I worked for a company that nearly acquired unroll.me. At the time, which was over three years ago, they had kept a copy of every single email of yours that you sent or received while a part of their service. Those emails were kept in a series of poorly secured S3 buckets. A large part of Slice buying unroll.me was for access to those email archives. Specifically, they wanted to look for keyword trends and for receipts from online purchases.
The founders of unroll.me were pretty dishonest, which is a large part of why the company I worked for declined to purchase the company. As an example, one of the problems was how the founders had valued and then diluted equity shares that employees held. To make a long story short, there weren't any circumstances in which employees who held options or an equity stake would see any money.
I hope you weren't emailed any legal documents or passwords written in the clear.
situations like this is what makes it really hard for others in this space to survive. I run https://clean.email (and we don't store/retain/sell any data, just charge people to use it) and the biggest issue we have is lack of trust because of news like this.
although every day someone would still email with a question "why you are not free like unroll.me".. sigh.
I understand that you don't retain user emails, and that's good, but do I understand that your service has somewhere a database of OAuth bearer tokens that provide direct access to the email archives of everyone who has signed up for your service? How do you protect that? I would be terrified.
yes, that is correct. we actually started without keeping refresh tokens and only using access tokens – but they expire really fast and google api randomly stops accepting them so we had to start keeping refresh tokens as well.
they are encrypted and can only be decrypted by "scan" and "action" (delete, trash, etc) jobs, job servers are not exposed to the outside and can only be accessed via the private network via ssh using access keys and only from a specific node which has those keys. keys are password protected. access to that specific node is restricted to a set of known public ip addresses. database and job servers are different servers of course. database servers are also only accessible within the private network.
the only thing that's publicly exposed is a load balancer.
to access anything else we log in to the "gateway" instance which we access by ip only and it does not have any domain name associated with it.
with all that – I am very open to ideas about protecting that further.
All job servers are stateless by design and easily disposable/replaceable with a fresh build so we don't back them up. we don't back up user data either – it's deleted within 24 fours (or immediately on request). the only thing backed up is a table with refresh tokens which are encrypted and decryption keys are not backed up with it.
Could you explain the limits of the free plan? Interested in trying this out but it's not clear what I'll get it and if/when I'll be forced to pay. That said, I understand the value in paying for such a service instead of selling off all my data.
We have them on the "about" page – https://clean.email/about – but we are actually working on a separate page right now. as I said above – we can and should do better putting our policies front and center.
I clicked, I read your value prop, I just can't see myself paying $95+ /year for less obnoxious email in my inbox. It's really not that big of a problem to me.
ugh. I have "Yearly pricing to the homepage" sitting in my to-do list for a few weeks :) so – there's yearly pricing (and it starts with 14.99 / year (I know, this looks really weird, but it took us some time to get to this pricing).
now, whether it's valuable enough to justify the price – depends a lot on how you use your email. we've got users managing 3-5 accounts with hundreds of thousands of emails each and they use our labeling/organization more than removal. think of it as of a way to act upon a group of emails no matter what the size of the group is.
(and I kinda think our website is not really good at communicating this – our traffic is mostly coming from android app right now and we've been putting website work off. who knew!).
You offer plain and simply ask for 8€ per month per account.
That's simply a ridiculous amount of money for 99% of the people, what you have but we can't see is part of the problem, not the trust, the price is just not worth for what you offer, so, don't complain about "not a single new customer from 50 clicks".
