A data exposure linked to two AI-powered apps has revealed how loosely some platforms handle identity documents, personal images, and user trust.