Glassbox

As of October 2018, Glassbox had raised US$32.5 million of capital funding.[2] In exchange for investing in Glassbox, Washington, DC, equity firm Updata Partners was given two Glassbox board seats.[2]

In April 2020, Glassbox raised US$40 million in series C funding.[5]

In October 2020, Glassbox acquired its rival SessionsCam.[4]

The Glassbox SDK can collect almost all data an app user enters into a screen, like passwords and credit card info, as well as mouse movements, clicks, scrolling, swiping, tapping, and more. Generally, the session replays of these activities are sent to the server of the analytics vendor or saved on the app developer’s server. When the data is not concealed properly, anyone who can access the screenshot database can see the information. This incident is just another salient example of the risk posed to mobile users by apps believed to be secured but which, in fact, are vulnerable to data exposures.

— Elaheh Samani, App Analytics SDKs Could Expose Sensitive Data, Broadcom Symantec, February 2019[9]

From at least as early as October 2018, Glassbox promoted its software as allowing its customers' websites or mobile apps to "see exactly what your customers do in real time".[10][2][8][5][6] This prompted some Twitter users to express privacy concerns about Glassbox's software.[11][10]

In February 2019, TechCrunch reported that numerous popular applications in Apple's iOS App Store used Glassbox software to record users' activities without the users' informed consent, which compromised users' privacy and contravened the rules of the iOS App Store.[7][12][13][14] The affected apps included ones published by Abercrombie & Fitch, Air Canada, Expedia, Hollister, Hotels.com, and Singapore Airlines.[15]

In response, Apple told app developers that if they continued to flout the rules of the iOS App Store, their apps would be removed from it.[16][17][18] However, it was not clear whether Apple's request was heeded.[19]

Following TechCrunch's investigation, security researchers from Symantec's enterprise mobile threat division found 277 iOS apps and 291 Android apps that employed Glassbox software, including a number of banking and credit card apps, "putting a user's financial information at risk of exposure".[9] Google, whose Play Store is the Android counterpart of the iOS App Store, did not comment on whether it would expect Android app developers to remove session-replay functionality.[20][21]

Anti-malware company Avast observed that using session-replay analytics "without even mentioning it is not right, and probably illegal in some countries."[22] Computer science professor Thomas Keenan, author of the book Technocreep, suggested that people who do not want a company to record their data like this should delete the app concerned.[23] IT Pro reported that Glassbox retains session, demographic, and location data for up to 24 months, categorizing it by age, gender, and interests, and may combine it with other information obtained from other companies.[24]