Hey, quick fix: Just make Yearly the default option when the page loads, since the yearly options are the best price. Users to your site may just scroll through without clicking anything and only see the monthly prices (like I did).
this sounds like a great idea from the rational standpoint, but our data says otherwise. we've seen a conversion increase and generally more people started buying when we enabled monthly prices and again when we made them default. I have a few theories to back it up – but generally speaking pricing perception is emotional, not rational. looking at our prices you'd assume no one buys monthly, but about 40-50% of people do :)
Yea I'm certainly not eager to sign up for another service like this after finding out that the last one I used sold my data. It's getting really tough to trust third party services with your data these days.
my point exactly. I was just discussing this with a friend – there's really no way for us to prove that we don't keep or don't sell the data we get access to (aside from clearer tos/policies).
and it's even scarier with iCloud for example – they don't have oAuth and people need to enter their passwords to scan/clean. (they do have "app-specific" passwords though but looks like people have hard time figuring those out.)
fair point – this is something we consider doing before expanding to b2b market. but:
my day job is in ecommerce (I work as a product manager at FastSpring) and I used to work on CleanMyMac at MacPaw – had to work with trust in both. it's somewhat unexpected but people who are buying software for themselves usually don't care about PCI compliance, audits, and other artifacts of "institutional validation". they care about a "norton secured" badge, proper language, recommendation from a person they know, a review at the website they read, "that green thing with the lock in my browser".. we're now at the phase where we are trying to find the right combination.
just to be clear – it's very different from project to project and depends on the audience. what I'm saying is that we're making decisions emotionally mostly based on our prior experience and rely on internal "thermometer" to tell us if what we're seeing is trustworhty.
When dealing with sites where high trust is required I think people would much rather see an independent audit or compliance with a (legit) security accreditation than a Norton badge, however, most of the time this is not offered, so we make do with the crappy badge, a recommendation, or gut instinct.
Having said that, I deal with independent audits in my job, and they're not all that reassuring.
Pardon my ignorance or perhaps its just that I've become jaded, but outside of circumstances with dire/sever consequence such as laws, regulations, etc how does an independent audit (legit accreditation or not) verify what happens after the audit is done and the auditors long gone?
How does an independent audit detect out of band taps (swapping binaries, re purposing archives/backups, mirroring, etc) on infrastructure the auditor wasn't monitoring before the audit? logs? but more importantly amortized or not the customer eventually pays for all this activity that at the end of the day is more fluff than substance (in terms of what the customer can actually verify)
In the end doesn't all this come down to just another form marketing?
Please note, that I recognize that there are many scenarios where an independent audit would add value. I just don't think it adds anything that social validation doesn't already add when considered from the perspective of a consumer to whom the infrastructure behind the service is unavoidably opaque.
I don't see how that indicates a lack of trust. People may not be in the mood to change, or need to do more research before they do, especially since it is very late in the evening for the Western world.
Also, it's only been 30 minutes since your first post, and 50 is a small sample size.
That's so far outside of what is acceptable that it should be actionable in some way and I sincerely hope Google cuts them off at the knees. Aren't you breaking an NDA by posting this? (If so, extra kudos to you!)
> I haven't been a part of that company for several years now, and did not have any legal agreements or first party relationship with either of the companies named above, and since the deal closed since with Slice it would be difficult for anyone to allege damages.
And if all this disappears, then yes, someone did attack me legally over it. I don't like the business culture that has built up around this kind of thing -- reputation is important, so let's defend it with lots of lawyers and NDAs, but it's too much effort to be up front about business practices that might give us a bad reputation. That's bullshit.
I totally agree. But, and this is a very big but: companies would no longer be open to potential acquisition partners during the due diligence phase of an acquisition if professionals in this space would talk publicly (or even at all) about what they find.
I'm seriously conflicted about this because I too have seen some extremely horrible stuff in the last couple of years, some of which I'm quite sure would rock the world orders of magnitude worse than what unroll.me has been up to and that was secured roughly in the same way (or maybe even worse) and with data best qualified as 'radioactive'. I do sign NDAs and I stick to them religiously but it is very hard at times to do that. Even so I understand that I'd make life miserable for those that employ me if I'd ever break an NDA.
Yep. Working in Systems as I do, my word that I'll keep my employer's secrets is pretty precious. Still, we share war stories over libations with our peers. These stories have value; they're how we know as a community what products to use and what employers to seek or to avoid. While I didn't intend for this to get quite the audience that it's getting, I will own up to having shared the story.
