The company behind the gay dating app left users' private photos online for a year in spite of knowing about the security bugs.