> there's no universe with perfectly secure software

This is why it's important to minimize the attack surface. Yes, there is always going to be risk when you store tracking data. You are choosing to create that risk by storing any data beyond what is specifically necessary. Uses such as "Optimizing pickups and dropoffs" are optional, which you more or less admit when you said it was something "we could do".

Alternatively, you could prioritize the safety of your customers by minimizing the risks they acquire when they use your service. The data collected for the ride could be minimized. You could expunge user data when it is no longer needed. You could find ways to store only aggregate data instead per-user values.

> we put safeguards in place

You also made design and business decisions that created the need for those safeguards. You are protecting your users from a problem that you created.

edit:

> we do our best to serve our users as best we can

You could be indemnifying you users for any damages that derive from the data you are choosing to store.

I don't want to sound like I'm disagreeing with you, but I want to raise some important points. Collecting too much data is definitely a bad thing. But there are things to consider:

> You are choosing to create that risk by storing any data beyond what is specifically necessary.

That's an interesting point and it begs that question of what is "necessary". Does that mean a company should distill its product down the the absolute minimum viable product without collecting any information beyond what is necessary to do its job? Nobody should use Google Analytics because it's not necessary to run a website? "Necessary" isn't black and white.

Pickups and dropoffs are very troublesome parts of an Uber ride (and definitely can't be avoided...the riders need to get in and out of the car without being run over). Uber currently has no way of improving that, without data at least. So what data is "necessary" to make that experience better? How can Uber, or any for-profit company, improve their product if they have no idea what's wrong with it? What kind of data can be collected that falls into the bucket of "necessary"?

> You could expunge user data when it is no longer needed.

Other than when a user leaves the service, how do you know when data is no longer "needed"? How can trends be measured over time if old data is expunged? How can fraud trends be detected if historical payment data is not preserved? How can Uber choose the best restaurants for UberEATS if order history is dropped over time?

When a user leaves a service for a time and returns, do they return to find a completely empty account? Would you expect this from Gmail, or Facebook?

At what point do you draw the line where you say, "I'm sure we'll never need this again."?

> You could find ways to store only aggregate data instead per-user values.

This assumes the data is homogeneous, which it's not. Different people use Uber (and any other service, for that matter) in different ways. Lumping everything together makes it impossible to discern patterns that are substantial but do not represent a majority of your user base: Some folks only ride to and from work. Some folks only ride to and from bars. Some folks only ever use Uber to go to the airport. How do you identify and optimize for these use cases?

It also calls into question how you bucket your data. Location data in California is not relevant to location data in New York. Location data in Rochester is not relevant to location data in New York City. Location data in Brooklyn is not very relevant to location data in Manhattan. At what point do you stop scrubbing your data into an aggregate form? How do you avoid scrubbing too much data away such that you've painted yourself into a corner when you try to solve a problem in the future? How do you avoid scrubbing too little, such that even when the UUIDs are stripped away you can use a big ol' hadoop job against pickup and dropoff locations to figure out which trips belong to which user?

It's worth asking also how much value you can provide to the user if you do all of these things. When I go home for the holidays once a year, I take Uber quite a lot. Should Uber forget my favorite destinations every year because the data gets expunged? Should it only show common destinations because my trip history has been anonymized?

Anyway, this is meant to point out that it's not simply a matter of keeping things as minimal as possible. It's hard to add value while also protecting users, even when the users' best interests are in mind.

"Just because you can, doesn't mean that you should."

I think people could be picked up and dropped off just fine prior to this update so it's not something fundamentally broken. Could things be improved? Sure but the benefits need to be weighed vs. the tradeoff.

Given the many responses that you have gotten so far arguing against your stance, it might be helpful to consider why people are having such a reaction. We have valid concerns and they should be addressed.

Firstly, I just want to take the opportunity to thank you for sticking around and taking part in the conversation. While my own thoughts lie mostly with the other respondents in this thread, it's critical that we have channels somewhere in-between "press release" and "Wikileaks" for getting some insight into the workings of companies like Uber.

Having said all that, it's still creepy. And the examples you gave (Google/Gmail, Microsoft/Cortana) are almost certainly also instances where data collected is being systematically used in what many would consider creepy ways.

I don't want to sound like I'm minimizing the issue, when I say this, because I respect the sentiments expressed here greatly. But there's a very strong stigma around collection of location data, more so than other forms of more sensitive information. Almost every credit card company, bank, insurance company, and more share your every purchase. What you buy, what you eat, how you live. As far as the sensitivity of data goes, location data is serious, but far less serious compared to things that people are mostly okay with.

For me, I go to and from home, the gym, and work. Every day. If someone was looking at that data, I'd be creeped out, but they'd learn almost nothing about me. If someone saw my credit card statements, I'd be mortified. And yet, almost everyone forgets to fill out and mail back that little slip you get with a new credit card that says "hey, actually I don't want you to sell all of my data to everyone on the planet."

> For me, I go to and from home, the gym, and work. Every day. If someone was looking at that data, I'd be creeped out, but they'd learn almost nothing about me.

Ha, this sounds exactly like "I have nothing to hide, so I'm okay with the NSA gathering all of my data".

Some people do have things to hide: they are having affairs, visiting prostitutes, going to Planned Parenthood to have an abortion, going to a cancer center to get treatment,...

I'd suggest you read https://www.wired.com/2013/03/anonymous-phone-location-data/ if you have not previously seen this.

Part of the issue is that location has a lot more "physicality" tied to it. One can't easily change where they live, work etc. whereas it's much easier to switch credit cards.

> I say this in a general sense, not specifically to Uber. It comes down to trust.

Yeah, I suppose this is true. Thanks for sharing your thoughts, I appreciate it.