My boundary, and the legal boundary that NDAs (even despite what is written in them) are generally held to is "trade secrets." I would hope that everything in my post is three or more years out of date, and would no longer qualify as such.
We're in immoral waters here:
1) NDA's prevent most human's getting closer to the truth.
2) Selected audiences (the drinking friends you share details with) know that companies x, y and z are scammers and criminal, but most don't.
3) As a consequence companies that are immoral and fronted by the most skilled marketing liars thrive too much.
I say not doing evil to the rest of mankind trumps protecting the evil few.
Leaking systems that work seem like the moral road?
I don't believe in that. For one, there is no such thing as anonymity to begin with, for another, I think if you do a thing like that you should stand by it.
> we don't store any of your emails on our servers.
Either way, I just deleted my Unroll.me account and revoked access to my Gmail account. I don't think there's anything the company can do to ever get me back as a user.
I'm not sure I can answer that in detail, or that it hasn't changed since the details were originally shared with me.
That might also be a case of an article that's written from the point of view of one feature ("what happens if I delete") and not what's going on under the hood. There are other references to deleting data stored with unroll.me, e.g. When you go through the delete steps you need to do it in a particular order so that data on their side is removed, as discussed in another comment thread.
In terms only of capabilities, that makes me wonder a lot about Gmail. I don't see anything there that they couldn't do if they wished to do it on a far grander scale.
Granted, I tend to think the people who run Gmail are more honest than that, but if someday the wrong people retired and others took over or what have you, I wonder just how suddenly that could change?
Gmail doesn't need to sell data to anyone, they use it for rest of the google suites like google.com, adsense, youtube, doubleclick, and all the other properties they own.
In fact it would be a stupid idea for them to sell any of that data directly to a 3rd party. Instead they package them in user friendly (marketer/advertiser friendly) ways to capitalize. Some of these are shady and I'm not a fan but overall I think this approach is fine.
The problem happens when you sell user data to a 3rd party.
Here's an example: Let's say you start an email newsletter about travel. You get millions of subscribers. Then you start putting ads on your email. Maybe sometimes even send sponsored messages. This is kind of annoying but not "unethical".
On the other hand, the same company could take all the email list and sell it to bunch of travel agencies. Then all the million users who subscribed suddenly start receiving spam emails from these travel agencies. This is unethical because they literally "sold" your email address.
Of course this is more of an extreme example, but the pattern is the same.
There are so many factors involved that it becomes unreasonable quickly.
Your main problem is going to be getting everyone to use it. If you converted 25% of the people using email today to an end to end encryption system it means that they can either only email anyone else in that 25% or anytime they send or receive an email from the other 75% it's not going to be encrypted the entire way.
Unless they're using an HSM, that would most likely be a matter of just copying a file.
With an HSM, it would have to be marked as exportable (bad for security), or to happen via some proprietary HSM to HSM cloning method endorsed by the vendor.
That said, I don't see that much HSM usage outside of the government or their contractors.
Just so you know, you have been quotes on gruber's article. Be careful about what you say on careful forum especially since your profile gives your contact information.
Thanks. I'll let it stand for now. I haven't been a part of that company for several years now, and did not have any legal agreements or first party relationship with either of the companies named above, and since the deal closed since with Slice it would be difficult for anyone to allege damages.
On top of that, it should be very clear that everything I said is hearsay at best. If I had known the attention this would receive, I would have been clearer about it.
In 20 years I haven't seen a time where this wasn't the case.
Seed money is the first to take the risk and deserves the majority share of profit
VC (series A,B,C) are putting in the most money and brining big hitters for the board and advisors. They clearly deserve the majority share.
Founders do all the work and it's their idea so they deserve all the money.
The second generation leaders productive, operationalize, and bring legitimacy to the company, so they deserve all the money.
