36

I work at a small start up. At times I am asked to download their mobile app for testing purposes. The end users of this app usually are delivery / riders who use it for pickup and drop up purposes.

Now there is nothing wrong with the app, I just don't feel comfortable giving an "always on" location permission and the "tracking" (iOS) to an app that I will just be using once or twice a month. When asked about why the "tracking" feature needs to be enabled and what data it collects, I was told (non verbatim) "Tracking in iOS is used for high accuracy location info" which kinda seemed dodgy as I would expect any and all location info to be under the "location settings" and not tracking. This is a software industry that builds this app, so this can not simply be a case where an individual is simply not aware of the tech being used.

So the question, should I go ahead and tell that I do not feel comfortable giving an app on my personal phone (not work issued) said permissions? Should I go on and ask my query to higher level tech / team leads on how tracking is used?

Or is it part of my work and hence I am liable to have said app? No contract / NDA I signed specifically said having this app is a part of the job.

EDIT : I should have mentioned this earlier but looking at @joeqwerty's suggestions, I did also ask for alternatives, if a web / desktop app was offered (I have no issues giving tracking permissions to my work laptop), but none were offered.

4
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Kilisi
    Aug 11 at 7:08
  • 2
    How long are the tests? If you are willing to test the app in your personal phone, during work hours, can't you just install the app, do the tests and then uninstall it from the phone? Aug 11 at 19:14
  • You’re correct. As I understand it, the tracking permission on iOS allows apps to collect data on users’ activities outside the app. They can then use this info for their own marketing or sell it to other companies. For a company that presumably makes its money from arranging transportation, the fact that this would be not only requested but required to use the app is highly suspect. Even Facebook hasn’t dared to go that far. Aug 12 at 0:51
  • "Should I go on and ask my query to higher level tech / team leads on how tracking is used?" Yes. In theory, users with drained batteries won't be making them any money, so for their business model, it would make sense to only turn on the tracking when the user is out making an actual delivery or when the user is signaling that he's available to make a delivery. Aug 12 at 7:23
163

Ask for a company phone to use for testing purposes.

If you're going to be testing an in-development app on a phone, it probably shouldn't be your own personal device. After all, if a bug bricks your phone, how would your family contact you? Additionally, if you left the company, you'd be taking potentially sensitive corporate data with you that could potentially be leaked to your competitors.

In addition, if the testing is being carried out on employee phones, it's likely that it would result in an ad-hoc test regime that doesn't fully capture the potential breadth of devices that the business intends to support - so it may be in the business's best interest to build a proper testing lab containing at least one copy of every device you intend to support to allow for formal testing on each such device.

Instead, ask for your employer to provide a device for testing purposes, which would remain company property and remain on company premises at all times. They provide you with computers to code on and servers to host your development stuff on (repo servers, build servers, etc), and this is just another piece of hardware that you need to do your job.

I would suggest the use of an iOS emulator, but apparently Apple discourages their use for iOS app development, according to a company that sells testing on actual Apple devices over the Cloud.

15
  • 18
    XCode, Apple's product, comes with an IOS emulator so I'm guessing those sites are talking about using 3rd party emulators. Emulators don't always show problems that come up on phones though. Aug 10 at 10:38
  • 3
    And that company has an obvious financial incentive to tell you not to use an emulator.
    – user253751
    Aug 10 at 12:06
  • 17
    @NotThatGuy It's a polite lie, instead of "I don't trust you not to spy on me." plus a side of "I paid for this phone, why would I inconvenience myself in order to let you use it for free? Buy your own damn phone." (Both of which are super valid, company needs to put on their big company pants and buy real testing equipment and pay for real testing. Even with no other issues, if something breaks on one of the test phones a dev is going to want to take the phone away for a few days to scrutinize the logs and figure out what happened, and it's a lot easier if it's not someone's personal phone.) Aug 10 at 14:49
  • 15
    This is the right answer. Never install corporate tools on your personal devices and never use those personal devices for work purposes. Even if you deem the app trustworthy, there's no reason why your personal items (that you paid for) should be used and scheduled for corporate purposes. Also, don't use corporate tools for personal purposes. Keep those rigidly separate.
    – xxbbcc
    Aug 10 at 21:58
  • 4
    Not to mention, the app is likely using data that you are personally paying for, not the company.
    – bta
    Aug 11 at 0:01
34

Regardless of any NDA or contract, an employer can't force you to do anything with your personal property.

