Anime selfie app Meitu is responding to reports that it is collecting and sending back to China more data from users' phones than is necessary.
In a statement provided to PCMag, the company acknowledged that it collects data such as MAC address/IMEI number, IP address, SIM card country code, GPS and network location, and phone carrier info. It says this is within Apple's iOS developer guidelines and terms and similar to those on popular photo-editing apps for Android users, but developers this week expressed concern that Meitu is too aggressive with its data collection.
In a tweet that now appears to be deleted, Developer Zoë Quinn warned users about some "VERY shady code" discovered in the app. "It asks for permissions to far more things than it needs, and researchers have found it is phoning home (back in China) and sending back a ton of data it shouldn't be, including your GPS info, IMEI (unique phone ID needed to clone your phone) and other personal/sensitive info," she wrote.
In another still-live tweet, she called Meitu "an infosec nightmare."
Meitu said its policies are dictated in part because of Internet restrictions in its home country of China.
"As Meitu is headquartered in China, many of the services provided by app stores for tracking are blocked. To get around this, Meitu employs a combination of third-party and in-house data tracking systems to make sure the user data tracked is consistent," it said in a statement. "Furthermore, the data collected is sent securely, using multilayer encryption to servers equipped with advanced firewall and IDS, IPS protection to block external attacks."
The company is currently developing plans to move servers and user data outside of China, but did not provide any other details on these arrangements.
The app lets you snap selfies and apply filters that make you look like an anime character. It's been around for awhile, but only just exploded on social media in the US this week.
"Meitu's sole purpose for collecting the data is to optimize app performance, its effects and features and to better understand our consumer engagement with in-app advertisements. Meitu DOES NOT sell user data in any form," according to the company.