Rela, a popular Chinese lesbian dating app, exposed data on 5M users, including dates of birth, height and weight, and sexual preferences, since June 2018
Rela (.), a popular dating app for gay and queer women, has exposed millions of user profiles and private data because a server wasn't protected with a password.
Context & Ripple Effects
Rela's exposure is the latest entry in a string of dating-app data failures: back in 2017, researchers showed they could pull users' real names, locations, and login details out of Tinder and OkCupid through exploitable vulnerabilities in the apps themselves. What makes this one distinct is scale plus sensitivity — an unprotected server left open since June 2018, exposing birthdates, body measurements, and sexual preferences for roughly 5 million users of a niche app serving queer women in China.
The story also lands between two bigger arcs in the same coverage: Grindr's owner Beijing Kunlun was forced by US officials to sell the app after giving Beijing-based engineers access to user data (the Kunlun-Grindr divestment), and a Consumer Reports study later documented how mainstream apps including Grindr, Tinder, OkCupid, and period trackers share intimate data with brokers (the data-broker sharing study). Rela shows the same intimate-data risk arising not from deliberate sharing or cross-border access, but from basic hygiene.
First-order effects
- About 5 million Rela users have had dates of birth, height, weight, and sexual preferences sitting on an open server for months — for a lesbian dating app, that exposure carries outing and safety risks beyond ordinary credential leaks.
Second-order effects
- Regulators and security reviewers scrutinizing dating platforms — already primed by the Grindr-Kunlun case and the broker-sharing findings — now have a third failure mode to police: misconfigured storage, alongside deliberate sharing and API leaks.
Third-order effects
- If the pattern holds across these cases, intimate-category apps (dating, health, sexuality) get treated as a distinct compliance class where storage configuration, data access geography, and broker relationships are all audited — raising baseline operating costs for small regional apps most of all.
The trend: Dating-app user data is shifting from an engineering afterthought to a regulated asset class, with misconfiguration, cross-border access, and broker sharing each drawing separate scrutiny.