> Can you point to specific evidence of i happening?
Specific evidence of what exactly? You mean an example of data stored on signal's servers after you opt out of setting a pin? That's something that takes place in the background without notice to the user. We also don't have access to the data stored on Signal's sever. What we do have is the source code and we can see it still uploads data. When asked about this directly a lead developer at signal confirmed that this was happening by design here: https://community.signalusers.org/t/beta-feedback-for-the-up...
> The change was to never upload the encrypted master key to SVR. We still create a master key locally and derive a storage key from the master key. That storage key is still used to encrypt data that is uploaded to storage service. Storage service is still necessary for future features involving linked devices. That data is encrypted with a 256-bit key that remains only on your devices.
So when opting out a setting a pin, Signal still encrypts and uploads your data, but doesn't use the key for their secure value recovery service. As far as "internet rumors" go, the fact that signal is collecting this data is highly verifiable. They just aren't being clear about this data collection to users. In fact they've been highly misleading when asked
(see https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...)
> Every communication app 'collects' info
Not true (see Jami), but even if it were, what matters most is that it's always 100% clear to people what data is being collected under what circumstances and Signal has failed in that. Signal markets their app to people like whistle blowers and human rights activists who have a critical need for privacy, but doesn't give them the information they need to make an assessment of their risk.
> Signal is designed to make that data unavailable to Signal itself.
that's extremely questionable. You can read over some of the security concerns here: https://community.signalusers.org/t/proper-secure-value-secu...
It's not clear how secure this data actually is from Signal, or from the type of agencies that have already requested this data from Signal in the past. Back in 2006 they were very proud to say they don't collect the kinds of data being requested (https://signal.org/bigbrother/eastern-virginia-grand-jury/)
> Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user’s groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user’s groups), or any records of who a user has been communicating with.
Note that this website hasn't been updated to say so, but they are in fact now storing a list of your contacts and who you've been communicating with and there is no way to opt out of this data collection. It might take an exploit to get at that data, but even after facing months of backlash on their own forums from users about this, they still insist on collecting that data and are being less than transparent about that fact.