Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnSquareMore
Event startup Partiful did not remove GPS data from photos uploaded by users

Event startup Partiful did not remove GPS data from photos uploaded by users

Bitget-RWA2025/10/04 19:06
By:Bitget-RWA

Partiful, a social event planning app that brands itself as “Facebook events for hot people,” has quickly taken over as the preferred way to send out party invites, replacing Facebook. However, like Facebook, Partiful is amassing a vast amount of user data, and its efforts to protect that information have not been flawless.

On Partiful, event organizers can design digital invitations with a nostalgic, bold style, making it as simple for guests to RSVP as it is to order food on a touchscreen. The app’s focus on being both stylish and easy to use has helped it climb to #9 in the iOS App Store’s Lifestyle category. Google even named Partiful the “best app” of 2024. 

Today, Partiful functions as a robust social network similar to Facebook, easily charting your friendships, your friends’ connections, your activities, locations, and even your phone numbers.

As the app’s popularity soared, some users began to question its background. A promoter in New York City announced a boycott of Partiful, citing that its founders and some employees previously worked at Palantir, Peter Thiel’s data analytics company, which developed the software used by ICE for the Trump administration’s deportation efforts.

Amid these concerns, TechCrunch created a new account to test Partiful. It quickly became apparent that the app was not removing location data from images uploaded by users, including those used for public profiles.

TechCrunch discovered that anyone with access to a web browser’s developer tools could retrieve unprocessed user profile images from Partiful’s backend, which is hosted on Google Firebase. If a photo included exact GPS data, others could view the precise spot where the image was taken.

Most digital files, such as smartphone photos, carry metadata that details information like file size, creation date, and author. For photos and videos, this metadata can also reveal the camera type, its settings, and the exact latitude and longitude where the image was shot.

This security issue is concerning because anyone using Partiful might have unintentionally exposed the location where their profile photo was taken. Some users’ profile pictures included detailed location information that could pinpoint a home or workplace, especially in less populated areas where individual buildings are easier to identify on a map.

It is standard for platforms hosting user photos and videos to automatically strip metadata upon upload to prevent such privacy breaches. 

TechCrunch confirmed the vulnerability by uploading a profile photo to Partiful that had been taken outside San Francisco’s Moscone West Convention Center, complete with embedded location data. Upon checking the image stored on Partiful’s servers, the metadata—including the exact coordinates—remained intact.

TechCrunch’s profile photo uploaded to Partiful included GPS metadata. Image Credits:TechCrunch A Google Map showing where the Partiful profile photo was taken. Image Credits:TechCrunch

After identifying the vulnerability, TechCrunch contacted Partiful co-founders Shreya Murthy and Joy Tao via email, since there is no public channel for reporting security issues. TechCrunch provided a link to a user’s raw profile photo that revealed the user’s real-world location at the time it was taken, which was a residential address in Manhattan.

Tao informed TechCrunch on Friday that their team was already aware of the issue and had recently made it a priority to address it. 

Partiful initially said the bug would be fixed by “next week,” but due to the sensitive nature of the data, the company resolved the issue by Saturday at TechCrunch’s request.

On Saturday, TechCrunch confirmed that metadata had been stripped from all user-uploaded photos, including the test image with location data.

Shortly before this article was published, Partiful publicly acknowledged the security issue in a tweet.

When TechCrunch asked whether Partiful had the technical capability—such as logs—to determine if anyone had accessed user profile photos in bulk or individually, spokesperson Jess Eames replied that the matter was “still under investigation but we have found no evidence of this yet.”

Eames added that the company “regularly perform security reviews with experts in the field, not just as a one-time action but as part of our ongoing processes.” When asked, Partiful did not disclose the names of these experts to TechCrunch.

Since its launch in 2022, Partiful has secured over $27 million in funding, including a $20 million Series A round led by Andreessen Horowitz. When asked if a security audit had been conducted before the product’s release, the co-founders declined to answer.

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!

You may also like

Spirit Blockchain Faces Leadership Challenges as Interim CFO Navigates Regulatory Uncertainty

- Spirit Blockchain filed interim financial reports and MD&A for Q3 2025, with CEO Lewis Bateman serving as interim CFO after Inder Saini's departure. - The blockchain infrastructure firm focuses on recurring revenue through licensing and digital asset support, navigating regulatory risks and market volatility. - A separate SPIR-listed Spire Global faces NYSE delisting risks for missing filings, creating potential investor confusion between the two unrelated companies. - Bateman's dual role may streamline

Bitget-RWA2025/11/29 01:12
Spirit Blockchain Faces Leadership Challenges as Interim CFO Navigates Regulatory Uncertainty

ZEC drops 20.91% in a week as surging retail activity heats up the futures market

- Zcash (ZEC) rose 0.28% in 24 hours but fell 20.91% weekly amid volatile derivative markets and shifting demand. - Stagnant shielded pool activity, including the Orchard and Sapling pools, signals weakening demand for ZEC's privacy features. - Overheated retail-driven futures markets and declining open interest highlight risks of sharp corrections after historical patterns. - ZEC approaches critical $436 support level, with analysts warning of potential 30% declines if technical indicators break.

Bitget-RWA2025/11/29 01:08
ZEC drops 20.91% in a week as surging retail activity heats up the futures market

DASH Rises 54.08% Over the Past Year as Institutions Invest and Earnings Announced

- DoorDash (DASH) surged 54.08% in 12 months amid strong institutional buying, including Jefferies' 40.7% stake increase and Vanguard's $10.15B holdings. - Q3 earnings missed estimates ($0.55 vs $0.68) but revenue grew 27.3% to $3.45B, with analysts maintaining "Moderate Buy" ratings and $275.62 average price targets. - Insider sales totaling $15.4M contrasted institutional confidence, as DASH trades at $81.1B market cap with 95.47 P/E ratio, reflecting long-term growth bets in on-demand commerce.

Bitget-RWA2025/11/29 01:08
DASH Rises 54.08% Over the Past Year as Institutions Invest and Earnings Announced

Ethereum Updates Today: Vitalik Buterin: Privacy Should Be Considered Digital Hygiene, Not an Exclusive Privilege

- Ethereum co-founder Vitalik Buterin donated 256 ETH ($800,000) to privacy-focused messaging platforms Session and SimpleX, advancing metadata privacy in digital communication. - The platforms use decentralized infrastructure and avoid centralized identifiers, addressing vulnerabilities in traditional messaging systems through unique approaches like service nodes and user-controlled servers. - Buterin's move counters EU regulatory pressures on encrypted messaging, emphasizing privacy as a fundamental righ

Bitget-RWA2025/11/29 00:50
Ethereum Updates Today: Vitalik Buterin: Privacy Should Be Considered Digital Hygiene, Not an Exclusive Privilege