You walk into a store. There’s a special device transmitting on a frequency humans can’t hear. But smartphones can. And, thanks to that new app you downloaded, it is listening. Why? The retailer wants to know who you are and that you’re in the house.

Deal, or no deal?

Incentivize the public

A friend called, all excited about something called Shopkick. He gushed on about saving money when shopping at Best Buy. That’s a good thing, as he spends prodigious amounts of time and cash there.

It seems, Shopkick is:

“The first mobile app that gives you rewards and offers simply for walking into stores, for scanning products, and for signing up friends. You can collect kick bucks and bonuses at millions of stores and restaurants in America.”

My friend asked if I had heard of Shopkick. I mentioned that I didn’t, knowing full well it was his way of getting me interested. The call ended with an ultimatum.

“Don’t take long. My brother borrowed my speakers for a party and trashed the sub. I need a new one bad.”

That’s my friend, selflessly helping the economy at every chance.

Seemed normal

I thought, why not see where this leads. I started with Shopkick’s website. I noticed that several big-name retailers were involved. And, media outlets were saying nice things about Shopkick. So far, so good.

Next, I checked their Terms of Service and Privacy Policy: nothing unusual. It was time to get serious. I didn’t find much initially. Then, I came across a This Week in Tech (TWiT) podcast by Leo Laporte, where Shopkick was one of the topics being discussed.

As I listened, it got interesting real fast.

Surprise, surprise

Mr. Laporte and the panel of guests were discussing smartphone apps and why the apps were turning the microphone on. That certainly grabbed my attention. Especially, Mr. Laporte asking:

“Does it scare anybody we’ve learned that this program (referring to Color) turned on the microphone and was listening? Now, they’re not using it in any nefarious way.

But they didn’t have to tell us. They just did it. Doesn’t it mean that there may be many other apps that are doing the same thing? Doesn’t that bother anybody?”

I’ll get to this later. First, I want you to read what panel member, Robert Scoble points out:

“By the way it’s not the only app (Color) that uses the microphone. Shopkick uses the microphone to know when you entered the store. You turned on Shopkick and it’s actually listening for an inaudible signal.

So they have a speaker in front of Macy’s that when you take your iPhone inside Macy’s, inside the front door, it senses the audio signal and gives you points for entering the store.”

Not mentioned in EULA

Remember my not noticing anything unusual (like using the smartphone mike) in the Shopkick Terms of Service and Privacy Policy? Mr. Laporte reasons why: “They didn’t have to tell us. They just did it.”

I felt it important to understand what the developers had in mind and why it wasn’t mentioned on their website.

To that end, I contacted Shopkick. Ms. Katie Carlson of Atomic PR helped make the connections. Cyriac Roeding, cofounder and CEO of Shopkick was kind enough to answer the following questions.

Kassner: The use of the phone’s microphone is not mentioned on the website. Or not easily found, if it is. Why is that?
Roeding: Shopkick’s main focus is consumers, so the information on the site is geared towards helping them get the most out of the application.

We are very public about how the technology works. In fact, we believe this technology is a major breakthrough in location technologies. You will find many articles in which we talk about technical details.

We take user privacy very seriously. Users need to open the app, in order to activate the technology, so they are 100% in control. It’s like a satellite GPS signal. You only pick it up when you want to. We don’t do anything with the audio signal except try to identify a signal the app can understand. And, none of the audio itself gets stored.

Kassner: Can you explain how the Shopkick app uses the microphone?
Roeding: The microphone is used as part of our location technology called the ‘Shopkick Signal,’ which enables the app to verify presence within a store or mall.

Stores have transmitters on-site that emit inaudible audio, which is picked up by the microphone on a user’s smartphone, when (and only when) the Shopkick application is open.

Because the detection occurs on the phone rather than by the store, privacy of presence information is completely under the users’ control.

Kassner: What does the app do with the captured Shopkick signal?
Roeding: As for the application, it samples the ambient audio through the microphone and isolates the Shopkick signal, which appears in inaudible portions of the audio spectrum. This is analyzed using digital signal processing technology to decode the signal.
Kassner: What assurances do people have that the audio is indeed unusable?
Roeding: We don’t store or transmit recordings of the audio itself, only processed information about the Shopkick signal.

Final thoughts

When I told my friend what Shopkick does, he was able to make an educated decision on whether to use it or not. Without significant searching that would not have been possible.

I’d like to thank Mr. Laporte, Mr. Scoble, Mr. Roeding, and Ms. Carlson for helping me get to the bottom of this mystery.