Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnSquareMore
Event startup Partiful did not remove GPS data from photos uploaded by users

Event startup Partiful did not remove GPS data from photos uploaded by users

Bitget-RWA2025/10/04 19:06
By:Bitget-RWA

Partiful, a social event planning app that brands itself as “Facebook events for hot people,” has quickly taken over as the preferred way to send out party invites, replacing Facebook. However, like Facebook, Partiful is amassing a vast amount of user data, and its efforts to protect that information have not been flawless.

On Partiful, event organizers can design digital invitations with a nostalgic, bold style, making it as simple for guests to RSVP as it is to order food on a touchscreen. The app’s focus on being both stylish and easy to use has helped it climb to #9 in the iOS App Store’s Lifestyle category. Google even named Partiful the “best app” of 2024. 

Today, Partiful functions as a robust social network similar to Facebook, easily charting your friendships, your friends’ connections, your activities, locations, and even your phone numbers.

As the app’s popularity soared, some users began to question its background. A promoter in New York City announced a boycott of Partiful, citing that its founders and some employees previously worked at Palantir, Peter Thiel’s data analytics company, which developed the software used by ICE for the Trump administration’s deportation efforts.

Amid these concerns, TechCrunch created a new account to test Partiful. It quickly became apparent that the app was not removing location data from images uploaded by users, including those used for public profiles.

TechCrunch discovered that anyone with access to a web browser’s developer tools could retrieve unprocessed user profile images from Partiful’s backend, which is hosted on Google Firebase. If a photo included exact GPS data, others could view the precise spot where the image was taken.

Most digital files, such as smartphone photos, carry metadata that details information like file size, creation date, and author. For photos and videos, this metadata can also reveal the camera type, its settings, and the exact latitude and longitude where the image was shot.

This security issue is concerning because anyone using Partiful might have unintentionally exposed the location where their profile photo was taken. Some users’ profile pictures included detailed location information that could pinpoint a home or workplace, especially in less populated areas where individual buildings are easier to identify on a map.

It is standard for platforms hosting user photos and videos to automatically strip metadata upon upload to prevent such privacy breaches. 

TechCrunch confirmed the vulnerability by uploading a profile photo to Partiful that had been taken outside San Francisco’s Moscone West Convention Center, complete with embedded location data. Upon checking the image stored on Partiful’s servers, the metadata—including the exact coordinates—remained intact.

TechCrunch’s profile photo uploaded to Partiful included GPS metadata. Image Credits:TechCrunch A Google Map showing where the Partiful profile photo was taken. Image Credits:TechCrunch

After identifying the vulnerability, TechCrunch contacted Partiful co-founders Shreya Murthy and Joy Tao via email, since there is no public channel for reporting security issues. TechCrunch provided a link to a user’s raw profile photo that revealed the user’s real-world location at the time it was taken, which was a residential address in Manhattan.

Tao informed TechCrunch on Friday that their team was already aware of the issue and had recently made it a priority to address it. 

Partiful initially said the bug would be fixed by “next week,” but due to the sensitive nature of the data, the company resolved the issue by Saturday at TechCrunch’s request.

On Saturday, TechCrunch confirmed that metadata had been stripped from all user-uploaded photos, including the test image with location data.

Shortly before this article was published, Partiful publicly acknowledged the security issue in a tweet.

When TechCrunch asked whether Partiful had the technical capability—such as logs—to determine if anyone had accessed user profile photos in bulk or individually, spokesperson Jess Eames replied that the matter was “still under investigation but we have found no evidence of this yet.”

Eames added that the company “regularly perform security reviews with experts in the field, not just as a one-time action but as part of our ongoing processes.” When asked, Partiful did not disclose the names of these experts to TechCrunch.

Since its launch in 2022, Partiful has secured over $27 million in funding, including a $20 million Series A round led by Andreessen Horowitz. When asked if a security audit had been conducted before the product’s release, the co-founders declined to answer.

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!

You may also like

BCH Rises 0.09% as Momentum Fuels Outperformance

- BCH rose 0.09% in 24 hours but fell 4.22% in seven days, yet gained 22.72% annually. - It outperformed its Zacks Banks - Foreign sector with 0.66% weekly gains vs. -2.46% industry decline. - Earnings estimates rose twice in two months, boosting consensus from $2.54 to $2.56. - With a Zacks Rank #2 (Buy) and Momentum Score B, BCH shows strong momentum potential. - Annual 63.46% gains and positive revisions solidify its position as a top momentum stock.

Bitget-RWA2025/11/28 05:26
BCH Rises 0.09% as Momentum Fuels Outperformance

DOGE drops 1.36% as Bitwise ETF debuts

- Bitwise launched the first Dogecoin ETF (BWOW) on NYSE, offering institutional-grade exposure to the memecoin. - DOGE fell 1.36% in 24 hours but rose 7.34% weekly, reflecting mixed short-term market sentiment. - The ETF aligns with growing institutional adoption and regulatory momentum for altcoins, despite a 52.35% annual decline. - Similar products like Bonk’s ETP and Ethereum upgrades highlight maturing crypto infrastructure and investor demand.

Bitget-RWA2025/11/28 05:26
DOGE drops 1.36% as Bitwise ETF debuts

ZEC Falls 4.01% After Grayscale Submits Zcash ETF Conversion Application

- Zcash (ZEC) fell 4.01% in 24 hours as Grayscale files to convert its Zcash Trust into an ETF. - The ETF conversion aims to boost institutional exposure and regulated market access for ZEC. - ZEC shows 16.26% monthly gain and 736.04% annual rise despite recent 17.89% weekly drop. - Analysts highlight ETF approval could stabilize ZEC’s price and attract diversified investors. - The SEC’s decision on the ETF remains pending, shaping market perceptions and ZEC’s adoption trajectory.

Bitget-RWA2025/11/28 05:26
ZEC Falls 4.01% After Grayscale Submits Zcash ETF Conversion Application

Algo Falls by 0.69% as Market Fluctuations and Ongoing Downtrend Persist

- Algo (ALGO) fell 0.69% in 24 hours to $0.1434, contrasting with 5.52% weekly gains but a 57.16% annual decline amid crypto market uncertainty. - Switzerland delayed CARF crypto reporting rules until 2027, citing stalled international data-sharing talks, hindering global regulatory alignment. - Bonk (BONK) launched Europe's first ETP on SIX Swiss Exchange, enabling traditional investors to access memecoins without digital wallets. - Ethereum prepares December 3 gas limit upgrade to 60M, enhancing layer-2

Bitget-RWA2025/11/28 05:04
Algo Falls by 0.69% as Market Fluctuations and Ongoing Downtrend Persist