I found a vulnerability in a paid Smartphone app. It is supposed to contain a lot of private details.
There is a logging option for support that you can switch off and on, to extract the part that causes you problems. The app's support can ask you to send them the log for review.
The problem is:
The app creates an email with a zip file and claims that it only contains logging information.
What it really does contain is the whole database, all private details you have ever entered. Neither the database, nor the zip file is encrypted. Plus the logging information.
A trusting customer would send the email, whose recipient is auto-added, and send his data unencrypted throughout the internet to the us-based company.
As the company implemented it that way, it is a bad idea to notify them.
Who should I notify for the company to not be alarmed and for the government to take appropriate action?
I am not US-based.