They may choose to fire you if you fail to cooperate, but they can't force you to install their application on your personal phone.

Tell them you're not comfortable installing the app on your personal phone and ask them what alternative solutions might exist.

13
  • 59
    "They may choose to fire you if you fail to cooperate" you may want to put a constraint on that... Yes, in the US and other nations with a non-developed set of labor laws. In many countries, your employer cannot nilly-willy fire you for things not in your working contract.
    – nvoigt
    Aug 10 at 6:38
  • 8
    @nvoigt exactly. In most places, employers need to provide their employees with the facilities and tools to perform their job - the burden of acquiring said facilities and tools is ALSO on the employer While BYOM / BYOD programs exist, they're voluntary Aug 10 at 9:38
  • 11
    "They may choose to fire you if you fail to cooperate" pretty much directly contradicts "an employer can't force you to do anything with your personal property" (or at least the former makes the latter mostly meaningless). The answer seems to imply they can force you to do some things, but not this. However, that's not really the case. An employer's not going to hold a gun to your head to force you to do anything; the most common way to "force" you is under threat of termination (the only other way I can think of is under the threat of legal action, but this is much, much less common).
    – NotThatGuy
    Aug 10 at 13:19
  • 5
    @LioElbammalf this was the first answer to this question, so in joeqwerty's defense, I had not tagged this with the country until asked in comments (to the question) by nvoigt Aug 10 at 13:57
  • 3
    @nvoigt any employer can fire any employee nilly-willy for things not in their contracts. The only difference between jurisdiction is whether or not that is legal, and therefore what recourse ex-employees have when it happens. Sometimes even if it wasn't a legal dismissal it's not worth fighting for the job, so with a track record of employees not fighting the decision employers with shady practices do this even in regions where they aren't supposed to. When the question is about an employer making unreasonable requests, the attitude of "they can't do this legally so they won't" doesn't apply. Aug 10 at 18:18
6

So the question, should I go ahead and tell that I do not feel comfortable giving an app on my personal phone (not work issued) said permissions?

You can express that feeling if you think it's "safe" to do so within the context of your company.

Should I go on and ask my query to higher level tech / team leads on how tracking is used?

If this would make you feel more comfortable about using the app, then you should ask.

Realistically, just turn location tracking on for this app while you are at work, then turn it off when you leave for the day. Or for even more security, uninstall the app when you leave work each day and reinstall it when you start work the next day. Both are simple solutions to your lack of comfort.

6

So the other answers are correct, that the company should really supply you with a work phone. They haven't though, even though you have expressed your unease. Maybe they would if you really pushed, but they might also not take it very well. If the job is good overall, then perhaps this is not the hill you want to die on. It also has a relatively confrontation free workaround;

Buy a burner phone

The cheapest "Smart" phones are not that expensive, this may be location specific, but I can get an android phone that would install apps and the like for about the same cost as a months worth of phone credit. You don't need any credit on the phone to install an app via wifi. I might have missed it, but I don't think you stated anywhere that the app is iOS only?

If your boss is annoyed by fact that you haven't got an iphone to test the app on, you will have to decided if you want to;

A) firmly state that this is the only phone you will be installing the app on,

or

B) tell a lie and say you lost your iphone.

The lie does have the slight advantage of preventing any argument, but you would then have to leave your iphone at home. I suspect it won't even come to this, nobody will remember what brand phone your phone was.

Edit in response to the comments;

  • Yes, asking around your friends/family for a spare old phone is a better and cheaper idea. Very environmentally friendly too.

