Highly sensitive user data collected from the app was left on a badly secured website for anybody to get at.