Data Backup Digest

At first glance, the new app, known as Care19, looks like a great tool. Developed by a company called ProudCrowd and based out of North Dakota, the app has already been sanctioned as the official app for tracking the spread of covid-19 around the state. According to recent reports, however, Care19 isn't being 100% upfront with its users – especially when it comes to data privacy and data usage.

How it Works

There's no denying the speed at which the Care19 app was developed. Created to address an issue that is, at best, several months old, the app was created from the ground up and released in an incredibly short amount of time.

Care19 works by assigning a randomized ID number to each individual user. From there, it's able to "anonymously cache the individual’s locations throughout the day." Specifically, it notes when the user has spent at least 10 minutes in one particular location. If that user then tests positive for the virus, the data is passed on to the North Dakota Department of Health and attempts are made to contact any people who may have shared that space with them.

Major Data Privacy Concerns

It's simple enough, even if it is kind of clunky, but there are some serious concerns around the privacy of the data generated through Care19. To make matters worse, a recent report has uncovered the fact that Care19 is actively sending user data to other entities, too, including Foursquare, Bugfender, and an advertising platform that appears to be associated with Google.

Complicating the matters even further is the fact that Care19 has failed to inform its users of their data-sharing practices. While this data might not be used for nefarious purposes – Bugfender, is, after all, a bug-tracking platform that could actually improve the software over time – users of Care19 are left wondering why ProudCrowd wasn't upfront with this information to begin with.

Thankfully, the team with ProudCrowd and Care19 has been receptive to the recent report – and they don't deny their data-sharing practices. ProudCrowd has even pledged to update their privacy policy as soon as possible.

"The Care19 application user interface clearly calls out the usage of Foursquare on our ‘Nearby Places’ screen, per the terms of our Foursquare agreement. However, our privacy policy does not currently explicitly mention this usage. We will be working with our state partners to be more explicit in our privacy policy. It is important to note that our agreement with Foursquare does not allow them to collect Care19 data or use it in any form, beyond simply determining nearby businesses and returning that to us."

Moreover, it appears that the inclusion of the randomized user ID, which is included in the app's communications with Foursquare, was unintentional. The company plans on removing that feature as soon as possible, too.

For now, it seems that ProudCrowd is trying to do the right thing. They've already acknowledged their mistake in not being clearer with their privacy policy, and they're now taking steps to strengthen relations with their current and future users.