The Android app Brightest Flashlight has been installed between 50 million and 100 million times, averaging a 4.8 rating from more than 1 million reviews. Yet its customers might not be so happy to learn the app has been secretly recording and sharing their location and device ID information.

On Thursday, the app maker GoldenShores Technologies settled Federal Trade Commission charges that it deceived users and is thus prohibited from further “misrepresenting how consumers’ information is collected and shared and how much control consumers have over the way their information is used.”

GoldenShore’s privacy policy had mentioned that information collected would be used by the company, but the FTC said location and device information was shared automatically with advertisers and other third parties–even when users opted out. In fact, before they could accept or refuse the app’s terms of agreement, the FTC said Brightest Flashlight was already collecting and sending information.

“When consumers are given a real, informed choice, they can decide for themselves whether the benefit of a service is worth the information they must share to use it,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection, in a statement. “But this flashlight app left them in the dark about how their information was going to be used.”