Risk of User Data Exposure in Partyful App: Security Flaw to Be Addressed Promptly

Staff Reporter | PNN:

The new social event planning app, Partyful, which markets itself as a “Facebook Events for hot people,” has surpassed Facebook in party invitations. However, like Facebook, Partyful collects a large amount of user data and has not taken sufficient measures to ensure its security.

On Partyful, hosts can create retro-style online invitations, and guests can easily RSVP. The app is user-friendly and trendy, reaching #9 on the iOS App Store lifestyle chart. However, tests by tech news outlet TechCrunch revealed that location data from user-uploaded photos was not fully removed.

Anyone could access the backend database and determine the location where a user’s profile photo was taken. This could particularly expose users’ homes or workplaces in rural areas.

After TechCrunch informed Partyful co-founders Shreya Murthy and Joy Tao via email, they confirmed that the issue was already under review by the team, and resolving it was prioritized. Over the weekend, the problem was fixed, and metadata was removed from users’ photos.

Founded in 2022, Partyful has raised $27 million in funding, including $20 million in Series A investment. The company stated that it conducts regular security reviews and is investigating whether any user photos were directly or widely accessed.