What Data Does Upd8All Collect?
Upd8All is a free app that lets a business send short one-way updates, such as order-ready alerts, to customers who scan a QR code. There are no accounts and no phone numbers exchanged on either side.
This article looks at what sits behind that kind of privacy claim. That includes the store labels, the advertising software inside a free app, and what a reader can check without installing anything. It states Upd8All’s own position plainly and stops there.
Key Takeaways
- Upd8All holds no phone numbers or email addresses; message content is end-to-end encrypted, and channels older than about 30 days are periodically deleted from the servers.
- The advertising software inside the free app is a separate collector, and its footprint still shows up in the app’s own store declaration.
- Message content is encrypted; the date and time of a message is not.
- Google’s and Apple’s disclosure labels are filled in by the developer, and neither platform verifies the entries for accuracy.
- Checking any app takes four steps: the store’s data label, its privacy policy, and, for a UK company, the ICO register.
What Does Upd8All Collect?
Upd8All holds very little. There are no accounts and no sign-up for either side. No phone numbers or email addresses are exchanged between the business sending updates and the customer receiving them.
Pairing works by scanning a QR code rather than typing in a contact detail. How the QR pairing and the channel actually work is covered in full on the site’s main explainer of the product. The receiving side does not need an app at all. Scanning the code opens the updates in a browser through Upd8 Go. Reading updates in a browser without installing anything is covered in more detail elsewhere on the site.
Message content sent through Upd8All is end-to-end encrypted. It is scrambled on the sender’s device and can only be read on the sending and receiving devices. The date and time stamped on each message travels in the clear, because encrypting a header is a different job from encrypting a body.
Channels older than about 30 days are deleted from the servers, though the timing is not fixed. Either side of a channel, sender or receiver, can also delete it manually. Both the app and Upd8 Go show the last 10 messages on a channel.
That is the full list of what the product itself holds, and it is short by design. What two of the app stores print about Upd8All in their own privacy labels reads differently. The next section explains why that is not a contradiction.
Why Do the App Stores Describe It Differently?
Google defines the word plainly: ‘Collect’ means transmitting data from your app off a user’s device (Google Play Console Help, 2026). Apple’s rule reaches just as wide. Developers “need to identify all of the data you or your third-party partners collect, unless the data meets all of the criteria for optional disclosure listed below” (Apple Developer, 2026).
That is why an advertising kit bundled inside a free app still shows up in that app’s own store label. Google’s own guidance says so:
“This includes user data transmitted off device from your app by libraries and/or SDKs used in your app, irrespective of whether data is transmitted to you or a third-party server.” (Google Play Console Help, 2026)
A collector does not have to be the developer to count.
Apple draws a related but separate line, and it spells out what the word means rather than leaving it open to interpretation. Apple’s own definition reads:
“Tracking refers to the act of linking user or device data collected from your app with user or device data collected from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement purposes. Tracking also refers to sharing user or device data with data brokers.” (Apple Developer, 2026)
A label can carry a heading reading “Data Used to Track You” without the developer having built a tracking feature. The heading describes what a bundled partner’s code does. Apple’s App Privacy labels separate this into two sections. One covers data used to track a person across apps and websites owned by other companies. The other covers data that is collected but not linked to that person’s identity.
| Surface | Who writes it | What it covers | What it does not cover |
|---|---|---|---|
| Google Play Data safety section | The developer, filling in a form | Data the app, or the libraries and SDKs inside it, transmit off the device | Whether the declaration is accurate; that is covered later in this article |
| Apple App Privacy label | The developer, filling in a form | Data collected by the app or by third-party partner code bundled inside it | The same accuracy question, covered later in this article |
| A developer’s own privacy policy | The developer, in free-form text | Whatever the developer chooses to describe, in its own words and structure | A fixed format, and no platform check against what the software actually does |
None of this is unique to Upd8All. Any free app with a bundled advertising kit faces the same two-form problem. The underlying question, what holding a customer’s number commits a business to, sits one level up from any single label.
