com/pierrevalade/85bbe1e5278b81813e08e7ed9a76250b https://gist.github.com/pierrevalade/85bbe1e5278b81813e08e7e... That way, only Cloudflare gets the user IP address (and to my the best of my knowledge I don't know how to access it), and our servers never get it.
    - Nextgrid 8y ago
      How can I confirm what you are saying is true regarding the IP address, other than taking your word for it (I heard that worked great with Facebook)? Why does your privacy policy mention third-party analytics then? Why do you mention “Segment sends the data to Amplitude” in another one of your comments if you claim here that you don’t use any third-party analytics service? Also, just wondering - why do you need to send anything in the first place? People have been building software just fine for decades before this whole “analytics” plague started going around, and I didn’t notice software quality being improved by it (if anything software has gone significantly downhill).
samschooler 8y ago
I'm wondering what ID they use? If its identifier for vendor[0] then Segment (or any other analytics providers) would have more trouble connecting the dots to figure out who the person is. This is because per vendor, the ID changes. If its the advertiser identifier[1], they can track across apps, however this is an easy fix by enabling "Limit Ad Tracking" in settings, which causes the ID to be all 0s. 0: https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/documentation/uikit/uidevice/162... 1: https://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti...
- way66 8y ago
  Pierre, here, CEO of Jumbo. We use: UIDevice.current.identifierForVendor?.uuidString for the deviceID Let me know if you think that's not a good idea, but it seemed a unique app device that's completely a black box for us, Segment, or Amplitude.
tgsovlerkhgsel 8y ago
> unique deviceID > 100% anonymous Choose one. This is pseudonymous, which is just a fancy word for "likely deanonymizable".
GordonS 8y ago
> 100% anonymous This language feels disingenuous, given that fingerprinting could be used to match an identity elsewhere.
- way66 8y ago
  What fingerprint? We don't send device OS, IP address, geolocation... Impossible to do fingerprint from only a device UUID that does not means anything.
  - Nextgrid 8y ago
    Device UUID will still leak an usage pattern. For example, if an UUID is active in the morning and in the evening during the week but at random times during the weekend you can infer that they are working, their approximate working hours and the fact they are not working on weekends. Just a simple example - I’m sure a data scientist can do a lot more magic given enough data.
    - way66 8y ago
      Hum... and then?
      - Nextgrid 8y ago
        Usage patterns can be unique enough to track the same user across different services, some of which may have the user’s PII and thus a link to the user’s identity.
        way66 8y ago
        Okay, good point. so maybe we should modify the created datetime of the event more or less 15minutes what do you think?
        Nextgrid 8y ago
        Could be a good idea to send events in batches, so the app collects event counters locally and only sends it in bulk every few days (exact interval being random). That way there’s no specific date/time associated to events, just that “for the past 3 days the app has been opened X times”.
megaremote 8y ago
> we ask Apple to generate a unique deviceID This is bullshit. You don't ask Apple. Apple enforces this requirement on every single app.
- way66 8y ago
  I guess I meant... we call a Apple API to ask for a anonymous Device UUID. Precisely: UIDevice.current.identifierForVendor?.uuidString Do you still think that's "bullshit"?
ozten 8y ago
Two 3rd party analytics platforms... Seems like a roll your own competency for a Privacy Assistant.
- way66 8y ago
  why?

lmkg 8y ago

And where does Segment send it to? My experience with Segment is that it's not an analytics tool, but rather a tool that provides a single API for sending data to your fifteen different analytics tools.

way66 8y ago
Segment sends the data to Amplitude. Pierre, CEO, Jumbo.

jklinger410 8y ago

So yes.

cal5k 8y ago
Apple actually does a really good job of making it hard for developers to track a specific device (if they want to get approved for the App Store, that is).
- tokyodude 8y ago
  How do they do this? How is the device not trivially trackable ?
  - gruez 8y ago
    >How is the device not trivially trackable ? List a few ways it's "trivially trackable".
    - Nextgrid 8y ago
      Correlating device type & OS version, IP address and time of access is a pretty good way to connect the dots between “anonymised” IDs. If the same IDs always show up in quick succession from the same IP and device type/version chances are it’s the same person just checking multiple apps on their phone. Time of access and IP address can be used to infer where the person lives (to a certain degree or accuracy), when they are working, etc.
      - way66 8y ago
        Yes, UNLESS you don't collect device type, OS version and IP address in the first place, which we don't. Pierre, CEO Jumbo

gregdunn 8y ago

I feel like a unique ID isn't enough to protect your identity from an analytics provider, especially if they're receiving analytics on you from multiple sources.

