Cryptocurrency fans who were hoping to use Apple’s forthcoming credit card to splash on coin are out of luck. You also won’t be able to use the Apple Card to buy lottery tickets, casino gambling chips in any form, physical or virtual, or foreign currency or travelers checks.
Reuters spotted the detail in a customer agreement posted to Apple Card’s card issuer partner Goldman Sachs’ website which lists restrictions on transactions it describes as “cash advance and cash equivalents”.
The agreement defines these as meaning “any cash advance and other cash-like transaction, including purchases of cash equivalents such as travelers checks, foreign currency, or cryptocurrency; money orders; peer to peer transfers, wire transfers or similar cash-like transactions; lottery tickets, casino gaming chips (whether physical or digital), or race track wagers or similar betting transactions”.
Given the wild swings in crypto valuations the Apple+Goldman credit tie-up saying a firm ‘no’ to cardholders splashing on such shaky stuff is hardly surprising.
Apple announced it was getting into the credit card game back in March, saying the card would offer a 2% cash back incentive for using Apple Pay to make purchases. (The physical version of the Apple Card is slightly less generous vs the digital card.) While if you’re buying stuff direct from Apple there’s 3% cash-back.
There are also no late fees and no penalty rates. Interest rates for Apple Card are in the range of 13-24%, based on the user’s creditworthiness.
As with Apple Pay, there’s a privacy promise too — with a pledge that Apple Card transaction data won’t be sold for advertising or marketing, not by Apple, Goldman or any other partners. Though data may be shared with regulators for financial reporting purposes and so on.
The Apple Card is due to be released in the US next month.
It wasn’t “system updates” as it claimed. StockX was mopping up after a data breach, TechCrunch can confirm.
The fashion and sneaker trading platform pushed out a password reset email to its users on Thursday citing “system updates,” but left users confused and scrambling for answers. StockX told users that the email was legitimate and not a phishing email as some had suspected, but did not say what caused the alleged system update or why there was no prior warning.
A spokesperson eventually told TechCrunch that the company was “alerted to suspicious activity” on its site but declined to comment further.
But that wasn’t the whole truth.
An unnamed data breached seller contacted TechCrunch claiming more than 6.8 million records were stolen from the site in May by a hacker. The seller declined to say how they obtained the data, but promised to soon put the stolen records for sale on the dark web.
The seller provided TechCrunch a sample of 1,000 records. We contacted customers and provided them information only they would know from their stolen records, such as their real name and username combination and shoe size. Every person who responded confirmed their data as accurate.
The stolen data contained names, email addresses, hashed passwords, and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. Several other internal flags were found in each record, such as whether or not the user was banned or if European users had accepted the company’s GDPR message.
Under those GDPR rules, a company can be fined up to four percent of its global annual revenue for violations.
When reached prior to publication, neither spokesperson Katy Cockrel nor StockX founder Josh Luber responded to a request for comment.
StockX was last month valued at over $1 billion after a $110 million fundraise.
The Entertainment Software Association issued an apology of sorts after making available the contact information for more than 2,000 journalists and analysts who attended this year’s E3.
“ESA was made aware of a website vulnerability that led to the contact list of registered journalists attending E3 being made public,” the organization said via statement. “Once notified, we immediately took steps to protect that data and shut down the site, which is no longer available. We regret this this occurrence and have put measures in place to ensure it will not occur again.”
It’s not clear whether the organization attempted to reach out to those impacted by the breach.
In a kind of bungle that utterly boggles the mind in 2019, the ESA had made available on its site a full spreadsheet of contact information for thousands of attendees, including email addresses, phone numbers and physical addresses. While many or most of the addresses appear to be businesses, journalists often work remotely, and the availability of a home address online can present a real safety concern.
After all, many gaming journalists are routinely targets of harassments and threats of physical violence for the simple act of writing about video games on the internet. That’s the reality of the world we currently live in. And while the information leaked could have been worse, there’s a real potential human consequence here.
That, in turn, presents a pretty compelling case that the ESA is going to have a pretty big headache on its hands under GDPR. Per the rules,
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
There is, indeed, a pretty strong argument to made that said breach could “result in a risk to the rights and freedoms of natural persons.” Failure to notify individuals in the allotted time period could, in turn, result in some hefty fines.
It’s hard to say how long the ESA knew about the information, though YouTuber Sophia Narwitz, who first brought this information to light publicly, may have also been the first to alert the organization. The ESA appears to have been reasonably responsive in pulling the spreadsheet down, but the internet is always faster, and that information is still floating around online and fairy easily found.
VentureBeat notes rightfully that spreadsheets like these are incredibly valuable to convention organizations, representing contact information some of the top journalists in any given industry. Many will no doubt think twice before sharing this kind of information again, of course.
Notably (and, yes, ironically), the Black Hat security conference experienced a similar breach this time last year. It chalked the issue up to a “legacy system.”
