3 things to do now to check up on your data privacy settings

This week, found itself in an unfriendly spotlight.

is a free service that bundles subscription emails into a daily digest and helps you weed out other junk that clogs up your inbox. To make money, the company sells anonymized information scraped from its user's email accounts. The practice surfaced for much earlier this week after reading a New York Times report on Uber chief executive Travis Kalanick; that article mentioned that Slice Intelligence, which owns sold information to Uber about rival company Lyft, based on emailed Lyft ride receipts. The act sounds nefarious, but it’s legal and it happens more than you might expect.

I think the reason that a lot of people were very surprised by this behavior, is that if you go to the main homepage of Unroll.Me, it says this ‘is a free service, says Jason Hong, an associate professor of computer science at Carnegie Mellon University and an expert on privacy. What it doesn’t say, Hong points out, is how they monetize the service, and what they do with your data. For that, of course, you need to read the privacy policy—and who actually does that?

Allowing companies to access your email, in general, is incredibly risky, he adds.

So what’s a privacy-minded internet-user to do? Here are three strategies.

Think about how the app is going to make money off of you

There’s an internet adage: If you’re not paying for the product, then the product is you. And that applies to Unroll.Me. You weren’t paying for it directly, but they were figuring out how to monetize your data in some way, says Hong.

When you do pay for a service, on the other hand, it’s easier to understand how the company’s model works.

Alexander Obenauer, who started a paid service called Throttle that has a similar function as Unroll.Me, says that his company does not sell customer data in any way—not even anonymized. Instead, they make money by charging for their product.

When a product is free, so often that comes with baggage, Obenauer says.

And Boomerang, an email management service that offers features like letting people schedule a Gmail message to be sent later, maintains that they do not sell data, and that’s because they charge for it, too. At Boomerang, we make our money from paid subscription upgrades,” Alex Moore, CEO of Boomerang, said in an email via a PR representative. “We don't sell any data, and never have.

Try to read that privacy policy

It’s obvious that reading the privacy policy is a pain, and according to Professor Hong, it’s rational not to read it: It takes forever, and it’s confusing, so there’s no payoff to the task. An eagle-eyed reader of privacy policy would notice that it does say that it might “collect, use, transfer, sell, and disclose non-personal information for any purpose has responded to the blowback in a blog item on their website.

They intentionally use certain kinds of vague language,” Hong says, pointing out that. Almost every privacy policy and terms and conditions are like that. Hong’s team is actually working on a service that will help surface key phrases—for example, language that pertains to financial charges a customer might face— from terms and conditions statements that consumers should be aware of.

A similar project is called Terms of Service; Didn’t Read that evaluates companies’ terms of service statements and puts them into classes, like “Class Android users can visit PrivacyGrade, which is run by Hong’s team and assigns a letter grade to apps based on their use of something called a third-party library—code written by someone other than the app developers themselves (for example, advertisement-related software, or even just a library to help integrate Facebook into an app) that might give the researchers a clue as to what happens with customer data.

In general, think critically about what permissions an app or service is asking for when you install it. Be very conservative about installing all these apps, Hong says, because, the challenge today is that it’s so easy for your data to flow outwards.