Whichever group has the leverage forces the table to tilt their direction.
It doesn't matter how good the potential is, how sure the victory is, how close the first breakthrough customer is, if you don't trust someone, or there's a slimy/smarmy vibe then just walk away. It's not worth putting in years of effort to have to resort to contract lawyers to get paid.
It boils down to this: Capitalism is not the goal of society, it is a tool.
Somewhere in the past few decades we've conflated the two - and a larger portion of our population believe that Capitalism is the goal. It's not, it's a way to achieve our goals. It is efficient, it is effective, it will always have little to no morals and consolidate in the hands of the few. That is not a judgement of the system it is an assessment. No different than stating a hammer will will work well with nails and poorly with screws.
We as a world society (and particularly an American socienty) need to refocus on what our goals of society are. And actively decided when to use and when to rein in specific tools to achieve our goals.
Absent of focusing on goals, our tools become our goals and we get the results we're seeing today.
As sympathetic as I am to anti-capitalist rabble-rousing, your comment comes off as a canned micro-rant which doesn't relate in any substantial way to the parent.
If you want to understand what the implications are you need to spend time not with technologists but with ecologists. In nature there is a reason the apex predator doesn't evolve predatory advantages at a faster rate than its prey evolves defensive advantages. These rates grow or shrink in lockstep depending on resource availability. If they don't the ecosystem collapses.
I agree, but it won't until the bubble pops, and even that won't sort out the monopolists. As long as it's centered around VCs with more money than sense or morals, tech is going to continue unabated in its transformation into Wall Street 2.0
What bothers me is that this phrase becomes a thought-terminating cliche.
Too often, it's used to shut down all conversations around corporate malfeasance re:privacy, so the industry doesn't get better, we all just move on to the next big story. And victims are blamed and shamed. "Your fault for using a free service, what did you expect?" vs. "This is unacceptable behavior, let's force a change."
Not to mention so many don't understand free vs. non-free. Are there ads? Are there optional purchases that keep the company going? As someone else mentioned here, unroll.me showed ads, which would lead users to believe their usage was being subsidized by those ads - and Slice's About page on its web site says nothing about using unroll.me as a data source, it claims to use its own shopping app.
That's all well and good - and many people realise and accept this - but the degree to which you're the product can clearly vary wildly. That's the real issue.
Of course it varies. It's up to you to decide/deduce/infer what the "cost" of using a free service likely is. Understanding that there IS a cost is really the first step, one which a good portion of the population seems to not understand.
To be fair Unroll.me shows you ads in their emails to you so a user may think thats how they monetise and be ok with that. Its another thing altogether when the company sells all of your email data directly to buyers.
We come for startup and tech news. YC is a startup and tech funding company that needs to have it's portfolio reach us as their customers/employees/investors/etc...
With all due respect you were a consultant for 8 months at Returnpath and know nothing about why that deal didn't happen and you certainly weren't important enough there to know anything about the equity structure of the company. Returnpath is also a data company that buys companies for data collected from services provided to the user. Ask Josh Baer. That's why they bought his company.
Also spreading unfounded rumors about data storage practices you know zero about is really irresponsible.
You might have been and possibly still are under an NDA from the acquisition process. I'm not sure it is worthwhile detailing all of this in a public forum.
Slice (unroll.me) is owned by Rakuten, who also owns a whole family of companies including Ebates, Rakuten Marketing (a fairly large adtech company), Viber, Buy.com, and lots of others. Slice's data has all sorts of interesting applications, both within the Rakuten family and to third parties like Uber. If you're a Slice/unroll.me user, I'd bet that a lot of your online experience is shaped by the data you share with Slice. A lot of Rakuten's other properties actually share office space with Slice in San Mateo, so there's obviously plenty of opportunity for collaboration. :-)
The irony is that Rakuten also owns a significant (12 percent?) stake in Lyft. Pretty funny that one Rakuten property was selling data to Uber who used it to hurt a second Rakuten property.
So hypothetically, if you paid $5 a month for this service, you would be confident they were NOT selling your information?
Since the answer is obviously no (and in fact, purchasing behavior is the juiciest stuff to sell, be it Comcast, Target, etc), then this tired trope is meaningless.
So hypothetically, if you paid $5 a month for this service, you would be confident they were NOT selling your information?
No. A statement's truth doesn't imply its inverse [1].
It simply means if a company has employees, and they're receiving paychecks, and the money is not coming from you, then it's definitely coming from someone else.
If you are giving them money, it doesn't mean they're not also getting money from somewhere else. But they're less likely to need to do that, especially if it would upset their paying customers.
Whether I'm paying for a service is orthogonal to what its ToS allows them to do with my data. When I'm not paying for it, you can be pretty confident the ToS explicitly allows it, with even money on its being phrased in abstrusely arcane legalese. They have to make money somehow...
In the UK, O2 has a line in their terms and conditions that pretty much say they're allowed to sell your data to 3rd parties.
Now it's obvious why I've got people calling me asking about my recent loan that may have had PPI or that traumatic car crash I was in a few years ago, even though I've never in my life on both fronts. It's my bloody carrier!
If you use Google, shop in a supermarket, use a mobile phone, have the internet, your data is being collected and, in most cases, being sold to "chosen partners for marketing purposes". Everyone's doing it because they can make money from it.
Like i said below, the most obvious expectation was thinking that they would monetize with ads, which is why people didn't think twice about this.
There's a difference between ad supported businesses and business that actually directly sell user data behind the scenes.
Equating all the ad-supported businesses with this case is not really fair because the types of businesses you're talking about here are not actually literally selling you out. They are simply pushing you ads on THEIR platform which YOU agreed to use. Sure there are lots of shady things going on in this department as well, but it's a completely different game than what this looks like.
Based on this article it looks like they took your data and actually sold it to a third party, this is different from simply displaying ads on their platform. They literally sold you. And it happened OFF of the platform you signed up for.
You're describing my assumptions exactly! I incorrectly assumed that the occasional ads for Dashlane, HelloFresh, etc. in the "Daily Rollup" were how they monetized their service. But hey, turns out they're straight up selling my emails to third-parties. I've deleted my account and revoked their access on my Google account.
It's trite, and aside from belonging in the big dustbin of Hacker News cliches like linking to XKCD Standards, 'Just because you can doesn't mean you should' and 'Conflating Causation and Correlation' in this case it obscures more than it illuminates.
A product may be free - and you may still be happy to be the product if you think your attention is being sold, or that they plan to upsell you onto a premium plan.
'If you're not a paying user' doesn't immediately lead you to 'They're going to scan my email and sell the data to fucking Uber' and shouldn't require the user to scan the ToS / rack their brains for every nefarious bit of fuckery the company might conceivably use the data for.
> 'If you're not a paying user' doesn't immediately lead you to 'They're going to scan my email and sell the data to fucking Uber' and shouldn't require the user to scan the ToS / rack their brains for every nefarious bit of fuckery the company might conceivably use the data for.
I agree with the first half of what you said and disagree with the second. That's precisely the value of the original saying: it's not there to be an excuse for a company, it's there to spread awareness and remind people that they should get informed about just _how_ they're being productized _before_ they have cause to regret using the service.
If more of us scanned the ToS carefully, we might catch the nefarious bits of fuckery on time and pressure the company to change.
Does the privacy policy say your data will be sold to third parties? Great, find out what data, to what third parties and questions like that.
And since no one actually reads the privacy policy, users likely expect that the only data they're retaining is about email subscriptions, and that it will only be used internally and not sold to 3rd parties.
If someone has strict privacy needs, why wouldn't they read the privacy policy? Read it or don't read it, it's your choice. But if you choose not to, don't complain that the terms you agreed to don't work the way you arbitrarily expected them to. That's on you, it's not unethical that the terms don't work the way you want them to.
