Whisper app has published its new terms of service and privacy policy

http://www.theguardian.com/world/2014/oct/16/-sp-whisper-privacy-policy-terms-of-service

Version 0 of 1.

Whisper, the app which claims to be “the first completely anonymous social media network”, has introduced changes to its terms of service.

The new terms of use and privacy pages appeared on Whisper’s website on 13 October, 2014.

A previous version of this article suggested the changes to Whisper’s terms of service were a direct response to the company having discovered, four days earlier, that the Guardian planned to write a story about a number of company practices.

In fact, Whisper had drafted the update to its terms and privacy policy months earlier, in August, 2014.

Tracking users who have opted out of geolocation

Whisper’s new policy maintains that geolocation services are voluntary, but contains a get-out clause. The terms now tell users to “please bear in mind that, even if you have disabled location services, we may still determine your city, state, and country location based on your IP address (but not your exact location).”

Sharing information with the Department of Defense

Whisper has been sharing information with the US Department of Defense, for a research study into suicides, without notifying its users. No specific user or personal data has been shared for the research. Previously, Whisper’s terms and conditions contained no wording that explicitly related to sharing of data for government or educational research.

The company’s new terms explicitly allow for these kinds of data-sharing projects. They state: “We may also partner with universities or other research institutions or scientists to use the limited information we have in anonymous, controlled research studies.”

Data stored or processed outside the US in places like the Philippines

Whisper uses a company in the Philippines to constantly monitor messages posted on its app to stamp out inappropriate behaviour.

Whisper’s new terms advise that the company process and stores “all information in the United States or other countries where our service providers may be based”. The new terms add: “This may be important to you, as the laws of the United States or such other countries may not be as protective of your personal information as the laws of your jurisdiction.

Information shared with law enforcement bodies like the FBI

Whisper executives told the Guardian they passed user information to law enforcement bodies like the FBI when they believed there was a serious and imminent threat to life.

Whisper has detailed instructions for law enforcement agencies who wish to obtain user data on its website and they remain unchanged.

The company’s newly updated contract with users contains a portion that makes it clear that Whisper takes a proactive approach to passing information to law enforcement bodies. “We may monitor User Content and where deemed appropriate take proactive steps, including without limitation notification to appropriate authorities,” the new terms state. “You hereby expressly acknowledge and agree to such monitoring and that we may disclose information and data that might lead to your identification if we, at our sole discretion, deem it appropriate to protect you or others from serious harm.”

How anonymity on Whisper can be compromised

Whisper trades on the promises it makes to users about anonymity. Its previous terms and conditions did not specifically mention anonymity, although a privacy section said the company “is committed to protecting your privacy and the security of personally identifying information”. The company’s new terms are worded slightly differently. “Our goal is to provide you with a tool that allows you to express yourself while remaining anonymous to the community,” the new policy states.

Whisper’s new terms specifically caution users not to include personal information in their messages if they want to preserve their anonymity. They also warn users of the risks of turning on geolocation services, which alert other users to their general location. “Therefore, even if you do not include personal information in your whispers, your use of the Services may still allow others, over time, to make a determination as to your identity based on the content of your whispers as well as your general location,” the new privacy policy states. “We encourage you to be careful and avoid including details that may be used by others to identify you.”