I'm no lawyer, but this seems like at least grounds for a class action lawsuit, I would think. Like, it seems like privacy and security is implied (however ironic for an app like this) when requiring users to upload their PII.

Also, I assume their privacy policy didn't mention that they were just gonna publish their users' PII.