Online Buddies, the owner and operator of online gay dating app Jack’d, reached a settlement agreement with the New York Attorney General’s office over its alleged failure to secure users’ private and nude photos.

On Friday, Attorney General Letitia James said Online Buddies agreed to pay $240,000 to New York State. The company also agreed to substantially improve the security of its online gay dating app.

Jack’d claims to have hundreds of thousands of active users worldwide including approximately 7,000 in New York.

Online Buddies told users that its app is secure and has the ability to protect their private information including nude photos. However, the company failed to implement reasonable security measures to keep users’ nude photos private.

Based on the investigation of the Attorney General’s office, Jack’d app “explicitly and implicitly” claimed that its private pictures feature allows users to exchange nude images securely and privately. It provides users two screens when uploading photos, one for “public” and another for “private” viewership.

Online Buddies failed to fix app vulnerabilities

According to the Attorney General’s office, Jack’d app failed to protect the private photos and nude images of around 1,900 users.  Online Buddies violated users’ trust by breaking the app’s user privacy policy, which states that the company implements “reasonable precautions to protect personal information from…unauthorized access [or] disclosure.”

Additionally, the Attorney General said its investigation determined that Online Buddies knew the vulnerabilities of its app. However, it failed to fix it for a year and to implement any stopgap protections. It failed to establish logging to detect any unauthorized access, warn Jack’d users, or change representations about the privacy of their private photos and the security of their personally identifiable information.

“This app put users’ sensitive information and private photos at risk of exposure and the company didn’t do anything about it for a full year just so that they could continue to make a profit,” said Attorney General James.

She added, “This was an invasion of privacy for thousands of New Yorkers. Today, millions of people across the country — of every gender, race, religion, and sexuality — meet and date online every day, and my office will use every tool at our disposal to protect their privacy.”