Thread by @chronic

this number seems low and is a big reminder that I will need to get more info pushed out to the public about this. WSJ did good work but only scratched the surface.

https://twitter.com/samschech/status/1098986421220769792

also surprised they didn't dig deeper on period trackers. there is some odd stuff.

example: Period Tracker Lite (#30 in Health/Fitness, 20k+ reviews, itunes.apple.com/us/app/id33037…) sends 'fact of' sensitive actions, like start of a period, or marking the user was intimate, to Apsalar.

not too hard to find by looking at the network traffic. for Period Tracker Lite example above, you'll see 'add_period_start' and 'add_note_intimate' and such in the outgoing GET requests as you perform the action.

Period Calendar (#32 in Health & Fitness, 35,000 ratings, itunes.apple.com/us/app/id89650…) communicates often with Google Analytics. what data it sends is a bit harder to judge precisely, because some of the content they send to appears to be obfuscated or in an odd format.

best I can say about that one without speculating much: that app allows you to enter some extremely personal information, and right after doing so there is a flurry of connectivity to Google Analytics. watching that is quite unsettling, even if it's not clear what data is sent.

My Calendar - Period Tracker (#174 in Health & Fitness, itunes.apple.com/us/app/my-cale… / com.lbrc.PeriodCalendar) sends more granular information to Google Analytics, such as mood and intercourse entries (as specific as whether protected / unprotected)

Dot Fertility Tracker (itunes.apple.com/us/app/dot-fer…) sends Flurry Analytics information about what contraceptive methods are used, if recently pregnant, and other bits of info. this occurs even if the age is set to be under 18.

Spot On by Planned Parenthood (#132 in Health & Fitness, itunes.apple.com/us/app/id10399…) sends "days in cycle" plus contraception method information to Segment[.]io when entered. will include additional detail if applicable (ie. for IUD it'd also send type like "Mirena")

no clue if this is just extreme carelessness on the developer's side or what. either way, pretty weird to have that sort of data stored with a third party, in my opinion.

WSJ highlighted Facebook's role, but tracking is really a wider issue, Facebook just plays a part in it.

probably a whole lot more similar activity elsewhere too, for what it's worth. the above stuff is only what I have already fully verified (was putting something together for guardianapp.com/reports.html on the topic, but ended up on back-burner as I dealt with other matters).

oh almost forgot, above info is just a few examples of data being uploaded to a third-party. the wild thing is, most apps in this category upload data to their own API, without being clear to users that the data is stored online at all (most users probably expect local storage).

here's an odd one. this app (itunes.apple.com/us/app/id72079…) will upload user info (including location long/lat if permission is granted under guise of obtaining weather info), without user notice, to xjt3g2fl3l[.]execute-api[.]us-east-1[.]amazonaws[.]com via PUT request, as a CSV (???)