iOS Apps Want Your Contacts, not Just Path

I develop iOS apps, I also hold the indie developer scene upto high moral standards. By extension iOS developers get given the benefit of the doubt from me, they are interested in making fun, beautiful interesting applications. Sweet. However as it is said, unless you paid for it, you are being sold. Never is it more true than in the startup crazy VC funded world.

Companies that are building “eyes orientated” products that rely on hundreds of thousands of users downloading the app and using it are after your data. In iOS, location data requires user permissions, Contacts and Music libraries don’t. Guess what these apps upload as soon as you open it. They are after your data, all of it they can get their grubby little mitts on.

I was recently working on a contract for and application that wanted Contacts, Music and Data all uploaded to their servers. Move location, they want a notification. Take a dump, they would have wanted a notification. The ammount of data they wanted to be uploaded was excessive and outrageous, I felt dirtier with every line of code I wrote. Oh yes it is their privacy policy that they are taking all this information, and their excuse is analytics an anyway everyone else is doing it…

Reality

Most of these startups however are struggling to ship their own code or they are out there hunting more money. They don’t have the time to run big data queries on this data. Now us in the know, us geeks and nerds get all uppity and throw our toys out the pram when this sort of thing comes to light, and rightly so. Consider this though, how is asking for this information going to change anything though? I bet 99% of the population simply say “ok” to permission notifications, or accepts default user options when they install the app. So suddenly we’re in the same situation anyway.

Solution

There really isn’t a solution is there, so many apps even an independent audit of all the apps would take years. Apple to remove the Contacts API? It’s not really like Apple to ever remove an API is it?