Venmo, Noom and even Solitaire shared my personal info with data firms

Many of us have ditched cash and, instead, use smartphone apps like Venmo to pay for goods and services. 

The app is free, it takes just a second to initiate and finish a transaction. I don’t have to write a check or pull out some cash. It’s great. 

But you know what, there’s no such thing as free.

I discovered this week that when I opened PayPal-owned Venmo to pay my personal trainer, the app recorded my GPS location (home address) and the trainer’s name, and sent it off to Braze, a third-party data collection firm. 

Think about that for a minute. You use the app to pay your bill, and, in return, some company you’ve never heard of now has your address and associations. How icky is that? 

“How would the CEO of PayPal feel about his home address and contacts being shared with third-party data collection firms?” asks Patrick Jackson, the Chief Technology Officer for security firm Disconnect. 

Probably just like I did – a little sick to the stomach. 

Jackson took control of my iPhone this week to help me understand just how badly I was being tracked. His firm Disconnect was able to see which companies were sharing my information when I used apps. 

It was worse than you could imagine. 

Our digital privacy and what we can do to tackle the onslaught from all these firms that want to snoop into our lives takes a big spotlight Monday, with the annual RSA conference, which is devoted “to stand against cyberthreats around the world.”

And nowhere are cyber threats more prevalent than on our smartphones. Just ask Amazon CEO Jeff Bezos, whose phone is believed to have been hacked by the crown prince of Saudi Arabia, via the Whatsapp communications app. Or Hillary Clinton’s 2016 campaign manager John Podesta, who clicked a malicious link in an e-mail sent by Russians. 

Firms not disclosing sharing our data with third parties

Here at home, it’s all our personal data getting sent to these data collection firms, a practice not disclosed by the companies whose logos are all over our smartphones.

Take the seemingly innocuous Solitaire app that many people use to waste a few minutes with a game that many of us have been playing since the first PCs. My version is from the Chinese company Zenjoy, and Jackson found that it sent device information to Chartboost, a San Francisco based data collection firm. It knew what kind of phone I used, who my carrier is, that I played the game while wearing earbuds, and via a digital fingerprint, it could follow me to other devices. 

“You, as a user, have no idea any of this is happening,” Jackson says. Nor “the level of detail we’re giving up to these companies.”

Noom shared e-mail address

Also this week, I signed up for a “free” trial of weight loss app Noom, and it responded apparently by sending off my e-mail address and device information to the data collection firm Mixpanel.  

Noom is an app that costs $59 monthly to use. I do expect it to mine my data: what foods I’m eating, my levels of exercise activity and the like. I don’t expect it to share this info with a company like Mixpanel, whose mission is to “analyze user behavior.” 

Did I sign up for this? Because I don’t remember that happening. 

Solitaire and Venmo, though, are “free.” We all make a bargain with these types of apps. We don’t pay to use them in exchange for the companies learning about our habits and preferences. 

The problem is, we trust a big company like PayPal with our data, but how do we feel about Braze, Mixpanel and other companies of the same ilk?

“Now they know who you are, where you live and who you’re sending money to, and how safe is that information?” Jackson asks. “What happens to that data?”

What is Braze?

And good luck to the consumer who could figure out exactly what Braze is, based on its own description. The company calls itself “a comprehensive customer engagement platform that powers relevant and memorable experiences between consumers and the brands they love.”

Got it?

We reached out to Venmo, Noom and ZenJoy, but only got a response, sort of, from Venmo.

It declined to answer why it shared my home location and association with Braze. It also declined to answer whether the PayPal app also shares such information with Braze. 

PayPal did say it works with third-party service providers “who assist us in providing services to you” or to provide fraud detection. “Our contracts dictate that these service providers only use your information in connection with the services they perform for us and not for their own benefit.”