Draw This

"You should play Draw Something, it's really good" said a good friend of mine the other day. I called it up on Android Market and checked the different versions available.

Firstly, I'm all for paying. I hate adverts. If I get the choice of a free version with adverts or a no-ad version for under a quid, it's a no-brainer for me. So I compared the two versions of the app, the premium and the free, and noticed something interesting... they both require access to the GPS hardware.

Now, I'm aware that sometimes the free version of an app will require access to the user's location mainly to decide which adverts to show (pointless showing an ad for a service only available in the US if the user is in the UK for example) It's only fair - you still pay for the app, just not in financial terms; you pay either with your time (reading ads) or your privacy (app collects lots of info on you) but in this case the game wants to know the location of the user even if they opt to pay, which isn't right. More worryingly, it asks for the fine location - the actual GPS position (potentially accurate to within a metre) of the user, rather than just the network location. Fair enough, if a developer wants to know I'm in Southampton I've no real issue with that - but I don't want them knowing my exact address. I decided not to install Draw Something.

What worried me the most is that when I mentioned to another good friend of mine why I decided not to install the app, they replied "all apps want to know your location", dismissing it as not worth worrying about. So do I worry too much? I decided to find out.

One of my favourite games on Android is Cut The Rope. I had a look at the permissions required for the different versions. There are three versions - Free, paid and HD. As a tablet user I have the HD edition (which isn't free). It requires the coarse location permission. This allows the game to determine the approximate location of the user without giving it access to the GPS. This is perfectly reasonable in my opinion. After all, any app with access to the internet can gain this information without needing the location permission anyway. As to why it needs it, I've no idea, but as I said, I've no issue with it knowing roughly where I am. As a developer I like to know stuff about my users so I can tailor my future stuff to them, I'd be surprised if others didn't think the same way. A little worrying is the fact that it wants to know the device's phone number, but as my device is a tablet with no phone function I guess this doesn't really apply to me. I'd hesitate before installing the app on my phone though. But look - the free edition requires the fine location permission, which allows the app access to the GPS. This runs true with my earlier assertion that you pay for free apps with your privacy. The app only wants to know exactly where you are if you don't pay up.

But let's look at another example - the ubiquitous Angry Birds. As far as I can tell, Android has no paid version, the only version is the free one (not counting the sequels, Rio and Space). Even so, the game doesn't want to know exactly where you are, just roughly. And as it's a free app, with ads all over the place, I think this is fair enough. In fact, Rovio are so intent on people not getting the wrong end of the stick that they went public [talkandroid.com] with the reasons behind all the permissions required to run Angry Birds (or, to be more precise, one of its sequels) on an Android device. They specifically mention that they didn't feel the need to request a precise GPS-based location for the user in order to target their adverts. So when one of the market leaders says things like that, OMGPOP, developers of Draw Something, had better follow suit or at least give a damn good reason for not doing so. Sadly, there doesn't seem to be any kind of privacy information for the app on their website. Their privacy policy only refers to the website itself, and the one page on the site relating to Draw Something has nothing other than a promotional video and links to the various app stores.

In this age of identity theft and privacy infringements I think we all need to be a little more cynical. When someone asks for information, there's always a reason. If they refuse to divulge that reason, a smart person should really be wondering what they have to hide. But for developers, it really does make good commercial sense to keep users informed - OMGPOP have certainly lost one potential customer and I'm certainly not the most privacy-concious person I know. Perhaps it's a Google problem. I applaud them for making app permissions so transparent, but the Android Market should maybe force developers to provide a reason for each permission they request. And let's face it, the only apps that should need to know your exact position on the earth are navigation or local interest applications - if we sleepwalk into a world in which we unquestioningly expect apps to want to know where we are, then we've taken a massive wrong turning.