Reporting poor privacy practices in a mobile app
<p>I found a vulnerability in a paid Smartphone app. It is supposed to contain a lot of private details.</p>

<p>There is a logging option for support that you can switch off and on, to extract the part that causes you problems. The app's support can ask you to send them the log for review.</p>

<p>The problem is:</p>

<p>The app creates an email with a zip file and claims that it only contains logging information.</p>

<p>What it really does contain is the whole database, all private details you have ever entered. Neither the database, nor the zip file is encrypted. Plus the logging information.</p>

<p>A trusting customer would send the email, whose recipient is auto-added, and send his data unencrypted throughout the internet to the us-based company.</p>

<p>As the company implemented it that way, it is a bad idea to notify them.</p>

<p>Who should I notify for the company to not be alarmed and for the government to take appropriate action?</p>

<p>I am not US-based.</p>

<blockquote>
  <p>As the company implemented it that way, it is a bad idea to notify them.</p>
</blockquote>

<p>First and foremost, you notify the company of a security issue - you give them a reasonable amount of time to resolve it, and then you publish it.  The management may know nothing about how the data is handled, and may rush to fix it when notified - you cannot make an assumption that everyone in the organisation is fully in the know and has given permission for the app to work in that way.  </p>

<p>This may be something as simple as a dev leaving extra data in the report for debugging purposes that should have been removed before final release.</p>

<p>If you are an EU country or the UK, you can contact someone like the <a href="https://ico.org.uk/make-a-complaint/your-personal-information-concerns/" rel="nofollow noreferrer">Information Commissioners Office</a> and lodge a complaint.</p>

<p>If I were you, I’d ask the advice of someone who regularly handles data protection breaches about your next steps - perhaps reach out to Troy Hunt, who runs the Have I Been Pwned website and deals with disclosure daily.</p>

<p>You should notify it to Google or Apple.
The application is clearly spying on customers.</p>

<p>The owner of the application said "we only collect X information" but instead, the application is collecting X + Y. then it breaches the contract.</p>

united-states intellectual-property privacy gdpr