as reported by concealment Rights Clearinghouse: ZDNet's Zach Whittaker reports:A popular fitness app that claims over six 1000000 users was leaking private and sensitive data, including health information and private messages sent between users.PumpUp, an Ontario-based company, bills itself as a fitness community, allowing subscribers to discover new workouts and register their results, and get advice from fitness coaches and other users.But the troupe left a core backend server, hosted on Amazon's cloud, exposed without a password, allowing anyone to see who was signing on and who was sending messages -- and their contents -- in real-time.. . .Each time a user sent a content to another user, the app exposed user profile data -- and the private contents of that message.The exposed data included email addresses, dates of birth, gender, and the city or town of the user's location and timezone. The data also included the user's app bio, workout and activity goals, and users' full resolution profile photos, who a user has blocked, and if the user has rated the app.The app also exposed user-submitted health info -- such as height, weight, and other data points, like caffeine and alcohol consumption, smoking frequency, health concerns, medications, and injuries.Also included in the exposed data was device data, such as iOS and Android advertiser identifiers, users' IP addresses, and session tokens for the app which could be used to earn access to a user's account without needing their password.Users who signed in using Facebook also had their access tokens exposed, putting their Facebook account at risk.In some cases, we also found unencrypted credit card data -- including card numbers, expiry dates, and card verification values