  • Should you later go back to bringing your iphone to work, and someone is perceptive enough to notice, you can simply say you found it. Don't do that until you are sure that all talk of installing apps is over. Losing your phone once is plausible, twice is suspect.

10
  • 4
    the question is tagged India, where "a months worth of phone credit" can be as low 2-3 USD
    – fqq
    Aug 10 at 21:21
  • 1
    This is the best answer if you are in any way insecure in your role. Cheap old iphones are available online for about what a new cheap smartphone are.
    – Dave
    Aug 11 at 8:26
  • 3
    @Neil Because the world is not bound to behave according to moral principles, and so refusing to install the software on some phone may also come at a cost. So there is a trade off; either they must spend money on a phone or good will at their job. The phone is the better option if the job is overall a good job, because good will is a tricky thing to purchase. If the job is a bad job then this answer doesn't apply well and OP should probably push back more, but lots of other answers covered that already.
    – Clumsy cat
    Aug 11 at 16:59
  • 1
    @Neil To be clear, I do think the company is in the wrong, but that doesn't change the options OP has.
    – Clumsy cat
    Aug 11 at 17:01
  • 1
    Better still, ask your friends and relatives to look into their closet and find a phone with an API level so old that it is not supported by your application. Aug 12 at 7:17
2

Refusing to do what your employer asks may mark you as "not a team player" or "difficult"

This is especially true if basically every other employee does so and it would be true even if what they're asking is not reasonable.

If you're marked as such, the consequences may vary from getting fired (probably not too likely, if they're reasonable) to making opportunities to advance or work on interesting projects less likely (whether intentionally or subconsciously on their part). Refusing may not be fully responsible for that by itself, but it could get the ball rolling (or make it roll faster). If they think you're not that committed, they may see further signs of a lack of commitment when you do perfectly innocuous things (that most/all other employees also do) like not attending a team event because you have other plans or taking a long holiday.

I imagine the risk of getting sued (or anything like that) due to this alone would be negligible to non-existent. But of course I'm not a lawyer and this is not legal advice.

It should be fine to raise some concerns

It should be fine to raise some concerns about installing the app and ask about alternatives (or, preferably, offer alternatives, because you're presumably much more motivated than they are to find an alternative). Although you should at least be somewhat careful about which objections you actually raise and how you phrase them, as to avoid implying things like "I don't trust you" (by objecting to the permissions on your device specifically) or "you shouldn't trust me" (by implying that you may maliciously or neglectfully leak some sensitive company data).

Note that some alternatives may just not seem that viable or necessary to the company at present, like building a proper testing lab or giving an employee (or every employee) a company device when they only use it very rarely. This would likely be especially true if we're talking about an early-stage startup that may want to avoid unnecessary expenses (even small ones).

Should you explicitly refuse?

If raising concerns or trying to find alternatives didn't work out, should you refuse to install the app?

That's ultimately something you need to decide for yourself, based on how likely you think the above risks are based on your knowledge of the company and how much you actually care about those risks compared to this one aspect of your privacy.

4
  • 5
    Refusing to put software under development, "for testing purposes" (a.k.a alpha or at the very least beta quality software) on my personal phone, that I pay for, that my family depends on me to have, will mark me as being "not a team player?" Not in any company I am familiar with. In fact, I am expressly prohibited from putting company-owned software on my personal IT devices...
    – CGCampbell
    Aug 10 at 16:29
  • 1
    @CGCampbell If the company expects it and everyone else in the company does it, then yes, not doing it may mark you as "not a team player". If any given company prohibits the practice, then one or both of those conditions are necessarily false, so what would happen there seems largely unrelated to what would happen at companies where both of those conditions are true.
    – NotThatGuy
    Aug 11 at 4:48
  • Just because all th OP colleagues are fine with being taken advantage of does not mean the OP needs to stand for it.
    – Neil Meyer
    Aug 11 at 19:15
  • @NeilMeyer Of course OP doesn't "need to" stand for it. They are perfectly free to refuse, if they're happy to risk sabotaging their future at that company.
    – NotThatGuy
    Aug 11 at 20:08
2

There is an issue of boundaries here. It is not that installing the app on your phone really has much of an influence on your life it is just it is something you pay for which your employer thinks they can use for there economic activities. This is in essence unreasonable.