Amazon has tweaked the settings for its Alexa voice AI to allow users to opt out of their voice recordings being manually reviewed by the company’s human workers.
The policy shift took effect Friday, according to Bloomberg, which reports that Alexa users will now find an option in the settings menu of the Alexa smartphone app to disable human review of their clips.
The Alexa T&C did not previously inform users of the possibility that audio recordings captured by the service might be manually reviewed by actual humans. (Amazon still doesn’t appear to provide this disclosure on its main website either.)
But the Alexa app now includes a disclaimer in the settings menu that flags the fact human ears may in fact be listening, per the report.
This disclosure appears only to surface if users go digging into the settings menu.
Bloomberg says users must tap ‘Settings’ > ‘Alexa Privacy’ > ‘Manage How Your Data Improves Alexa’ before they see the following text: “With this setting on, your voice recordings may be used to develop new features and manually reviewed to help improve our services. Only an extremely small fraction of voice recordings are manually reviewed.”
The policy tweak comes as regulators are dialling up attention on the privacy risks posed by voice AI technologies.
This week it emerged that Google was ordered by a German data protection watchdog to halt manual reviews of audio snippets generated by its voice AI, after thousands of recordings were leaked to the Belgian media last month which was able to identify some of the people in the clips.
Google has suspended reviews across the whole of Europe while it liaises with EU privacy regulators.
In a statement on its website the Hamburg privacy watchdog raised concerns about other operators of voice AIs, urging EU regulators to make checks on providers such as Amazon and Apple — and “implement appropriate measures”.
Coincidentally (or not) Apple also suspended human reviews of Siri snippets this week — globally, in its case — following privacy concerns raised by a recent UK media report. The Guardian newspaper quoted a whistleblower claiming contractors regularly hearing confidential personal data captured by Siri.
While Google and Apple have entirely suspended human reviews of audio snippets (at least temporarily), Amazon has not gone so far.
Nor does it automatically opt users out. The policy change just lets users disable reviews — which requires consumers to both understand the risk and act to safeguard their privacy.
Amazon’s disclosure of the existence of human reviews is also currently buried deep in the settings, rather than being actively conveyed to users.
It’s not clear whether any of this will wash with regulators in Europe.
Bloomberg reports that Amazon declined to comment on whether it had been contacted by regulators about the Alexa recordings review program, saying only: “We take customer privacy seriously and continuously review our practices and procedures We’ll also be updating information we provide to customers to make our practices more clear.”
We reached out to Amazon with questions but at the time of writing a spokesperson was not available.
Hello and welcome back to Startups Weekly, a weekend newsletter that dives into the week’s noteworthy startups and venture capital news. Before I jump into today’s topic, let’s catch up a bit. Last week, I wrote about SoftBank’s second Vision Fund. Before that, I noted some challenges plaguing mental health tech startups.
Remember, you can send me tips, suggestions and feedback to kate.clark@techcrunch.com or on Twitter @KateClarkTweets. If you don’t subscribe to Startups Weekly yet, you can do that here.
What’s new?
This week DoorDash announced an agreement to acquire Caviar, an on-demand delivery business, from Square. DoorDash says it will pay $410 million for the company in a combination of cash and stock. If you’re thinking that seems like a lot of money, you are very much correct.
It’s so much money that all of us over here at TechCrunch were scratching our heads trying to understand why DoorDash would shell out that kind of cash. After all, Square paid only $90 million in stock for Caviar when it acquired the company back in 2014. However, DoorDash is VC cash-rich. The business, still privately-owned, has raised an astronomical sum of venture capital. This year alone it’s raised $1 billion, including a Series G funding of $600 million that valued it at $12.6 billion.
When a company raises that many huge rounds so close together, you can only assume it’s burning through a lot of cash. When it comes time for DoorDash to begin pitching Wall Street for an IPO — we’re thinking late next year — established subsidiaries like Caviar will at least help bolster its IPO-ready narrative.
With monster companies like DoorDash, Grubhub and UberEats owning the food delivery space, we will no doubt see more big M&A deals and more startups die. (Remeber the insane fall of Munchery, anyone?) But will any of these efforts ever become profitable? Or will DoorDash burn through cash until there’s just no more cash left to burn?
#Equitypod
If you enjoy this newsletter, be sure to check out TechCrunch’s venture-focused podcast, Equity. In this week’s episode, available here, Equity co-host Alex Wilhelm and I attempt to make sense of DoorDash’s acquisition of Caviar. Equity drops every Friday at 6:00 am PT, so subscribe to us on Apple Podcasts, Overcast and Spotify.
Here’s your weekly reminder that for a low price — a complete bargain really — you can learn more about the startups and venture capital ecosystem with a subscription to Extra Crunch. We offer exclusive deep dives, Q&As, newsletters, resources and recommendations, and fundamental startup how-to guides to our subscribers. Here are some of the best EC posts of the week: