It should be pretty easy to prove with tcpdump or even a decent firewall; their app should make connections only to their server.