When an app has been downloaded over a million times and garnered over 800,000 5-star ratings, you’d expect the app to be good and not dodgy. A flashlight app itself isn’t too hard to develop, but the Brightest Flashlight Free app was doing a few things without informing the user.

It turns out that the app has been secretly tracking users’ location information, along with device IDs. Not only was the information shared even when users opted out, it was also being transmitted before the user had a chance to accept or refuse the app’s terms of service.

Next we’ll have to see if the app remains in th Google Play Store and whether the app or the terms of service will be modified to be more open about what is going on.

This popular flashlight app has been secretly sharing your location and device ID

GoldenShore’s privacy policy had mentioned that information collected would be used by the company, but the FTC said location and device information was shared automatically with advertisers and other third parties–even when users opted out. In fact, before they could accept or refuse the app’s terms of agreement, the FTC said Brightest Flashlight was already collecting and sending information.