If you’ve been following the news, you might know that WhatsApp recently updated its terms and privacy policy – meaning that the app now demands to share your data with Facebook and other third-party services. But it’s not just WhatsApp… plenty of personal finance apps share personal data with third parties, too. To lift the lid on this murky practice, Surfshark analyzed the privacy policies of over 200 apps to find out which collect the most data and which collect the least.
Alternate Apps That Require Less Data
We compared privacy policies based on the 32 types of data that the Apple Store flags through their “nutrition label” initiative. Each colored square represents one type of data that each app collects. For example, Popcornflix harvests two types of Contact Info (name and email), one type of Location Info, one type of Identifier (device ID), and one type of Usage Data (product interaction).
Five of these apps don’t collect any data from their users (at least, not any that they were required to disclose to the Apple Store). These include navigation app InRoute and personal finance organizer Mvelopes. We found two more data-free apps in our study, Pixelmator (image editing) and Dust (messaging), which don’t appear on this table as there is already a zero-data app from their category.
How do apps generate income without selling their user’s data? Some, such as the image editor Pixelmator, charge a small fee upfront. Others, such as Cisco Webex Meetings, offer both free and premium versions (aka freemium.) Following another popular pricing strategy, Mvelopes suggests in-app purchases.
Which App Categories Demand the Most Data?
Social media apps share secrets, while the food delivery category is a data glutton. Both categories tracked an average of 20 out of 32 possible data types. Shopping (18 types of data), Dating (16 types), and Payments (15 types) round out the top five categories.
Browsers and imaging apps occupy the low end of the scale, each tracking six categories of data. Many ‘alternative’ browsers such as Brave and DuckDuckGo focus on privacy as their selling point. Their creators deliberately developed them not to track as much data as their better-known browsers like Google Chrome.
Privacy Tool: Find the Best App for Your Needs
Surfshark has compiled an interactive table to help you find the least data-hungry app for your needs. Select the category of app you are looking for (weather, dating, finance, etc.) and toggle the results based on what type of data you are willing to share
The Most and Least Hungry Apps for Everything
Some apps are hungrier than others, even within each app category. Surfshark has stacked up the data types required by the most popular apps for each purpose to show all the alternatives at a glance.
The big three—Gmail, Outlook, and Yahoo Mail—are all data hogs, with Gmail demanding 19 data types. There are no download numbers for Apple Mail, which requires just Name, Email, User ID, and one type of usage data (Product Interaction). Spike only takes 3 data segments: User and Device ID, and Product Interaction.
Messaging & Video Calls
Messaging apps may be where we share our most complex and useful data about who we are and what we want. Most messaging apps harvest multiple data types. Facebook Messenger, for instance, tracks 32 out of 32 possible data categories. However, three apps studied were designed with privacy in mind: Cisco Webex (0 data types), Dust (0), and Signal (1).
Social Media
Social media is the doorway to the internet for many, and it encompasses many of the functions offered by other app types (shopping, messaging, etc.), making its data uniquely valuable. It is also tough to quit, a fact that Facebook and its property Instagram take advantage of, demanding all 32 data types for both apps.
Streaming
Google’s video player, YouTube, leads the pack with 24 data types, but just try getting through a week without landing on YouTube. Art and indie film streaming apps Mubi and Kanopy offer a low-intrusion experience. Big boys Netflix, Hulu, and HBO Max are all mid-range, with 11-13 data types.
Browsers
On average, browsers are quite privacy-conscious. ‘Alternative’ browsers are often designed with data privacy in mind. However, big players Chrome and Bing each track nearly half of all possible data types. Cake – despite advertising itself as a more private browser – does the same.
Payments
Paypal has long been at the heart of the online retail ecosystem. The payment app collects 26 data types, followed closely by Venmo with 21. MoneyGram is a leaner alternative, collecting 8 types of browser data through its website, but not through its iOS app.
Shopping
It’s tough to resist the might of Amazon, even if it collects a whopping 26 data types. While this is the highest in the shopping category, it is not an unusual feature: over a third of shopping apps collect information in 20 or more categories.
Food Delivery
Only three food delivery apps collect fewer than 19 types of data, and none collect fewer than 13 types. Doordash and Caviar are real gluttons, each chomping up 24 data types (both of these companies use Doordash’s technology). Food apps tend to require search history access, which may help them learn what you really want to eat tonight.
Flight Booking
Most flight Booking apps collect between 11 and 16 data segments, but Priceline soars ahead with 23. This data-intensive industry has come under scrutiny after mixed reports that your search history may affect the flight prices you are offered.
GPS Navigation
Seven of the 12 GPS Navigators studied collect fewer than 10 types of data. But Maps.me and Waze stand out, requiring 20 and 21 types, respectively. GoogleMaps was not studied; at the time of our research, it was still in the process of complying with Apple’s new privacy labeling.
Dating
Dating is supposed to be personal. However, none of the top dating apps collect fewer than 11 data types. Four apps collect more than 20. It is worth noting that one company, Match Group, owns Tinder, PlentyOfFish, OkCupid, and Match, but each requires different types of data.
Period Tracker
Perhaps the only more sensitive data than dating or finance is health. So perhaps it is surprising that most period trackers are in the double-digits for data collection. Magic Girl was the most anonymous period tracker in our study, requiring only Device ID and Advertising Data.
Pregnancy Tracker
Pregnancy trackers are on a par with period trackers for personal data requirements. Glow Nurture is “powered by data” and includes social media functionality, coming with 19 privacy labels. Sprout, Baby Bump, and Pregnancy App are all minimally intrusive, while Hello Belly only tracks the user’s name.
Kids
Only two kids’ apps collect more than 10 data types: Facebook Messenger Kids and YouTube Kids. However, there are no top apps in our study that kids can use with full anonymity. Studies have found that app developers may be flouting child privacy law, so it is important for parents and children to have an engaged relationship with their online privacy rights and not defer blindly to companies’ claims.
Personal Finance
Mint is the most downloaded personal finance app by some margin, and it’s also the greediest for your data. However, some of this activity is used to connect your different accounts to make the app functional. Most financial apps in our study are more discreet, with Mvelopes and Monefy built for privacy – although, in the case of Monefy, this may limit what it is capable of doing.
Cryptocurrency
The most popular cryptocurrency app, Binance, only tracks 4 data segments. This defies a general trend where the most popular app in each category is often the most data-hungry (i.e., Chrome, Gmail, Amazon Shopping, Facebook). However, the second-most-popular crypto app – Coinbase – tracks 18 types. The least data-hungry crypto app – Crypto Pro – asks only for User ID.
Weather
The most and least data-hungry apps only have a difference of eight data types between them and are relatively modest in their requirements. However, it’s hard to see why Weather Underground needs 13 types of data, location notwithstanding. CARROT Weather is the least intensive; however, you have to put up with jokes.
Image Editing
Image editors tend not to be intrusive. In fact, two of these apps (TouchRetouch and Pixelmator) don’t need any Privacy Label. VSCO is the biggest hitter, with 18 types. In fact, VSCO conducted its own internal audit to make sense of the swathes of user data they were harvesting – much of it intended to inspire improvements to the app.