Skip to content

Out of Gas

Gasapp home page, with single link to the iOS app

Gas is the latest app to get attention from the hand-waving wing of the edtech press. In general, I try and ignore coverage of “the latest app that schools should worry about” because if past is prologue, the coverage is reliably mediocre.

I would love to say that Gas is where this trend changes, but that would be untrue.

Specifically, I mean that people writing about these services omit key details related to the service, and/or don’t catch things that should be caught.

For example, Common Sense Media has a review of Gas. They say that the app is good for children age 10+.

Screenshot from Common Sense Media review

Gas’s privacy policy clearly states that it should only be used for people 13 and over.

“Gas is not intended for children under 13 and we do not believe we have collected any data from children under 13. If we learn that we have collected data from children without proper consent, we will delete that data.”

I would be curious to know why Common Sense appears to be encouraging preteens to violate the policies of online services.

Bark – a company that sells software and services that allow adults to surveil children – has a writeup on Gas that misunderstands the technical realities of how apps work.

Bark’s review says this about Privacy:

“Despite being a quasi-anonymous app, Gas will access your contacts and insert them into the polls. It will also allow you to join a local school group based on your location if you’re in the right age range. That being said, no real identifying information is revealed beyond your name. However, this is a paid “God mode’ that enables curious users to reveal names.”

Gas’s privacy policy contains more precise information than the Bark review. According to Gas’s privacy policy, the app can reveal information about age, gender, friends (via Contacts), in addition to a name.

“You can use Gas to answer polls about your friends. When answering a poll, we send your response to your friend via the App and it includes your grade, gender, and the other poll options, which could include friends or Contacts. Your friend may reveal your name if they subscribe to additional services.”

Additionally, Gas collects multiple identifiers from each user that are often used in a device profile. Gas’s privacy describes their practice clearly:

“When you use the app, we automatically collect certain information about your device (such as the type of device, operating system, IP address, and unique identifiers) and how you interact with the app (such as the actions you take and how long you use the app).”

Between name, email address, approximate location, contacts lists, precise device data, and answers to quizzes, Gas has a pretty good sense of who people are, who they hang out with, where they are, and what they care about. But sure, Bark: keep telling people that “no real identifying information is revealed beyond your name.”

And about those quizzes. An Edweek article opens with this statement:

“Users can only say nice things to each other, by participating in polls with an ostensibly positive spin, instead of writing their own, possibly hurtful messages.”

It’s almost like we’ve never seen any app that combines online quizzes with contact harvesting. Can we please, please, please remember that online quizzes and likes can be used to create profiles?

Asking for a friend. And yeah, also, for democracy.

The EdWeek piece continues to describe the app as an iOS only offering.

“But dig a little deeper and it’s clear that Gas—recently the number one downloaded free social media app in Apple’s app store—has serious flaws, experts said.”

This appears to be confirmed by Gas’s own home page – the page only has a link to the iOS app.

Gasapp home page, with single link to the iOS app

Gasapp home page, with single link to the iOS app

This is Gas on the Apple store:

Gas on the Apple store

Gas on the Apple store

However, over on Google Play, you can grab a Gas app. It uses similar images and language as the iOS version, although it appears to be made by a different developer.

Google Play Store listing for a Gas app

Google Play Store listing for a Gas app

I do not have enough data to say definitively if the Android version of the Gas app is a copy, or whether it’s affiliated with the real thing, but multiple details suggest it’s a clone that is not connected to the “real” Gas. In addition to not being listed on Gas’s site, the developer information links to a privacy policy hosted on Blogspot for a NFT creator.

There are multiple other issues with the Android app, including the fact that the developers claim that no data are collected, and the fact that the developers state that data aren’t encrypted. The lack of encryption appears to be confirmed by static analysis I ran on the Android app.

Developer info linking to a privacy policy hosted on Blogspot

Developer info linking to a privacy policy hosted on Blogspot

If this app is a clone not affiliated with the real app, it seems like Google has some obligation to remove the app, and it’s very odd that their management is inept to the point of not catching this themselves.

And: for people writing about app – when you are writing about an app that is only available on one platform, do a search on other platforms. This is basic. It takes under 30 seconds. It’s nearly 2023. Why isn’t this standard practice?

So, that’s Gas. Of course it’s crap, and of course it’s privacy practices are questionable, and of course there might be opportunistic clones springing up. Kids are targeted by predatory tech all the time, and until we have media coverage that meets some basic level of competence and directness, any accountability for tech companies will be limited.