Tea

Is Tea safe?

Tea set out to protect women from bad dates, but the app itself became the risk. In July 2025 it left a storage bucket open that held about 72,000 images, including selfies and driver's licence photos users had sent to prove they were women. A day later a researcher reached more than a million private messages. Apple pulled the app from the App Store in October 2025. It is still on Google Play. We score it 32/100, the same as DeepSeek and below Bumble (50).

If you want the safety benefit, you can still use Tea carefully. Just treat it as a public noticeboard, not a private group.

What leaked in July 2025

Tea's own account, filed in federal court in December 2025, is that on 25 July 2025 "unauthorized third-party actors" accessed a Firebase file storage area holding verification photos and images of government IDs. These were collected between January 2023 and February 2024, when Tea had fewer than 30,000 users. Users on 4chan wrote scripts to download the files. Tea says it shut off access within 15 minutes of learning about it and notified 4,244 people on 28 August 2025, offering two years of identity monitoring.

The women suing Tea describe it more starkly. Their filing says Tea had promised to delete verification images once checks were done, that the whole set of 72,000 images sat open to anyone with a browser, and that the data spread on X with searchable databases linking real identities to anonymous posts, often with threats of violence.

On 26 July 2025 came a second, unrelated incident. A security researcher accessed a Firestore database holding Tea direct messages, more than a million messages in about 100,000 chats, spanning early 2023 to July 2025. Plaintiffs say they included conversations about abortions, cheating and phone numbers. Tea took the messaging feature offline and changed its database rules.

The lawsuits

More than a dozen class actions were filed in the weeks after the leaks. Those in California were combined as In re Tea Dating Advice Data Breach Litigation before Judge William Orrick in San Francisco. In a joint report of 31 August 2026, both sides said they were finalising a settlement and expected to ask the court for preliminary approval by 30 October 2026. The terms are not public yet.

Tea also faces suits from the other side. Men named in posts have sued in Michigan, with claims filed as libel, and a class action removed from an Illinois state court cites the state's biometric privacy law. These are allegations; none had led to a judgment against Tea when we checked.

We found no fine or order from a regulator such as the FTC or a state attorney general.

What Tea collects and sells

To join, you now choose between a video selfie and a selfie with a photo of your government ID. Tea's privacy notice, effective 27 February 2026, says it analyses facial geometry to verify you and deletes that data after verification, and in all cases within two years. It also says that, in the past 12 months, it "sold" identifiers, network activity and geolocation data from the app to analytics vendors in the sense of California's privacy law, though not for cross-context advertising.

Tea also runs background checks. Through third-party partners it pulls criminal records, phone numbers, marriage records and court records about US individuals whom users look up. Those men never signed up and have no account to delete.

Apple's removal

Apple took Tea and the copycat men's app TeaOnHer off the App Store on 21 October 2025. It told TechCrunch the apps broke its rules on user-generated content moderation, on using personal data without permission, and on excessive complaints, including complaints that minors' personal details were being posted. Apple said it raised the issues with the developers and they were not fixed.

How to use Tea more safely

1. Verify with a video selfie, not a photo of your ID.
2. Never post your own full name, workplace or photos you use elsewhere.
3. Write only what you saw yourself, as facts with dates. Opinions stated as facts can expose you to a defamation claim.
4. Do not use Tea messages for anything you would not want leaked; use Signal instead.
5. If you verified with an ID before 2024, place a credit freeze and watch for fraud.

How we scored it

Security (20) is the weakest factor: two separate databases were left exposed in two days, and verification images Tea had promised to delete were among them. Privacy (30) reflects ID-based verification, data sold to analytics vendors and background checks on non-users. The regulatory record (60) is better only because no regulator has acted yet; the private lawsuits are reflected in the other factors.