Isn't it just as likely that this data is being sent to the app vendor's servers and then off to one or multiple third-parties?