Tinder, Hinge, OkCupid, POF (Plenty of Fish), BLK (com.okcupid.okcupid, com.pof.android): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
5 of 387 entries · sorted by elapsed ↓
Showing the report for Tinder, Hinge, OkCupid, POF (Plenty of Fish), BLK.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Tinder
NASDAQ
2026-06-20
91d ago
Waiting
Critical
To prove you are a real person, Tinder scans your face and sends that scan to a US company, and separately to a Chinese-owned biometric SDK vendor. A third company then turns your dating preferences, which count as special-category data about sexual orientation under GDPR, into a persistent identity profile that follows you across other platforms, all from the simple act of signing up.
FaceTec 3D liveness biometric to US third party. FaceUnity biometric SDK (China). LiveRamp identity resolution on sex-preference data. GDPR Art. 9 triple breach
click to expand
GDPR Art. 9(1)GDPR Art. 9(1)GDPR Art. 9(2)(a)+1
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF
Hinge
NASDAQ
2026-06-20
91d ago
Waiting
Critical
Hinge sends a 3D scan of your face to an outside US company just to confirm you are a real person, feeding into the same biometric system shared across Match Group's other dating apps. The app also carries a hardcoded access key, a known way for someone to abuse how the app talks to its own servers.
FaceTec 3D liveness biometric to US third party. Hardcoded Firebase API key. Same cross-brand Match Group biometric pipeline as Tinder.
click to expand
GDPR Art. 9(1)GDPR Art. 5(1)(f)GDPR Art. 9(1)+2
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF
OkCupid
NASDAQ
2026-06-20
91d ago
Waiting
Critical
OkCupid's own interface code contains a line that explicitly lists sexual orientation, race, ethnicity, religion and political belief as categories used to build commercial offers shared across all of Match Group's dating apps. That means some of the most sensitive information you disclose on a dating profile is fed into marketing that reaches beyond the one app you signed up for.
Production UI string explicitly names sexual orientation, race, ethnicity, religion and political belief for cross-brand "Match Group Offers" commercial use - most legally significant finding in the entire dating-app series.
click to expand
GDPR Art. 9(2)(a)GDPR Art. 9(1)GDPR Art. 32(1)(a)+2
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF
POF (Plenty of Fish)
NASDAQ
2026-06-20
91d ago
Waiting
Critical
Plenty of Fish takes a 3D scan of your face for identity verification and runs it through the same shared biometric and advertising system used by Tinder, Hinge and OkCupid. The app also carries a hardcoded access key, a known weak point in how it communicates with its own servers.
FaceTec 3D liveness biometric + hardcoded Firebase API key. Same Match Group biometric/ad pipeline shared with Tinder, Hinge, OkCupid.
click to expand
GDPR Art. 9(1)GDPR Art. 32(1)(a)GDPR Art. 32+1
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF
BLK
NASDAQ
2026-06-20
91d ago
Waiting
Critical
BLK's TikTok component can send profile data connected to your racial background to servers in China, information that never should have left the EU without stronger safeguards. The production app also leaks Match Group's own internal network addresses, a sign the build was never properly cleaned before release.
TikTok/ByteDance SDK transmits racial-origin-adjacent profile data to Chinese infrastructure. Hardcoded internal Match Group IP address and corporate hostname (match.corp) shipped in the production binary.
click to expand
GDPR Art. 9(1)GDPR Art. 44-49GDPR Art. 9(1)+3
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.