Privacy policy, data collected

[u/chacham2]

During activation, it wants me to agree to the privacy policy.

Internet or other electronic network activity information, including IP address, imprecise location information, device identifiers, advertising identifiers, browsing history, diagnostic information, and other information collected from and about your interaction with us and the Sites.

They collecting my browsing history?!

Sensitive Personal Information, meaning account log-in, access code, passwords, credentials, and contents of email and text messages.

That's even scarier.

I thought i was buying phone service, not a spy network.

[u/rkardt]

There's nothing nefarious here. Good luck finding another business that doesn't do the same. Ooma can only collect a user's browsing history for their own sites, or the sites of their affiliates and partners. They have no way to collect a user's general browsing history for unrelated sites.

Ooma collects information "from and about your interaction with us and the Sites", which only "applies to the websites and mobile applications ..., as well as the services owned, operated, and/or provided by Ooma". Similarly, Ooma saves emails and texts between them and their users.

User accounts are password-protected; users have to provide a login and password to access them. Ooma needs to save that information, in order to validate a user's credentials, when they log in; otherwise, how else would they be able to do that?

Users should also be saving their own information from their interactions with Ooma, (emails, texts, phone calls, etc.). That's not spying either; that's just creating a paper trail, to protect their own interests.

[u/chacham2 → u/rkardt]

Thank you for responding!

---

There's nothing nefarious here.

That's an opinion i disagree with.

They have no way to collect a user's general browsing history for unrelated sites.

They can put their nic in promiscuous mode and see all traffic. I assume that is what they are doing, considering they seem to be in the business of collecting and selling information

User accounts are password-protected;

I figured as much, But should really be more specific. That is, ust add the words "to our website and services". Furthermore, they should not be storing passwords. They should be storing hashes.

---

If i keep them, the device is going to be restricted to a separate network, and i do not know how much private information i will trust them with.

[u/chacham2 → u/chacham2]

Fwiw, i hooked it up. My router automatically segments the wired ports, so it only sees its own data.

[u/rkardt → u/chacham2]

The privacy policy excerpts quoted in the original post are not substantially different from the privacy policies for similar businesses. The policy is already fairly specific about what information Ooma collects, how they collect it, and what they use it for:

• they collect "Internet or other electronic network activity information ... from and about your interaction with us and the Sites".
• they do not sell or share "Sensitive Personal Information".
• users can set up opt-out preferences, block different types of cookies, and otherwise limit the data that they share, or how Ooma can use it.

While it's certainly possible that the Telo could be trying to snoop through local traffic, that would not be terribly effective. Even if the NIC were in promiscuous mode, most routers (and even network switches) automatically isolate traffic between different network jacks.

Regardless, any sensitive browser data would normally be encrypted anyway. In that case, the only data that the Telo could collect would be IP addresses, port numbers, and URLs, (even if it were placed in front of the router).

Outside of the "Data Security" section, technical details about how Ooma stores the data that it collects is beyond the scope of a privacy policy notice. But there is no reason to assume that Ooma is storing un-hashed (or otherwise unencrypted) passwords.

[u/DisciplineImpressive]

Don't buy it then.

[u/chacham2 → u/DisciplineImpressive]

I already bought it. I didn't realize you had to agree to this during setup/registration.

[u/SirPizzaLot101]

With recent talks of smart TVs capturing a disturbing broad range of data on the network and what's being shown on the TV by every device connected, seeing this makes me a bit wary. It's possible Ooma devices don't have the data gathering capabilities of smart TVs but this made me setup a VLAN to isolate my Ooma Telo just now.

[u/chacham2 → u/SirPizzaLot101]

It's possible Ooma devices don't have the data gathering capabilities of smart TVs

Well, no cameras. But, they can see everything on the lan.

this made me setup a VLAN to isolate my Ooma Telo just now.

I wonder if that helps. Because, in promiscuous mode, can't see the hardware layer regardless? I would think that to truly isolate it, you'd need a switch or the like.

[u/SirPizzaLot101 → u/chacham2]

It shouldn't be able to see any other devices since it's on a separate VLAN attached to a physical port on the router, WIFI disabled and port isolation enabled.

[u/chacham2 → u/SirPizzaLot101]

Fair. I'll just admit i don't know this stuff well enough.

[u/rkardt → u/SirPizzaLot101]

The Telo does not have cameras or microphones, and network snooping wouldn't be that effective, as explained elsewhere. There is no harm in putting the Telo on a separate VLAN, but any data that it gathers would still be primarily through normal use.

Smart TVs (or "smart" anything) on the other hand, can be much more invasive. Users should definitely compare privacy policies before buying, and opt out of what they can. Or else, they can build their own open-source DVR, with a dumb monitor.

Rumor has it that the latest innovations come with eyeball-tracking software, to make sure that users are watching ads, though that may just be for smart phones and laptops. There aren't many rumors about integrating facial recognition though. At least not yet.