This widely-used instant loan app leaks nearly 30 million files of user data