They are a tech company, regardless of size or success tech companies make enough money to buy employees work cellphones. I don't care how good the job is, if insisting that employers respect employees boundaries makes you a non-team player, then too bad.

I don't expect anyone in my team to give a single damn about me. We go to work to further the goals of the company who pays our salaries. We have to work together, but no form of friendship is expected or required. I have a family I have a mother. No colleagues of mine is either.

This team-player poppycock just sounds like a way in which certain employers try to befriend you so as to make it easier to take as much advantage of you as they can.

I think in India they have the problem same as in South Africa that people think having a job is such a miracle that you have to endure any and every exploitation just to be employed. This may be the case in some profession but it shouldn't be the case for a suitably qualified tech professional.

1

These options are generally available:

  • Just say no and ask them to make budget accessible for obtaining current test devices. This would be the normal situation, which one might expect as a mobile developer - which may also include industrial scanners, label printers, as well as anything else, which cannot be emulated.
  • Buy any cheap and/or refurbish test device, on which you will neither set up your accounts and which you will always leave at your desk - then they can geofence it as much as they want, it will never leave the perimeter, unless intentionally carrying it outside of the boundaries, while being paid to do so.
  • Put your device into a metal box, whenever leaving the corporate compound, in order to shield it's radio (this should well count as having it "installed", unless they would have requested constant internet access).
  • It would be far less of a private issue, when the recording of GPS data would be strictly limited to office hours ...as I once did when writing a fleet tracking tool, which was also installed on private devices (they've rather welcomed it, not having to deal with another one device).

The security argument against BYOD in other answers might be wrong (at least for Android), because EMM (dpm) supports work profiles to be setup - which then can be remotely wiped.

And frankly speaking, the argument "that everybody is doing it", almost implies that it is wrong. Why they need to use peer pressure to manipulate their employees into supplying them with their private hardware? To me this doesn't seem well-funded or the funds might be diverted elsewhere.

1
  1. Uninstall immediately.
  2. Tell your boss in writing and some little 'why'.
  3. If they say "you have to", ask for that in writing. Don't install.
  4. If they get really shirty then get their threats in writing. Don't install.
  5. Point out that when you're not at work, you're not being employed by them and when you are at work they know where you are. (If you drive in your own car to work then what would anyone think about having to put a tracker on it? When that outrage sinks in, ask why a phone is different?)
  6. You may have privacy and data protection laws on your side. Ask for a list of the data collected and how it is being used and how it is being kept according to local privacy laws.
  7. Tell your colleagues. They might resent being spied on but don't have the balls to say no.

If your employer rules by fear then jump ship ASAP.

1
  • you make a good point with the car, I have not thought about it that way Aug 12 at 15:26
-1

Your company's policy and their responses to your questions show that they don't understand the issues or they do and have something other than software testing in mind. I think your best option would be to just leave your phone at home whenever you go somewhere you don't want them to know about. (Spending time with CEO's spouse whenever CEO is out of town, calling in sick when you're on a job interview, etc.) You should get a cheap prepaid, if you need one, for calls when you're without your Iphone. It won't cost anything compared to loss of your job or hurting your performance evaluation.

And you should start looking for a job.

2
  • What if calling in sick and they'll make a control call to the other device ...which nobody will answer? Aug 11 at 8:33
  • 2
    Wouldn't leaving your cell phone at home largely defeat the purpose of even having a cell phone? A cheap second phone is an idea, but what about all the apps that people use daily? Buying a second phone just for the company app seems like a better idea, but that still wouldn't be anywhere near my first choice.
    – NotThatGuy
    Aug 11 at 9:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .