,
7 tweets,
3 min read
Read on Twitter
1/7: I hope I'm overlooking something here, but the Android app for @spond - the service for organizing sporting events etc. - seems to be uploading my complete phone book the moment I log in. 
2/7: If you are running Android 5.1 on or lower you have on install time granted the app permission to read your contact list and access the Internet. The moment I log in hashed values of all the phone numbers and e-mail addresses in my phone book are uploaded to their server.
3/7: Any changes I do to my contact list triggers the app to immediately upload the changes in the background.
4/7: As far as I can see they state that access to the contact list is used when you invite people to your events. Yes, this is when the permission is requested on Android 6 and on, but the moment they have that permission they keep uploading your contact list.
5/7: What's more - but this is clearly stated in their privacy statement - is that any @spond user - either by uploading your phone number or attending to the same event will get hold of any personal information you have registered.
6/7: Here's a screenshot of the personal information you get by giving in a phone number. First name, last name, profile image, phone number, e-mail addresses etc. Obviously 34 of my contacts are using the app. Sorry to all of my 150+ contacts for using the app.
7/7: Why does @spond need to *constantly* *upload* *all* of my phone numbers and e-mail addresses? It does so the moment you log in on Android 5.1-, and the moment you grant access on Android 6+. Wonder what The Norwegian Data Protection Authority @Datatilsynet thinks about this.