Nextgrid 8y ago
Exactly. They just have to correlate device type & OS version & IP address & date/time to have a pretty good idea of which other apps (& their “unique” IDs you have). The more they do it the more they can narrow it down, until they reach the point where they have a set of IDs that only ever come from the same device/version, IP address as well as very similar times of day.
- way66 8y ago
  No, because we've designed protection against collecting IP address, device type and OS. We don't use any SDK from Segment, Amplitude, or any third party analytics. Our iOS app only sends a device UUID, an event name (user:opened:app) and some event properties (not personal information). Someone should feel free to reverse-engineer our network requests to confirm what I'm saying. Also, let's talk about IP address. We have a CloudFlare worker that sits between our app and our analytics proxy (which role is to send data to Segment). And this worker from Cloudflare is a piece of code that removes the user ip address from the request made to our proxy, hosted on Heroku. Here is the worker code: https://gist.github.com/pierrevalade/85bbe1e5278b81813e08e7ed9a76250b https://gist.github.com/pierrevalade/85bbe1e5278b81813e08e7e... That way, only Cloudflare gets the user IP address (and to my the best of my knowledge I don't know how to access it), and our servers never get it.
  - Nextgrid 8y ago
    How can I confirm what you are saying is true regarding the IP address, other than taking your word for it (I heard that worked great with Facebook)? Why does your privacy policy mention third-party analytics then? Why do you mention “Segment sends the data to Amplitude” in another one of your comments if you claim here that you don’t use any third-party analytics service? Also, just wondering - why do you need to send anything in the first place? People have been building software just fine for decades before this whole “analytics” plague started going around, and I didn’t notice software quality being improved by it (if anything software has gone significantly downhill).

samschooler 8y ago

I'm wondering what ID they use? If its identifier for vendor[0] then Segment (or any other analytics providers) would have more trouble connecting the dots to figure out who the person is. This is because per vendor, the ID changes. If its the advertiser identifier[1], they can track across apps, however this is an easy fix by enabling "Limit Ad Tracking" in settings, which causes the ID to be all 0s. 0: https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/documentation/uikit/uidevice/162... 1: https://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti...

way66 8y ago
Pierre, here, CEO of Jumbo. We use: UIDevice.current.identifierForVendor?.uuidString for the deviceID Let me know if you think that's not a good idea, but it seemed a unique app device that's completely a black box for us, Segment, or Amplitude.

tgsovlerkhgsel 8y ago

> unique deviceID > 100% anonymous Choose one. This is pseudonymous, which is just a fancy word for "likely deanonymizable".

GordonS 8y ago

> 100% anonymous This language feels disingenuous, given that fingerprinting could be used to match an identity elsewhere.

way66 8y ago
What fingerprint? We don't send device OS, IP address, geolocation... Impossible to do fingerprint from only a device UUID that does not means anything.
- Nextgrid 8y ago
  Device UUID will still leak an usage pattern. For example, if an UUID is active in the morning and in the evening during the week but at random times during the weekend you can infer that they are working, their approximate working hours and the fact they are not working on weekends. Just a simple example - I’m sure a data scientist can do a lot more magic given enough data.
  - way66 8y ago
    Hum... and then?
    - Nextgrid 8y ago
      Usage patterns can be unique enough to track the same user across different services, some of which may have the user’s PII and thus a link to the user’s identity.
      - way66 8y ago
        Okay, good point. so maybe we should modify the created datetime of the event more or less 15minutes what do you think?
        Nextgrid 8y ago
        Could be a good idea to send events in batches, so the app collects event counters locally and only sends it in bulk every few days (exact interval being random). That way there’s no specific date/time associated to events, just that “for the past 3 days the app has been opened X times”.

megaremote 8y ago

> we ask Apple to generate a unique deviceID This is bullshit. You don't ask Apple. Apple enforces this requirement on every single app.

way66 8y ago
I guess I meant... we call a Apple API to ask for a anonymous Device UUID. Precisely: UIDevice.current.identifierForVendor?.uuidString Do you still think that's "bullshit"?

ozten 8y ago

Two 3rd party analytics platforms... Seems like a roll your own competency for a Privacy Assistant.

way66 8y ago
why?