So you've read every TOS for every iTunes, or Android, or Windows update, ever? And if not, you'd be fine with handing over the keys for your house if one of them had a sentence in there that transferred it to Apple/Google/MS?
If you take out a loan from a loan shark, you should probably know what to expect. That doesn't mean that the loan shark isn't breaking the law when you get roughed up for non-payment.
Also, the thing is this is not really the loan shark situation.
People who go to loan shark know exactly what they're getting into--borrowing money.
People who signed up for unroll.me signed up because they got sick of all the the spammers and wanted to get away from all that easily.
Most people including me, thought they would somehow monetize with ads or something like that, but never thought they would sell our info to 3rd parties like this. So No, it wasn't at all obvious what to expect.
I'm sure it's buried somewhere in the Terms of Use. Contemporary terms of use are a classic dark pattern. If one would like to setup an useful ML project, take as input Terms of Use, spit out the highlights, the buried ledes, such as user data being sold.
Wasn't there a project similar to that featured on here at one point? I don't think it used sophisticated machine learning or anything, but it used basic keyword search to produce "plain English" summaries of ToS. I remember it being somebody's hobby project; I can't seem to find it now.
This is why I didn't and never will trust 3rd parties products/services getting accessed to my inbox and reading my emails wholesale in order to mine data or provide value.
Paribus is another of such services that I am aware that require you open your inbox access to them (the pull model).
There is nothing wrong with reading your emails with your explicit consent but I believe a push model like TripIt/Kayak's previous push model (send email receipts to trips@tripit/kayak.com) is a safer way to avoid privacy being violated and abused.
I was a little creeped out when--long after I deauthorized the app and enabled 2FA on my Gmail account--I got an email from them saying "We've found 141 new subscriptions". I wonder if that was just marketing spam, or if they have a weird way of accessing my email still.
Oh, that's what I meant by "deauthorized the app". I removed it on the Google side, and shortly after even got an email from Unroll.me saying that it no longer had access. So I was surprised to see an email a couple months later saying they'd found more stuff to unsubscribe from. It could have been a bug or just a message they sent to everyone who'd unplugged their email, but was quite jarring.
What do you guys think of Mixmax? Heard of people liking their service for making appointments within Gmail, and e.g. receiving read receipts. From their privacy policy:
> [...] Mixmax may securely access or store your name, your Gmail email address, your Gmail emails and other conversations, and your Gmail contact list [...] We may anonymize your Personal Information so that you are not individually identified, and provide that information to our partners.
Seems to be a recurring theme for services that scrape your email inbox. For example, see https://context.io which is a popular service for building these kinds of apps. They clearly state that the free version is funded by collecting anonymized data from the end users' email inboxes.
Yes thanks I just deactivated unroll.me
and deleted my account, make sure you change your email password and deny them access from your email provider as well.
> Their whole value proposition is to help people control their own privacy and now I kind of feel betrayed..
Really? I never got that. While I'm also a little unsettled by the selling data part, the value prop was always pretty clearly simplifying unsubscribing en masse, which necessarily involved handing over access to the contents of your emails.
> Wow I think this unroll.me thing is the real scandal here.
How is it a scandal? Competitive intel is a normal and widespread thing and it's not a scandal that people don't read a privacy policy that says, "We may collect, use, transfer, sell, and disclose non-personal information for any purpose."
> it's not a scandal that people don't read a privacy policy that says, "We may collect, use, transfer, sell, and disclose non-personal information for any purpose."
That companies are allowed to have such a non-privacy policy damned well should be. The number of privacy policies I'd have to read on a daily basis to function on the Internet is ludicrous and it is only because of my job working for companies like that that I know that those privacy policies exist in the first place.
I am an unroll.me user, but had no idea they sell user data to companies this way.
Their whole value proposition is to help people control their own privacy and now I kind of feel betrayed..