Recently I found a bug on a mobile app which claims to protect their users' privacy, however after connecting my phone with burp and installing a certificate I noticed that this app was sending a users' full first and last name + some other personally identifying information (other users' profiles, not just my own), however this isn't shown to the user directly.
I wanted to contact the vendor of the app, however after viewing their legal page I have my doubts as they state the following:
"reverse engineering of 'the software' is strictly prohibited and may result in legal action"
I've excluded the name of the app/company in question for obvious reasons
Currently I'm conflicted between responsibly disclosing this bug to them so they can fix this issue or simply not doing it at all since I'm not entirely sure if sniffing my own traffic between the app and server could be considered 'reverse engineering' and I simply don't want to get sued.
Does anyone know the legality of doing this? Is it considered 'reverse engineering'?