If it’s Free, You’re the Product ~ Unroll.me is Selling Your Information

Have you ever used Unroll.me, the web service that helps you unsubscribe from newsletters in bulk? If so, your emails have been scanned by that company and sold to third parties including Uber. There’s a chance they’re scanning your emails right now. As we find Privacy, Security and Reliability as the first to any second service available online, we’ve decided to publish this article.

As Mr Justin Pot stated: “If you want to switch tabs right now and remove third-party access to your email account, I don’t blame you. It’s the first thing I did when I found out. Come back when you’re ready, though, because I know you’re curious how Uber is involved.”

You might be aware that Uber is having, shall we a say, a difficult few months in the public relations department. The latest incident is a New York Times profile of CEO Travis Kalanick, which reveals the company was fingerprinting iPhones against Apple’s terms of service—Apple CEO Tim Cook reportedly threatened to pull Uber out of the App Store altogether over it. That’s what made headlines yesterday, but scroll down a little further and you’ll find this tidbit about a company called Slice Intelligence, which Uber hired to do market research.

“Using an email digest service it owns named Unroll.me, Slice collected its customers’ emailed Lyft receipts from their inboxes and sold the anonymized data to Uber,” the article states.

We All, Including You, Got Played

I personally tried using Unroll.me only once, a few years ago. If you’re anything like me, a few things came to mind after reading all about the latest events.

Luckily, some of us are cautious against the overwhelming values of gifts we can receive while trying out the innumerable online service, for example: viruses, malware, ransomware, data collection, information exchange, privacy concerns. So some of us try it, but not register while others pursue the benefits and might get busted at some point.

3 questions arising:

1. Is Unroll.me really owned by a market research company? When did that happen?
2. That company scans people inboxes for reasons other than finding newsletters?
3. Does this thing still have access to my emails?

When I first used Unroll.me, the service was a two-person startup. I had no idea the service was still enabled on my Gmail account all these years later, and I had no idea that a market research company with a villainous name had since bought the service.

We admit it: We got played. We now feel betrayed. And we’re not the only ones. If you tried it anytime, you got played up as well.

We apologise: To whoever we’ve ever recommended @Unrollme over the past couple of years, if any. And we’re also aware of our IT friends, using it still today, and recommending it to others.

If the service is promising a lot, and if it’s Free Service and if you’re not paying for it, well, then at its bitter end it means: You’re the Product!

An uproar against Unroll.me quickly surged, and with a good reason.

Is This Legal?

This is completely legal. Unroll.me doesn’t exactly go out of its way to advertise that it’s selling anonymized information from your inbox to third parties, but the information is there for anyone willing to dig for it. The Unroll.me privacy page specifically allows for “sharing” your information:

“We may share personal information we collect with our parent company, other affiliated companies, and trusted business partners,” the page says. It’s not clear, but the language allows for selling off information. The Unroll.me team, for their part, have issued an apology best summarized as “sorry not sorry.”

One of Unroll.me co-founders expressed his concerns with: “Our users are the heart of our company and service. So it was heartbreaking to see that some of our users were upset to learn about how we monetize our free service.”

After that sarcastic-sounding introduction, the post points out that the language of the company’s privacy statement allows them to do exactly what they’ve been doing. Only after stating that do they admit the transaction could be a touch more transparent, and specifically state that they’ll add this information to their on-boarding process and Frequently Asked Questions page. That information should have been there all along.

But if we are honest, this is mostly ours, or end-users fault. We, as end-users, signed up for a free service, and gave that service access to our inboxes. Then we let it keep that access for years. We shouldn’t have left it enabled that long. If it’s Free, we’re the product.

In any case we highly recommend, if you want to keep control over subscribed emails, to use disposable emails like: Byom.de, or MailCatch.

How to Delete PersonalUnroll.me Account?

Are you wondering how to delete your Unroll.me account? Go to Unroll.me and log in. Click your username at top-right, then click “Settings.” 

You’ll find your settings, which includes an itsy bitsy “Delete my account” button. Click it .. and just like that, your account will be gone.

How to Remove Unroll.me from Gmail Accounts?

We also recommend you make sure Unroll.me doesn’t have access to your Gmail account, which you can do by heading to myaccount.google.com, then clicking the “Connected Apps and Sites” link.

From here you’ll see a list of sites with access to your Google account. If you find Unroll.me in that list, disable it. There’s a chance that Unroll.me will email you after you do this. Savor the irony for a bit, then click “Unsubscribe.”

An Re-assuring Epilogue, really?

J. Hedaya promised to make it clearer to users exactly what Unroll.me does with their data, including adding new messaging to the website and app, and a disclaimer about data usage when users sign up for the service.

“I can’t stress enough the importance of your privacy. We never, ever release personal data about you. All data is completely anonymous and related to purchases only,” Hedaya said.