Sunshine Contacts may have given out your home address, even if you’re not using the app

A third-party contacts app you’re not using may be handing out your home address to its users. In November, former Yahoo CEO and Google veteran Marissa Mayer and co-founder Enrique Muñoz Torres introduced their newly rebranded startup Sunshine, and its first product, Sunshine Contacts. The new iOS app offers to organize your address book by handling duplicates and merges using AI technology, as well as fill in some of the missing bits of information by gathering data from the web — like LinkedIn profiles, for example.

But some users were surprised to find they suddenly had home addresses for their contacts, too, including for those who were not already Sunshine users.

TechCrunch reached out to Sunshine to better understand the situation, given the potential privacy concerns.

We understand there are several ways that users may encounter someone’s home address in the Sunshine app. A user may already have the address on file in their phone’s address book, of course, or they may have opted in to allow Sunshine to scan their inbox in order to extract information from email signature lines. This is a feature common to other personal CRM solutions, too, like Evercontact.

In the event that someone had signed an email with their home address included in this field, that data could then be added to their contact card in the Sunshine app. In this case, the contact card is updated in the Sunshine Contacts app, which then syncs with your phone’s address book. But this data is not distributed to any other app users.

The app also augments contact cards with information acquired by other means. For example, it may use the information you do have to complete missing fields — like adding a last name, when you had other data that indicated what someone’s full name is, but hadn’t completed filling out the card. The app may also be able to pull in data from a LinkedIn profile, if available.

For home addresses, Sunshine is using the Whitepages API.

The company confirmed to TechCrunch it’s augmenting contact cards with home addresses under some circumstances, even if that contact is not a Sunshine Contacts user. Sunshine says it doesn’t believe this to be any different from a user going to Google to look for someone’s contact information on the web — it’s just automating the process.

Of course, some would argue when you’re talking about automating the collection of home addresses for hundreds or potentially thousands of users — depending on the size of your personal address book database — it’s a bit different than if you went googling to find your aunt’s address so you can mail a Christmas card or called your old college roommate to find out where to send their birthday gift.

However, Sunshine clarified to TechCrunch that it won’t add the home address except in cases when it determines you have a personal connection to the contact in question.

Here, though, Sunshine enters a gray area where the app and its technology will try to figure out who you know well enough to need a home address.

Before adding the address, Sunshine requires you to have the contact’s phone number on file in your address book, not just their email. That would eliminate some people you only have a loose connection with through work, for instance. And it only updates with the home address if the partner API is able to associate that address with a phone number you have.

In addition, Sunshine says that it’s generally able to understand the type of phone number you have on file — like if it’s a residential or business line, or if it’s a landline or mobile number. (It uses APIs to do this, similar to StrikeIron’s though not that particular one.) It also knows who the phone number belongs to. Using this information and further context, the app tries to determine if a phone number is a personal or a professional number and it will try to understand your relationship with the person who owns that number.

In practice, what this means is that if all the information you had on file for a contact was professional information — where they worked, a job title, a work email and a phone number, perhaps — then that person’s contact card would not be updated to include their home address, too.

And because many people use their personal cell for work, Sunshine won’t consider someone a “personal” relationship just because you have their mobile phone number. For example, if you had only a contact’s name and a cell number, you wouldn’t be able to use the app to get their home address.

The result of all this automated analysis is that Sunshine, in theory, only updates contact cards with home addresses where it’s determined there’s a personal relationship.

This, of course, doesn’t take into account some scenarios like bad exes, stalking or a general desire for privacy. Arguably, there are times when someone may have a lot of personal information for a contact in their address book, but the contact in question would rather not have their home address distributed to that person.

The only way to prevent this, presumably, would be to opt out at the source: Whitepages.com. (Once you have your profile URL from the Whitepages website, you can use this online form to have your information suppressed.)

The way the app functions raises questions about what is truly private information these days.

Sunshine points out that people’s home addresses are not as hidden from the world as they may think, which makes them fair game.

It’s true that our home addresses are often publicly available. Although it’s been years since most of us have had a telephone directory dropped on our doorstep with phone and address listings for people in our city, home addresses today are relatively trivial to find when you know where to look online.

In addition to public records — like voter registration databases — there are web-based people finders, too.

Sunshine’s partner, Whitepages.com, makes visitors pay for its data, but others like TruePeopleSearch.com don’t have the same paywall. With someone’s first and last name and city, its website provides access to someone’s home address, prior addresses, cell phone, age and the names of family members and other close associates. (TruePeopleSearch is not a Sunshine partner, we should clarify.)

Even though this data is “public,” it’s uncomfortable to see it casually distributed in an app, as that makes it even easier to get to than before.

Plus, after years of being burned by data breaches and data privacy scandals, people tend to be more protective of their personal information than before. And, had they been asked, many would probably decline to have their home addresses shared with Sunshine’s user base. Generally speaking, people appreciate the courtesy of having someone come ask for a home address, when it’s needed — they may not want an app creeping the web to find it and hand it out.

Sunshine Contacts is in an invite-only beta in the U.S., so the company has time to reconsider how this feature is implemented based on user feedback before it becomes widely available.

Source: Tech Crunch