Sunshine Contacts Data Breach: Was Your Address Exposed?

An application for managing contacts that you don't currently use could potentially be sharing your residential address with its users. In November, Marissa Mayer, previously the CEO of Yahoo and a Google executive, along with Enrique Muñoz Torres, launched their newly rebranded company, Sunshine, and its initial offering, Sunshine Contacts. This new application for iOS is designed to streamline your address book by identifying and merging duplicate entries using artificial intelligence, and also aims to complete missing details by collecting information from sources on the internet – such as LinkedIn profiles, for instance.

However, some individuals expressed surprise upon discovering that their contacts’ home addresses had been added, even for those who had not yet adopted Sunshine as their contact management solution.

TechCrunch contacted Sunshine to gain a clearer understanding of the situation, considering the potential implications for user privacy.

We have learned that there are multiple ways a user might encounter a contact’s home address within the Sunshine application. The address may already be present in the user’s phone’s existing contact list, or the user may have chosen to grant Sunshine access to scan their email inbox to extract information from email signatures. This functionality is also found in other personal CRM platforms, such as Evercontact.

If an individual included their home address in the signature of an email, that information could then be incorporated into their contact profile within the Sunshine app. In such instances, the contact information is updated within Sunshine Contacts and then synchronized with the user’s phone’s address book; however, this data is not disseminated to other app users.

The application also enhances contact profiles with information obtained through alternative methods. For example, it can utilize existing data to fill in incomplete fields – such as adding a last name when other information suggests a person’s full name, but the field remains blank. The app can also retrieve data from a LinkedIn profile, if one is available.

Sunshine utilizes the Whitepages API to source home address information.

The company has confirmed to TechCrunch that it is supplementing contact cards with home addresses in certain situations, even for contacts who are not Sunshine Contacts users. Sunshine maintains that this process is comparable to a user manually searching for someone’s contact information online – it simply automates the procedure.

Naturally, some would contend that automating the collection of home addresses for a large number of users – potentially thousands, depending on the size of a user’s address book – differs significantly from an individual searching for a relative’s address to send a holiday card or contacting a former classmate to inquire about a birthday gift location.

However, Sunshine has clarified to TechCrunch that it will only add a home address when it determines a personal connection exists between the user and the contact.

Here, Sunshine navigates a complex area where the application’s technology attempts to assess the strength of relationships to determine whether a home address is appropriate to share.

Prior to adding an address, Sunshine requires that the user already have the contact’s phone number recorded in their address book, not just their email address. This would exclude individuals with whom the user has only a professional relationship. The app will only update with the home address if the partner API can link that address to a phone number the user possesses.

Furthermore, Sunshine states that it can typically identify the type of phone number on file – whether it is a residential or business line, or a landline or mobile number. (It employs APIs for this purpose, similar to those offered by StrikeIron, though not specifically that one.) It also identifies the owner of the phone number. Utilizing this information and additional context, the app attempts to discern whether a phone number is associated with a personal or professional relationship and to understand the nature of the connection between the user and the number’s owner.

In practice, this means that if all the information on file for a contact is professional – such as their workplace, job title, work email, and phone number – that contact’s profile will not be updated to include their home address.

Moreover, because many individuals use their personal cell phones for work, Sunshine will not consider someone a “personal” contact simply because their mobile number is on file. For example, if only a contact’s name and cell number are available, the app will not be able to retrieve their home address.

The outcome of this automated analysis is that Sunshine, in theory, only updates contact cards with home addresses when a personal relationship has been established.

This does not account for certain scenarios, such as situations involving former partners, stalking, or a general desire for privacy. There are instances where an individual may have extensive personal information for a contact in their address book, but that contact may prefer not to have their home address shared with that person.

The only way to prevent this, it appears, is to opt out through the source: Whitepages.com. (Once you obtain your profile URL from the Whitepages website, you can use this online form to request the suppression of your information.)

The functionality of the app raises questions about the current definition of private information.

Sunshine points out that people’s home addresses are not as confidential as they might believe, making them accessible for use.

It is true that home addresses are often publicly accessible. While most people no longer receive a physical telephone directory listing addresses and phone numbers, residential addresses are now relatively easy to find online.

In addition to public records – such as voter registration databases – there are also online people search services.

Sunshine’s partner, Whitepages.com, charges visitors for access to its data, but others, like TruePeopleSearch.com, do not have a paywall. With just a person’s first and last name and city, its website provides access to their home address, previous addresses, cell phone number, age, and the names of family members and close associates. (It should be noted that TruePeopleSearch is not a Sunshine partner.)

Even though this data is “public,” its casual distribution within an application can be unsettling, as it makes it more readily available.

Furthermore, after experiencing data breaches and privacy scandals, individuals are generally more cautious about their personal information. Many would likely decline to have their home addresses shared with Sunshine’s user base if given the option. In general, people appreciate being asked directly for their home address when it is needed, rather than having an application automatically search for and share it.

Sunshine Contacts is currently in an invite-only beta in the U.S., giving the company time to reassess this feature based on user feedback before a wider release.