Shine

Shine's privacy policy is rather hard to decipher at times (honestly, all privacy policies kinda are, but Shine's made our brain hurt just a little bit more). They lead off their privacy policy with what they call the company's privacy assurances. This includes statements like, "We do not sell your Personal Information to any nonaffiliated third parties." and "We do not share your Personal Information with nonaffiliated third parties that would use it to contact you about their own products and services, unless you have allowed us to do so and as permitted pursuant to a joint marketing agreement."

But what do those statements actually mean? Does that mean that they could sell data to any affiliated third parties. Yes, it seems so. Does it mean they may share personal data with marketing and advertising providers. Again, yes it does. And what does you giving them permission pursuant of a joint marketing agreement etc etc. actually look like? It's rather confusing legalese that doesn't make us feel great about their overall privacy practices.

Shine says they can collect a fair amount of personal information on you including first and last name, postal address, email address, and other "identifying information that you choose." They can also collect information such as your annual revenue, gender, and certain demographic information they say they don't consider personal info but rather anonymized statistical data. Shine also says they can receive information about your from third parties including business partners, data brokers, or credit reporting agencies. So much data from so many places! We don't like it.

What does Shine do with all that data they collect? Well, quite a bit of promoting, advertising, marketing, market research and even "to provide you with information about third parties that may be of interest to you" according to their privacy policy. They say they can share your personal information with a whole host of people including marketing or advertising providers, professional advisors, and even Rakuten Advertising, an ad company that can collect their own personal information on you when you interact with Shine. So much data sharing! Again, we don't like it.

They go on to say, as so many mental health app companies we reviewed do, "We may disclose aggregated, anonymized, statistical data and/or non-identifying information about our Users without restriction." And here is where we must remind you that it has been found to be relatively easy to de-anonymize this data.

Shine collects a lot of personal information, shares a lot of personal information with a lot of people and on top of all that, they don't meet our Minimum Security Standards (we were able to log into the app with the weak password "111111". ) All in all, Shine leaves us concerned about their privacy and security practices. Which is a bummer, because we here at *Privacy Not Included firmly believe protecting the privacy of marginalized communities is very important. Here's hoping Shine will step up and do better for the communities they work to help.