by For all of us who were not aware of what Superhuman is, let’s investigate together and understand why there’s a huge controversy around the privacy violation that took place. I first heard about this on John Gruber’s The Talk Show (Overcast link with the time they start talking about this). For what I’ve gathered so far Superhuman is a Gmail client that focuses on speed, design, and getting you through your emails as fast as possible. They use the same marketing technique as Gmail when it first started back on April 2004 (April first by the way but and, at the time, it looked like a prank to offer 1Gb of storage), where you need to be referred by another user to “get in“ the service. And by “get in“ I mean paying them $30 a month.
The Privacy Violation
What got them in some trouble was this post from Mike Davidson called “Superhuman is Spying on You.” He focuses on the read receipts feature where, as you send an email using Superhuman’s interface, you can track if the recipient of the email read the email, how many times and, based on their IP location, where are they reading the email. Each email will contain a 1×1 image with a unique id so that, when the user opens the email, the Superhuman fetches the image from the server and, since it’s unique per email, they know when and where it was accessed.
Mike Davidson goes further by saying:
Superhuman never asks the person on the other end if they are OK with sending a read receipt (complete with timestamp and geolocation).
And he’s right. Its a total violation of the user’s privacy.
But….
There are others: Newton Email
Back in 2017, I was using an email client called Newton Email. I liked it a lot, especially the read receipt (that they still provide). Back then, I inquired about this feature and got the following answer from their support:
When sending a tracked mail, Newton will embed an invisible image into the mail body. Whenever, your recipient reads the mail, their client will make a request for this image which will be recorded and shown to you as a read action.
I asked them point-blank:
Just for me to understand something. You have access to my emails?
Reply:
Yes, we do proxy emails through our servers.
If you are worried about privacy, I would like to inform you that only select developers will have access to the data and all employees have an NDA -https://cloudmagic.com/k/privacypolicy
In case you need any more clarity, feel free to write back.
This got me quite uncomfortable and got out of the service as soon as I could.
One More: MailChimp
MailChimp is a platform used by millions of people to send newsletters. Everyone uses it because it’s cheap (or free in some cases) and you can target a lot of people with your marketing message. Even Mike Davidson’s himself uses this service as the platform used to send newsletters.
I’m not implying anything with this statement. MailChimp’s main selling point is to help their customers understand what the best people to send newsletters are. They can only know this by tracking who opens the newsletters in the first place. That’s all fine; it’s a common feature in email marketing and, full disclosure, I use MailChimp also to send newsletters in other portals I manage.
What I am saying is that we need to look at the overall market and, if one company gets into trouble because of a feature that hundreds of other companies and similar products offer, we should look at the underlying problem. You receive thousands of newsletters a day, and all of them have this enabled, and you’re ok with it.
Public perception
John puts it best in his show:
The main issue is the public’s perception. You don’t know what’s happening and when companies do this kind of privacy violations. Here’s another clip that focuses on this idea:
It’s creepy as hell to have the geolocation part enabled by default with no choice by the receivers of the email to protect themselves.
What can we do to protect our privacy?
You can protect yourself in multiple ways; some of them are already on by default. Let’s look at Outlook, for example. Have you seen this message recently?
This means that Outlook won’t load any image from outside, blocking the tracking for you.
In iOS, you can block this too. Just go to:
- Select
Settings - Select
Mail - In Messages you’ll find
Load Remote Imagesand turn it off:
In macOS, you can do the same by:
- Open your Mail app
- Select
Mail - Then go to
Options - Finally
Viewing - Turn off
Load remote content in messages
Please note that this will avoid loading all images, visible or not, so you need to tap the button to see the images, but now you know the consequences of doing so.
Was there a privacy violation?
Yes, but this is nothing new, but I’m happy that both John Gruber and Mike Davidson are bringing light into these practices. People are unaware that this happens and that they violate their privacy. This got some traction, and we got articles in the New Yorker, The Verge, and Engadget, to name a few.
Superhuman’s CEO made a blog post also explains what the changes being done are. In reading it, I can understand the reasoning. Email clients are competitive enough, and they tried to get ahead by adding features like this to justify the service, not fully thinking about the privacy implications. Now let’s look at Superhuman’s actions. They replied quickly (24h), apologized, changed the service to cope with the complaints, and wiped the data (present and past). They did the right thing quickly in trying to fix an issue created by them. That’s something we may not say about most companies (yes I’m thinking about Facebook).
Have a suggestion of your own or disagree with something I said? Leave a comment or interact on Twitter and be sure to check out other privacy-related articles here.
Featured Image by Andre Hunter on Unsplash
