Clubhouse, a drop-in audio chat social media platform, has caused quite a buzz with its different style and “exclusivity.” Its privacy policy, however, was not as well received.
Since its first release, the company has revamped its policy several times. Such changes can be confusing because no one wants to read a new dry document every time they change it. That’s why we’ve done the reading for you.
Here are some of our concerns with the Clubhouse Privacy policy.
Clubhouse privacy policy concerns in a nutshell:
- Unclear about how long they keep data, especially the recorded conversations.
- Unclear about what they do with users’ contacts.
- Unclear about what they’ll do with this data in the future.
- Does not offer end-to-end encryption and routes all audio through a third-party based in China.
1. Clubhouse wants your contacts
From the Clubhouse privacy policy:
The point raises some questions. While the company states this is “to help users connect with people they know,” the act itself screams a privacy nightmare.
Why? Because this means that Clubhouse is vicariously collecting information about people who do not use their platform. In this case, it’s the company’s responsibility to inform people under GDPR about collecting their data.
Does Clubhouse do that with every contact they collect? Probably (most certainly) not. It also leaves you wondering what else the company will use that information for.
However, one should give credit where credit is due. Previously, Clubhouse wouldn’t let you use their service without access to your contacts. They’d also log all data associated with the entries like name, surname, email, and date of birth. This new approach to contacts is far from ideal but still a step in the right direction.
2. Clubhouse is unclear about how long it keeps recorded audio
“We temporarily record the audio in a room while the room is live. These conversations are deleted unless a user reports a Trust and Safety violation while the room is active. In those cases, we encrypt and retain the audio for the purposes of investigating the incident, and then delete it when the investigation is complete.”
This statement doesn’t specify time very well.
When it says that “conversations are deleted unless a user reports TOS violation while the room is active,” it doesn’t say how long the rooms are kept live. Are there any rooms kept active indefinitely?
For all we know, the company could be logging this data until they deem it unnecessary. And necessity is very subjective.
3. Clubhouse lacks proper encryption and uses third-party services for audio
The same statement raises more questions.
“We temporarily record the audio in a room while the room is live…. we encrypt and retain the audio for the purposes of investigating the incident, and then delete it when the investigation is complete.”
Clubhouse claims that they record every room’s audio in case of violations of rules or law. They also say that they encrypt the audio recording if it’s reported.
Since Clubhouse records data in its live rooms, this implies that it does not use end-to-end encryption (E2EE).
In tech terms, E2EE means that a message (text, audio, video) is encrypted by the sender and decrypted by the receiver. This ensures that no one in the middle, even the provider, can see the message’s contents.
By definition, Clubhouse does not provide E2EE for its users.
In fact, the entry suggests that Clubhouse doesn’t use encryption at all. However, that’s difficult to believe. Clubhouse uses server-side encryption, which allows them to listen in and monitor the rooms.
A Shanghai-based third-party company Agora handles most of Clubhouse’s back-end and audio. Since the company doesn’t use E2EE, the audio data goes through Agora. They can monitor, log and use that information as they see fit. They are also based in China. This means that Agora would be obligated by law to share data with the Chinese government.
4. Clubhouse is vague about how long they keep your data stored
The Clubhouse privacy policy states:
“Retention of data. We keep your personal data for as long as you have a Clubhouse account. To protect the safety and security of our users, your personal data will be retained for a reasonable period of time following account deletion.”
Same as with audio recordings – what is “a reasonable period of time”?
As a privacy advocate, I understand “reasonable” as a few days. For a company that makes money off people’s data, it would be reasonable to keep it forever.
5. Clubhouse gets unspecified access to your social media
A Clubhouse statement:
“Instagram, Twitter and other social media companies. If you connect your social media accounts (e.g., Instagram or Twitter) with Clubhouse, Clubhouse will also inform those companies that you have authorized its access to your accounts with those companies.”
Again, the policy doesn’t specify another key aspect – what does “access” mean? Is it access to your profile, photos, posts, history, friends list, or other information?
It doesn’t say. However, it does make it sound shady, even if it wasn’t the intent.
Should you use Clubhouse?
In short – not if you care about your privacy (and you should).
Clubhouse’s Privacy Policy is very obscure. Privacy policies, in general, should be detailed and concise to leave as little doubt as possible. But Clubhouse remains unclear about how much data it gathers and for how long it’s kept. This causes concern.
It’s also less reassuring knowing that the company doesn’t protect its users’ information. In April 2021, someone scraped 1.3M Clubhouse users’ data. Even though the data was public, it concerns me that Clubhouse doesn’t care to protect it, and made it available on the app in the first place. Your privacy is important – and don’t let anyone tell you otherwise!
