Rallyhood exposed a decade of users’ private data