Indeed in this case, where unroll.me is owned by an analytics service, it appears that the entire purpose for the service is to get access to user email data for monetization. So apparently Unroll.me, with access to its user email accounts, collected their Lyft receipts, anonymized them, and sold them to Uber. I’m pretty sure people signing up for unroll.me don’t expect that to happen.
- Several analytics packages:
We use third party services, such as Google Analytics, Facebook Analytics and Amplitude, to collect and analyze how you use Spark. These services may collect information about you and your usage of Spark in accordance with their respective privacy policies.
- Uses my primary email address to send me spam:
We might use that email address to reach out to you periodically with information about features, updates, announcements or to request your feedback.
- Stores my email username and password on their servers:
Where OAuth is not supported we keep your account username and password on our secure servers.
- Downloads my email to their servers:
We then use the authorization provided to download your emails to our virtual servers and push to your device.
Readdle goes on to explain that they primarily use the email headers to send push notifications for new mail, that they do not sell your information to third parties, and that you can unsubscribe to emails at any time. Readdle makes some great apps, ones that I use quite a bit, but I wish they’d reconsider using server-side processing for Spark. If they worked out a way to do what they needed to do on-device, Spark would be a much more attractive option for my email.