NearScrub

2026-08-04

The Partiful GPS leak, and why removing photo location data yourself is the only guarantee

An event-invite app is about as far from a typical security-research target as social software gets — no financial data, no private messages beyond party logistics, mostly casual social graphs. That's what makes what TechCrunch found in Partiful's photo uploads such a clean illustration of a narrower point: whether a platform actually strips your photo's GPS data isn't something you, the person uploading it, can verify from outside the app — no matter how well-reviewed or well-funded the app is, and even when the company genuinely intends to remove it.

What TechCrunch actually found

On October 4, 2025, TechCrunch reporters Zack Whittaker and Amanda Silberling published findings that Partiful — a social app for sending and RSVPing to event invitations — hadn't been stripping GPS coordinates from user-uploaded profile photos. The photos, stored in Partiful's back-end database hosted on Google Firebase, still carried the exact latitude and longitude of wherever they were taken. TechCrunch reported that it "was possible for anyone, using only the developer tools in a web browser, to access raw user profile photos" — the metadata wasn't hidden behind some obscure admin system, just behind the ordinary browser inspection tools built into every desktop browser.

To confirm it, TechCrunch ran a direct test: they uploaded a profile photo taken just outside San Francisco's Moscone West Convention Center, then checked what Partiful's server had actually stored. The coordinates were still there — accurate, in the reporters' words, to "a few feet," precise enough in a rural area to point at a single building.

The company's response, and the part nobody outside it could answer

Partiful co-founder Joy Tao told TechCrunch the issue was "already on our team's radar, and was recently prioritized as an upcoming fix," and initially said a fix was about a week out; after TechCrunch pushed for something faster, the company shipped it by that Saturday and removed the metadata from already-stored photos. Spokesperson Jess Eames said whether the data had actually been pulled in bulk before the fix was "still under investigation but we have found no evidence of this yet." What the reporting doesn't say — because there's no way to know from outside the company — is how long the gap existed before TechCrunch's test found it, or how many users had a profile photo sitting there with their coordinates attached the whole time. That's not a hole in TechCrunch's reporting; it's the actual shape of the problem. A user has no way to audit what a platform does with a file after upload, and in this case, neither, apparently, did anyone at the company until someone went looking from outside.

The same story, thirteen years earlier

This isn't a new category of problem. In April 2012, the Electronic Frontier Foundation published a post prompted by the arrest of a hacker known online as "w0rmer," traced in part through GPS coordinates embedded in a photo taken on an iPhone 4. EFF's writeup made a second point worth keeping alongside the location data: the same EXIF block that carried the GPS tag also carried the camera's serial number, which let police "scour the internet for other pictures tagged with the same serial number" — tying separate posts back to one device even when a single photo alone gives away no location. EFF's advice then is the same advice that applies to Partiful now: "if you're using a smartphone to take pictures, disable geotagging from your pictures... make sure you scrub its metadata before you upload it on the Internet." Thirteen years, a completely different kind of app, and the underlying fact hasn't moved: a photo file carries more than the picture, by default, unless something removes it.

Why "the app probably handles it" isn't a safe assumption

A different post on this blog looked at point-in-time tests of whether specific marketplaces strip Exif data on upload as a matter of policy, and found several that reliably did, tested independently three years apart. Partiful is a different kind of case: not a platform that never intended to strip metadata, but one that meant to and had a gap between that intent and what actually shipped — a gap nobody outside the company could see from the feed, from the app's own photo display, or from anything a user could check before hitting upload. A platform's privacy-handling code runs on infrastructure a user can't inspect, and — as this case shows — a company can genuinely intend to strip metadata and still ship a build that doesn't, for however long it takes an outsider to notice and report it.

Who controls whether your photo's GPS data survives ✕ After you hit upload — outside your control Whether the platform's server actually strips GPS metadata The gap between "meant to fix it" and what shipped in code How long a gap like that goes unnoticed before someone finds it ✓ Before you hit upload — inside your control Stripping EXIF/GPS from the file on your own device, first NearScrub: EXIF/GPS/XMP/IPTC removed in the browser, no upload Nothing left to expose later — the data was never in the file
What happens to a photo's GPS data after upload depends on someone else's code and its bugs — including the documented Partiful case above. Removing it before upload is the one step that doesn't.

What actually closes the gap

The one thing that doesn't depend on which app you're using, how well-funded or well-reviewed it is, or whether its metadata-stripping code happened to ship correctly this month is removing the GPS data before the file exists anywhere but your own device. That's what NearScrub does for JPEG and PNG photos: drop the file in, and the EXIF block — GPS coordinates, camera details, and the rest — along with XMP and IPTC data, comes out entirely inside the browser, before the photo goes anywhere. There's no server-side step for a bug to hide in, because there's no server involved at all; a file that never carried the coordinates in the first place can't be exposed later by someone else's implementation gap, however that gap gets discovered or however long it takes to fix.