Remote telemetry configuration and collecting basically everything they can about the device isn't anything new really. I think mobile apps (especially on Android) have been doing that since the beginning of time.

What's surprising for me is the claim that the behavior of the app changes if it detects someone is inspecting it. This seems a bit handwavey to me and would like a more detailed explanation if anyone has one.

At this point, I think for me the bars for me are:

Don't upload content that I haven't explicitly posted to your servers. This can come in various forms:

- Assuming you gave an app access to your album because you wanted to post something from there. How do you know it's not simply uploading all your photos and videos silently in the background?

- Microphone data: Again you let an app record some video and thereby give mic access to it, a malicious actor can then snoop in and listen to your conversation whenever they want.

These criticisms apply to both iOS and Android although iOS is a little better in terms of how background services work. Don't do mobile-dev as a profession, so I'd appreciate it if anyone could correct me if the OS does enforce some sort of protections here.