The Bump Pregnancy Tracker & Baby App

Reading The Bump's privacy policy was quite the bumpy ride! The Knot, the parent company of The Bump, has a privacy policy that covers all the apps and websites and it is quite the read. Honestly, if you want to see what a bad privacy policy looks like, this would be a good one to read. It's long, it's hard to follow, and it uses too many vaguely worded statements that start with "for example" and "may." If you don't want to read it, here's the tl;dr: The Bump collects a whole bunch of information, gathers even more information on you from data resellers and social media, uses and shares all the personal information for lots of things like lots of targeted, interest-based advertising, personalization, potentially sells your information, and doesn't really give users much control over their information. All in all, it sucks.

Let me break it down for you a little bit more. The Bump says they can collect a whole bunch of persona; information on you from lots of places. They can collect name, email address, postal address, precise location, phone number, wireless device address, gender, interests, lifestyle information, and hobbies, photos, videos, and of course all that personal health information you give the app like doctor visits, baby photos, symptoms, and more. The Bump also says they can collect information on you from third party sources like data resellers (brokers), social media sites, and public sources and combine that with all the other data they've collected on you. Yup, The Bump knows a whole lot about you. They love information!

What does The Bump say they can do with all this information they gather on your from all over the place? Well, share and potentially sell it. Which is bad. They say they can share your data with lots of third-party online advertisers and ad networks, all their business affiliates, service providers, and other third-party partners for marketing and to offer co-branded products or services. They share it with soooo many third-parties it's rather heads spinning. They also go on to say, "We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and sponsors, in our discretion." Yikes! This practice always concerns us because it's been found to be pretty easy to re-identify such data, especially if location data is included.

So, basically, The Bump seems like it wants collect as much data on you as possible from as many sources as they like, take all your data and share it around to sooo many third-party advertisers and affiliates to make as much money off it as possible. Yuck! This is maybe not what you expect to happen with all your personal information when you are expecting? We sure hope not.

When it comes how The Bump says they can share data with law enforcement, yeah, that worries us a little too. Here's what they say in their privacy policy, " By using the Services, you acknowledge and agree that we may access, retain, and disclose the information we collect and maintain about you if required to do so by law or in a good faith belief that such access, retention or disclosure is reasonably necessary to: (a) comply with legal process or a regulatory investigation (e.g. a subpoena or court order)." Here at Mozilla we like to see companies clearly state they won't give up user data through voluntary disclosure, and they won't give up user data to law enforcement unless required to under subpoena (and even then, we like to see them commit to only giving up the bare minimum necessary). The Bump's privacy policy on this does mention subpoenas and court orders, which is good, but is also still a little too vaguely worded to be clear on this issue, in our opinion.

Let's not forget about those security concerns we found with The Bump. The app doesn't meet our Minimum Security Standards because we found we could log in with the weak password "111111". If you do use this app, please use a stronger password, as one won't be required as sign up. Also, we emailed the contact listed in The Bump's privacy policy four times with our privacy questions. We received no response from them so we are unable to tell if they use have a way to manage security vulnerabilities and use strong encryption in transit and at rest. Not good for an app that collects so much personal and health related information.

What's the worst that could happen with this app? Uhg, well, if you do use The Bump, count on see lots and lots of ads following you all around the internet trying to sell you lots of pregnancy and baby products. Which might be fine. It also might not be great for your mental health is you're a woman forced to carry a pregnancy to term that you don't want to because you live in a state where abortion is not legal. That could go very poorly.