Quittr, a popular app designed to help people with a sex addiction, has leaked intimate data on hundreds of thousands of its users.
-
Quittr exposed highly sensitive details: masturbation habits, porn viewing history, emotional struggles, including data on 100,000 minors.
-
Quittr's co-founder dismissed concerns, told 404 Media to "have a good day," and ghosted them for a week.
-
A women's dating app suffered a similar leak last year as misconfigured Google Firebase databases are becoming a dangerous pattern.
According to 404 Media, which was tipped by an independent researcher, a misconfiguration in Google Firebase, an app development platform, is the root cause of a leak of highly sensitive information from its users, including their age, masturbation habits, emotional struggles, and the kinds of pornography they were watching.
According to the researcher, the issue allowed anyone who could authenticate as a user to potentially access the backend database, where user information for more than 600,000 users at the time was stored, of which 100,000 were identified as minors.
The researcher told the tech website that he contacted Alex Slater, Co-Founder of Quittr, on September 10th, 2025, to inform him about the vulnerability. Slater promised the analyst that he would fix the vulnerability “in the next hour.”
However, Slater and his business partner Connor McLaren didn’t fix the issue for months. In January 2026, four months after the researcher first reported the issue, he contacted Slater again, asking him why the vulnerability hadn’t been fixed.
But according to Slater, there was no reason for concern because no sensitive user data was exposed. When 404 Media got in touch with the Co-Founder, he wished the editor “a good day” and hung up.
404 Media tried to contact Slater for a week to report that the app was still vulnerable, but never heard back from Quittr’s Co-Founder. Despite the sensitive nature of the user data, the news outlet decided to publish the story in January, without mentioning the app.
The Cybernews community is talking about this. Be a part of the conversation.
The vulnerability has recently been fixed. That’s why 404 Media decided to publicly name the app in a new article.
Tea, a women-centric dating app, also had to deal with an exposed database hosted on Google Firebase last year. In August, 2025, the app's owners sent a data breach notification letter to affected users, stating that only 0.1% of users had been impacted.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked