Lumosity: a warning to users

Beklager til mine norske lesere for at dette er på engelsk.

Lumosity is one of those services you sign up for and enjoy for a while. It measures and supposedly trains your cognitive skills. It combines this with your demographic data to enable comparison with other, similar users. Now, this isn’t very important data, and this service could be one of those things where you choose to give up some of your privacy in return for a service.

But I’ve always been puzzled by sites that deny users the option to delete their data. In Norway, where I live, this is clearly illegal by our own law of privacy. Data related to people should not be kept in registers for any longer than they are needed, and people have the right to know what data are registered on them. I found an e-mail address in Lumosity’s Terms of Service, and requested the deletion of my user profile. This is the answer I got:

Your information and data are private, according to the terms of sign up. If you wish to stop receiving emails, please use the «unsubscribe» link at the bottom of the original email you received, as I cannot administer list changes. Thanks!
Best,
Aimee

A bit puzzled, I replied:

I’m not sure what to make of your response. I would like you to delete my user account. Can you please do that? Whether my data is «private» or not is more of a semantic question, given the terms of service.

And today, I got the reply:

I’m sorry, but it’s not possible for us to completely purge your information from our system.  Your information is secure as our terms and conditions state, but if you are worried about your information being «out there,» I would recommend logging into your account at lumosity.com/login, then going to «My Account» in the top right corner.  From there, you can change the information associated with your profile.

This got me nervous. Why would anyone construct a website where the staff can’t purge user accounts? After all, the signup terms state that user accounts can be deleted if they are impersonators or minors. Clearly, Lumos Labs were lying to me.

This is a problem if the privacy policy or terms of service of the company opens up for leaks of my personal data. I decided to read Lumosity’s Privacy policy, and I was dismayed to find this there:

We may enhance or merge personal information with your other information and with data from third parties in order to better market and provide our products and services.

In order to better market their products and services? That includes many activities, and they are not required to inform be beforehand. And furthermore:

We employ other companies and people to perform tasks on our behalf and need to share your information with them to provide products or services to you. […] Unless we tell you differently, these agents do not have any right to use Personal Information we share with them beyond what is necessary to assist us.

Which basically translates to: We share all the data we want with whoever we want as long as it helps us. For instance, it clearly «assists» Lumosity to share the data on my skills to a paying recruitment agency or university.

We also disclose Personal Information when required to do so by law, or in response to a subpoena, court order, or other legal mechanism, or when we believe, in our sole discretion, that disclosure is reasonably necessary to protect the property or rights of the Company, third parties or the public at large.

Again the «good part» is in the first part of the sentence, and the bad part in the end. They share data if they believe it is «reasonably necessary» to anyone (the company, third parties or the public at large? That is everyone).

We reserve the right to sell, transfer or otherwise share some or all of our assets, including information provided by you, in connection with a merger, reorganization or sale of some or all of our assets or in the event of bankruptcy. In any such event, personally identifiable and other information may be one of the assets transferred. We will post notice before personal information is transferred and becomes subject to a different privacy policy.

Again, this looks reasonable at first. But when you combine this with their non-deletion-policy, it’s not. They can choose to sell the information about me, if they only notice me beforehand. But I have no way to get out of this, even if they notice me. When the information is sold, the new privacy policy will enter into effect, and that can effectively make my personal information freely available to anyone. This means Lumosity, if they go bankrupt, will make data on my whereabouts and cognitive skills available to anyone interested.

Do also note that Lumosity has a “friends” feature, which is obviously a lot more sensitive than the data on your cognitive skills. I strongly recommend against using this.

As I said earlier, I could agree to take the risk if this was a free service, much like I can agree to watch advertisements in Google. But Lumosity costs $ 80 per year, which is a lot for access to some flash games. I don’t think Lumosity has evil intents, but I am not going to pay for it as long as their privacy policy is this weak. I recommend that you do not either.

And by the way: The so-called scientific base of Lumosity is bogus. One white paper explains how they test for «better working memory» on a group of people with an average age of 54. They ran pre- and post-tests using a web application – one of their games. In between these tests, some participants used Lumosity’s games every day, while a control group didn’t. Unsurprisingly, the control group performed worse than the trained group – but the control group did also improve significantly. The reason, obviously, is that both groups got better at using the tool. The difference between the groups is that the trained group got to play every day for five weeks (an average of 30 times before the post-test), while the control group got to play once before the examination.

*I can use myself as an example. When I used the games for the first time, I received much worse scores than the second time. Only at the fifth or sixth day, perhaps game number 15 or 16, did my scores level out. The implication of this is that scoring well on Lumosity’s games is a skill separate from my cognitive abilities. Either that, or my problem solving skills went from the lowest tenth of the population to the top ten in one week. While I’m sure the «scientific» pre- and post-tests were longer than my first playing of the games, the effect of five weeks of technical training in similar games would be far larger than the real effect on their cognitive skills.

The results of their games can’t – and shouldn’t – be interpreted as real estimates of «memory», «attention», «processing speed» or any other faculty of the brain. It should be interpreted as «skill in Lumosity’s games», much like IQ tests measure how well you perform on IQ tests, and little else. The validity of their measure is quite simply too low, and in particular the validity of changes over time in these games will be even lower. Furthermore, the effect of reading a book or going for a stroll might very well be stronger than the effect of playing a computer game.

I am not saying Lumosity’s games do any harm. The games are fun to play and perhaps they improve the brain. The problem is that they might very well not improve the brain. The so-called science of Lumos Labs does not prove what they claim to be proving. It is not science.

*Disclaimer: I am not a neuroscientist. But I do know statistics.