Koo denies leaking user data, clarifies about Chinese firm's investment

French cybersecurity says on Twitter that the Indian-made app was leaking email and other details about users

French security researcher Robert Baptiste, who goes as Elliot Alderson (@fs0c131y) on Twitter, has accused Indian microblogging platform Koo of leaking user data.

“You asked so I did it. I spent 30 min on this new Koo app. The app is leaking of the personal data of his users: email, dob (date of birth), name, marital status, gender, ...” Baptiste tweeted on late Wednesday night.

Baptiste, who has been in the news in the past as well for pointing out gaps in other apps as well, also posted screenshots to back his claim.

He also posted a screenshot suggesting the microblogging platform that offers a Twitter-like experience in Indian languages had Chinese connections.

Following the allegations, Koo App co-founder Aprameya Radhakrishna on Thursday tweeted: “Some news about data leaking being spoken about unnecessarily. Please read this: The data visible is something that the user has voluntarily shown on their profile of Koo. It cannot be termed a data leak. If you visit a user profile you can see it anyway.”

Baptiste in response tweeted that Radhakrishna’s defence was “a lie”, and posted a screenshot of a Koo App user where date of birth, marital status, etcetera, were not mentioned in the profile description.

In a statement later in the day, Radhakrishna reiterated that the data Baptiste claimed to be a leak was something the user chooses to show voluntarily.

He further said that 95 per cent of Koo users log in through their mobile phone number. Language communities of India do not use email to log in and hence it (email) was not the priority of the company, he said. Email login was introduced recently, and since concerns were raised, it has already been blocked from view, the statement read. 

“We are just a ten-month old platform and this sudden surge in our visibility and user base was unexpected. We are improving our platform day by day. All these technical issues are not something that cannot be dealt with or improved,” Radhakrishna said in the statement.

Ownership issues

Regarding the Chinese connection, Radhakrishna had on Wednesday tweeted that Chinese Shunwei Capital was an investor, with a single-digit investment, in the microblogging platform, but the company was in the process of exiting. This had also triggered talk of Koo App not being a completely Indian company.

To put these doubts to rest, Koo App issued this statement on Thursday: “A set of Indian entrepreneurs are seen to be investing in Koo with Ashish Hemrajani from BookMyShow, Vivekananda (Hallekere) from Bounce, Nikhil Kamath of Zerodha amongst various others entering the cap table of the company. It is a clear indication that the company is getting more and more Indian money into the company.”

The recent investment of $4.1 million in Bombinate Technologies, Koo’s parent company, was led by 3one4 Capital, an Indian investor, it added. “Shunwei had not participated in the latest round of funding. Shunwei that had invested in the company for the earlier product, Vokal, which answers user questions in Indian languages, will be exiting fully with the new investors buying their stake. Existing investors including 3one4 Capital, Kalaari and others will also be buying out some of the stake,” the firm said in the statement. 

Praise and name confusion 

Meanwhile, Information Technology Minister Ravi Shankar Prasad praised Koo as a homegrown alternative to Twitter. “Koo, a made in India (micro)blog, today has become a big toast of success, which is not only using Indian technology (but also) Indian servers,” he said.

Later in the day, there was some confusion about a Twitter handle with the name “KooAppOfficial” getting suspended. Radhakrishna clarified in a tweet that this was not the company’s official Twitter account.