Unroll.me proclaims that it is a free service on its website but doesn't say explicitly in its promotional materials that it sells user data. (Screen image by Hayley Tsukayama)

“Sneaky.” “Dishonest.” “There is no coming back from this.” Those are a few of the things that users of the email service Unroll.me have had to say to the company, after a New York Times report on Uber included a quick mention that it had sold information about its users' Lyft receipts to Uber.

The reaction to the report highlights the difference between how companies and consumers view data collection — and also points to how almost any company can deal in the selling of data. The truth of the matter is that it's hard to avoid data collection, which is a component of many online services — particularly those that are free. In fact, the only real way to avoid data collection is to read the lengthy privacy policies carefully and stop using those services.

Unroll.me bills itself as a free way to help keep email inboxes under control, in part by making it easy to unsubscribe from marketing lists. But the firm makes its money by gleaning information from users' emailed sales receipts and selling an anonymized version of that information to companies — like Uber — that want to know how people are spending their money.

The company has made no secret of its business plan. In fact, when the company's chief executive Jojo Hedaya apologized earlier this week to the service's users, he thought the firm was already open about what it does.

While “we try our best to be open about our business model, recent customer feedback tells me we weren’t explicit enough,” Hedaya said.

And Unroll.me's privacy policy plainly states: “We may collect, use, transfer, sell, and disclose non-personal information for any purpose.”

But privacy experts say that companies should do more to explain how their businesses work to avoid backlash like this.

“There’s a little Silicon Valley groupthink at work here: They think users understand more about how the data industry works than they do,” said William McGeveran, a privacy expert and professor at the University of Minnesota. Unroll.me's predicament, he said, shows why privacy policies must be the “floor, not the ceiling” of what companies disclose to their customers. Plus, it doesn't help that the company is built on cutting out marketers while participating in another part of the market, he said.

Unroll.me was acquired in 2014 by Slice Intelligence — a firm that deals in data and is itself owned by the Japanese e-commerce firm Rakuten. It's not clear how many users Unroll.me has now, but at that time, TechCrunch reported that the service had 1.3 million users.

The company is already working on new language to make the fact that it sells data gleaned from users' inboxes more explicit, said Jaimee Minney, director of communications for Slice Intelligence.

Minney also said that Unroll.me doesn't collect all information from users' email accounts. While the service does scan through all mail, the only data valuable to the company are non-identifiable pieces information related to purchases — for example, how often, in aggregate, Unroll.me users buy something from a particular company. This, she said, can't be tied back to a particular person. The company also promises that once someone deletes their account, the data associated with that account are also wiped.