How to Quickly Delete Unroll.me

Why is this a thing?

If you’re following the tech news, you’ve probably seen two things in the last few hours. Firstly, Unroll.me was reported in a story on the New York Times as having sold (allegedly anonymized) data on customers’ Lyft ride receipts to Uber:

Uber devoted teams to so-called competitive intelligence, purchasing data from an analytics service called Slice Intelligence. Using an email digest service it owns named Unroll.me, Slice collected its customers’ emailed Lyft receipts from their inboxes and sold the anonymized data to Uber. Uber used the data as a proxy for the health of Lyft’s business
https://www.nytimes.com/2017/04/23/technology/travis-kalanick-pushes-uber-and-himself-to-the-precipice.html

Secondly, an anonymous poster on Hacker News alleged that Unroll.me had been storing **every single email** from users who had subscribed to the service:

I worked for a company that nearly acquired unroll.me. At the time, which was over three years ago, they had kept a copy of every single email of yours that you sent or received while a part of their service. Those emails were kept in a series of poorly secured S3 buckets. A large part of Slice buying unroll.me was for access to those email archives. Specifically, they wanted to look for keyword trends and for receipts from online purchases.
https://news.ycombinator.com/item?id=14180463

While it’s fair to note that this second allegation is unproven, the combination of these two allegations is more than enough for someone like me to run away from Unroll.me as far and as fast as I can. Here is how you can do it too.

How to Delete Your Account

Step 1: Delete your Unroll.me account

While removing access to your email account prevents Unroll.me from accessing new emails, it’s still a good idea to delete your actual account as well.

  1. Log-in to Unroll.me and click on your user name in the upper right-hand corner
  2. Click on “Settings” from the dropdown menu
  3. Scroll to the bottom and click on the “Delete my account” link
  4. Click on the account deletion link to finish deleting your account
  5. Think long-and-hard about ever allowing another third-party service to have access to your email account again

Step 2: Revoke Unroll.me’s permission on your Gmail account:

This is the strongest and most immediate step that you can take, because it doesn’t rely on Unroll.me at all which, given the premise of this article, seems prudent.

  1. Go to you Google Account Settings page by clicking “My Account” in the dropdown menu that comes up when you click on your profile picture.
  2. Click on “Connected Apps and Sites” under the “Sign-in & Security” menu
  3. Click on the “Manage Apps” link under the “Apps connected to your account” heading
  4. Click on “Remove” in the Unroll.me section
  5. Think long-and-hard about ever allowing another third-party service to have access to your email account again
Click the REMOVE link to prevent Unroll.me from continuing to access any of your emails

What Happens to Your Personal Data

Information on the Unroll.me site is a bit unclear on this. From their FAQ:

What happens to my previous emails if I delete my account?
All of your previously rolled up emails are safe! They are located in your “Unroll.me” folder in your email client.

This tells us that the emails which were managed by Unroll.me are not lost forever, but it doesn’t tell us anything about what happens to any copies on the company’s servers.

It’s unclear from Unroll.me’s Privacy Policy or Terms of Service what exactly happens to any saved data when you delete your account (which is probably telling in-and-of itself). Further, reading those documents makes it pretty unclear that they would even be saving every single email that you send or receive, although neither document appears to prohibit email retention. I have reached out to Unroll.me for further information — if anyone knows anything that I’m missing, please mention in the comments.