Partiful’s Security Slip-Up: A Privacy Lesson for the Social Event App World
A Modern Take on Party Planning
Social event platform Partiful, famously branded as “Facebook events for hot people,” has quickly become the go-to digital space for sending stylish party invites. Known for its bold, retro aesthetic and easy RSVP system, the app has attracted a large following and climbed to No. 9 on Apple’s iOS Lifestyle chart, even earning the title of “Best App of 2024” from Google.
Beyond simple event invites, Partiful has morphed into a vibrant social network, mapping user relationships, activity patterns, and even phone numbers — a goldmine of data resembling Facebook’s own social graph.
Concerns Over Data and Origins
As its popularity soared, users began questioning the company’s background. A New York City promoter publicly announced a boycott after learning that Partiful’s founders and staff previously worked at Palantir, the data analytics firm co-founded by Peter Thiel. Palantir’s software has been used by the U.S. government, including ICE’s deportation systems during the Trump administration, fueling skepticism about Partiful’s data practices.
TechCrunch’s Investigation Uncovers a Privacy Flaw
To test these concerns, TechCrunch created a new account and discovered that Partiful failed to remove location metadata from user-uploaded images, including public profile photos.
The publication revealed that anyone with basic web browser developer tools could access raw images stored in Partiful’s Google Firebase database, along with precise GPS coordinates if they were embedded in the photo’s metadata. In essence, a user’s home or workplace could potentially be exposed through their profile photo — a major privacy red flag, especially in rural areas.
Why Metadata Matters
Digital images often contain “metadata” — hidden details such as camera settings, timestamps, and, crucially, latitude and longitude coordinates. While most reputable apps automatically strip this data upon upload, Partiful’s system did not.
When TechCrunch uploaded a test photo taken outside the Moscone West Convention Center in San Francisco, the stored version still contained the exact GPS location, accurate to within a few feet.
Company Response and Fix
Upon being notified, Partiful co-founders Shreya Murthy and Joy Tao confirmed that the issue was “already on our team’s radar, and was recently prioritized as an upcoming fix.”
Initially, Partiful promised a resolution “next week,” but after TechCrunch urged faster action, the company resolved the flaw by Saturday, confirming that metadata was removed from all existing profile photos.
Partiful acknowledged the incident publicly in a post on X (formerly Twitter) shortly before TechCrunch’s article was released.
Still Under Investigation
When asked if any unauthorized access had occurred, Partiful spokesperson Jess Eames said the issue was “still under investigation but we have found no evidence of this yet.” Eames added that the company regularly performs security reviews with external experts, though did not disclose who those experts were.
Partiful has raised over $27 million since 2022, including a $20 million Series A led by Andreessen Horowitz, but declined to comment on whether a formal security audit was conducted prior to launch.
Conclusion: A Growing Pains Moment
The Partiful incident underscores a key reality for fast-growing tech startups — user data protection cannot be an afterthought. While the company has acted quickly to address the flaw, its lapse serves as a cautionary tale in balancing innovation with privacy safeguards.
0 Comments