For developers: keeping users safe from technology-facilitated abuse
Could your app be enabling technology-facilitated abuse?
Please note: Refuge is not able to endorse or approve individual products, this page is for advice and guidance only.
As an app developer, you are responsible for making sure your users are safe from technology-facilitated abuse.
When developing a new app or update for an existing app, it is important to consider the ways it might be misused, this includes:
- coercion
- monitoring
- harassment
This is especially important for apps that collect, store, or share user data, such as:
- location data
- text and communications
- images
- account information
Collecting this data means users could misuse your app to monitor or control others.
We have created a checklist of things it is important to consider when building an app, or developing updates for an existing app.
App safety checklist – 10 things to consider
1) If someone had a user’s unlocked phone, what could they see in the app?
It’s important to consider additional privacy features in case someone else has access to a user’s device. For example, adding the functionality to password protect the app itself.
2) Is it possible to view sensitive information through the app’s notifications, previews, widgets, or the lock screen?
This could bypass the additional privacy features like in-app passwords, as the app may display sensitive information in a way that would be visible to others without them needing direct access to the device or app.
3) Is location data being collected that could be used to see a user’s movements or routines?
Any location sharing or monitoring features should be transparent, consensual, and easily disabled by the user. Hidden or persistent tracking can be misused for abuse.
4) Does the app request permissions that aren’t strictly needed?
You should only collect data that is necessary for the core function of the app, and provide users with clear information about what data is collected, how it is used, and who can access it.
5) Can users clearly see and control who has access to their data, their location, or their account?
Users should have clear and meaningful control over permissions, account access, and the ability to revoke access previously granted to others.
6) Could someone else access a user’s account through a shared device, saved logins, other user profiles, or SMS verification codes?
It’s important to have strong authentication processes and protection against unauthorised account access, especially if your app handles sensitive personal information.
7) Does the app store sensitive information locally, that could be viewed through backups, logs, or cached data?
Where possible, sensitive data should not be stored locally, or should be minimised and protected, and excluded from automatic backups.
8) Could app features such as messaging, location sharing, or monitoring tools be misused to track or harass someone?
Features that allow a user to monitor another person’s activity, messages, or device usage can be misused, and should be carefully designed with clear safeguards.
9) Can a user quickly exit, hide, or secure the app if someone is watching their screen?
Users may need to act quickly if they are being observed or monitored by someone else. Features that help with quickly exiting, hiding, or securing the app can help reduce the risk of sensitive information being seen.
10) If a user lost control of their device or account, are they able to easily regain control safely?
Users should be able to take steps to secure their account if it has been accessed by someone else. This includes options to reset passwords, log out of other devices, revoke active sessions, and update account details in a way that does not rely on information another person may have access to.