Comment by mholt | Hacker News Reader

Comment by mholt | Hacker News Reader

Parent Full thread

Privacy is awesome - one of the few services I highly recommend to anyone who makes purchases or pays bills online. Slick interface, product just works (except once when I pre-ordered something from Best Buy and that's because Best Buy had a very weird authorization flow that did two charges, instead of an auth + charge) -- and the benefits are great. Best of all, merchants cover the costs, so it's totally free as a consumer (edit: meaning, no monthly fees, etc -- of course merchants have to cover their card processing costs still). Their support is great, too.

I do wish their referral or spending perks were a little more enticing but the privacy benefits are still great overall.

Will be thinking about how I can effectively use the API...

EDIT: Woah, this is REALLY cool:

> Similar to the transaction event, auth stream decisioning will allow your system to dynamically approve and decline authorizations.

https://developer.privacy.com/docs#auth-stream

I smell a two-factor purchase flow in my future... (edit again: maybe not)

> I smell a two-factor purchase flow in my future

Unfortunately I don't think that'll be possible. The docs say that there's a 2000ms cap on the auth stream response time. I don't think that's likely to be raised significantly, since I'm pretty sure their card network backend has a similar requirement.

Darn -- I saw that but was hoping that's just a limit imposed by Privacy that could be lifted, perhaps in 2FA scenarios -- but if it's network-enforced, I guess that rules that out.

> so it's totally free

No, it isn't. A hidden cost is not the same thing is a non-existent cost. One way or another, you are paying for this service. Having the money only show up on the merchant's statement does make it a little easier to bury your head in the sand about it, but at the end of the day that money is coming out of your pocket one way or another.

A merchant has to cover card processing fees whether I use Privacy or not: my costs are exactly the same whether I use Privacy or a physical credit card.

You lose credit card protections, cashbacks (at least 1% or miles) - so it is basically a debit card purchase.

I lose at least 1% everytime I use privacy (all my creditcards are at least 1% CB). But I like the convenience of not having to get up and reach my wallet from the bedroom.

So it is not free.

We're working on being competitive here :).

How so? The loss of rewards is the same reason I don't use Simple, even though from the outside looking in it appears to be one of the best modern banks.

We're rolling out straight cashback (up to 5% at select partners) - simple and no hoops to jump through. It's still in the works, but you can join the waitlist at cashback.privacy.com.

More like 2%, since Citi gives 2% on everything...

Also note that Citi has virtual account numbers already. It's kind of clunky but it works.

Does the Citi privacy policy promise not to sell your transaction history to 3rd parties? If no, then Privacy's service offering is still attractive from that perspective.

Not quite, but

(a) Citi lets you opt out [1]

(b) Privacy.com still shares data that they don't deem "personally identifiable" [2]

(c) Privacy.com may share your data during a merger/sale of company stock etc. and I don't think they limit what can happen to it [2]

(d) Privacy.com may share your data "with financial institutions, processors, payment card associations and other entities that are involved in the payment process" (notice they don't limit the usage to actually processing your payment, or the storage to the duration of your membership... they just say "we may retain data about you for a period of time consistent with applicable law" which I assume could be quite a while)

(e) I'm not sure why I should trust a company named privacy.com themselves with my unique device IDs and location data, whatever the situation with third parties is.

[1] https://www.citicards.com/cards/wv/JRS/ACQ/img/Generic_AO_ve...

[2] https://privacy.com/terms#privacy-policy

The opt-out that Citi provides is extremely similar if not the same to the one that I receive annually from basically all financial companies I have an account with. They allow you to limit the sharing only as mandated by federal law.

Regarding (e) I can only say that I'm quite happy using Privacy's website to manage my account. Of course I disallow location sharing there, so the best location they have is via IP address which is a granularity I'm comfortable with (and which could be further obscured with VPN if you're really worried about it).

Overall it's a nice service. I completely agree with you on (d) being less than optimal and wish they would issue some stronger language on that point. Nothing is perfect I suppose.

Hey there!

I'm one of the founders. Just wanted to hop in here and clarify our current practices.

We do not sell any data to third parties (anonymized or not). We’re never going to do it for direct marketing purposes or anything like that.

The intent behind the non-personally identified information sharing clause is to potentially provide breach notification warnings to merchants:

Example: if a large number of locked cards were used at merchant X, and then subsequently stolen from merchant X, and used at other merchants, we could notify merchant X and our customers that shopped at merchant X (likely before anyone else in the ecosystem knew).

This is not a service we're planning to provide in the near term. Any other information we collect is solely for the purposes of fraud prevention, not marketing.

I definitely hear you on the language in the policy though, and it is something we intend to tighten up

The forms are all the same for opting out, but what exactly they let you put out of is different. In Citi's case it seems to include sharing information with their affiliated for direct marketing, which is what we're concerned about. (I'm not sure what the law is regarding sharing for other purposes though.)

That doesn't mean that Privacy is free. It just means that the system is rigged to hide its cost from you, and possibly to make you pay that cost whether you use it or not. But one way or another, that cost is not zero, and you will end up paying for it whether or not you are aware of it. There simply are no other possibilities.

Reply on news.ycombinator.com