What Does the Advertising Inside a Free App Collect?
The advertising software answers this. What that software collects depends on which network’s kit is inside the app. Google’s own documentation states plainly what its SDK does:
“The Google Mobile Ads SDK automatically collects and shares IP address, user product interactions, diagnostic information, and device/account identifiers for advertising, analytics, and fraud prevention.” (Google for Developers, 2026)
That list is one SDK’s own declared scope, not a description of what any single app adds on top of it.
Consent is required before most of that collection can happen for a UK user. A developer must gain consent to use cookies or mobile ad identifiers where this is legally required. That includes the UK and the European Economic Area, under the ePrivacy Directive (Google AdMob Help, 2026).
Even an advertisement that is not personalised still relies on some tracking mechanics. A non-personalised ad skips profile-based targeting. A cookie or device identifier is still used for frequency capping and combined ad reporting (Google AdMob Help, 2026). Two settings give a user some control here. The Android advertising ID can be reset or deleted through the device’s own ad ID controls. A developer can also turn off its collection entirely by editing the app’s manifest file (Google for Developers, 2026).
Ads inside the app are served by third-party advertising networks (such as Google AdMob or Huawei Petal Ads), behind a consent step on first launch. The app itself does not collect personal information. These ad networks may collect device identifiers such as the advertising ID, IP address, and general device information to serve and measure ads. Upd8All does not itself collect or store that information. This matches the app’s own privacy policy, and it is stated here without softening.
If Messages Are Encrypted, What Is Still on the Server?
Message content on Upd8All is encrypted, but the record of when something was sent is a different kind of data: metadata. The National Cyber Security Centre defines metadata as covering “user identifiers and timings, in other words the who, where, when and how of the communication.”
It adds that this “imparts information about users of the system, especially in aggregate, and if misused it could reveal the individual connections of users of the system.” (NCSC, Secure communications principles, published 2020, reviewed 2021)
Upd8All’s own facts fit inside that definition. Message content is end-to-end encrypted and unreadable by the company, but the date and time of a message is not encrypted.
Channels older than about 30 days are deleted from the servers, and the purge is manual so the timing is not exact. Both the app and Upd8 Go show up to the last 10 messages on a channel. Because the company cannot read message content, there is no way to recover it once a channel is gone. That is a genuine limitation as much as a privacy feature.
The link between those two facts, encrypted content and unencrypted timing, is drawn here from NCSC’s general definition. It is not stated by NCSC about any specific product. NCSC does not comment on Upd8All at all.
| Data element | Form it is stored in | How long |
|---|---|---|
| Message content | Encrypted; unreadable by Upd8All Limited | Until the channel is deleted or purged |
| Date and time of each message | Not encrypted | Same as above |
| Channel and its last 10 messages | Held on the servers | Roughly 30 days, then a periodic manual purge |
Source: Upd8All privacy policy, retrieved 1 September 2026.
Where Is the Data Actually Stored?
Application data and message storage for Upd8All run on Amazon Web Services, and the website is hosted with GoDaddy. Both operate in the United States (Upd8All privacy policy, 1 September 2026).
That split matters for one practical reason. A message channel and the website that describes it are not on the same systems. A change to one does not always touch the other.
Storing data outside the country where a customer lives is common for apps built on cloud platforms. Most consumer apps run on one of a small number of large cloud providers. Building an equivalent from scratch is rarely worth it for a small developer. What differs between providers is the data an app sends there, and the earlier sections have already answered that for Upd8All.
None of this says anything about whether any transfer is lawful, or what duties follow from storing data outside the United Kingdom. That is a legal question for a solicitor, not a technical one this article can answer.
How Do You Check Any App for Yourself?
Checking any app for yourself takes four short steps, and none of them requires installing anything you do not already have. What a scanned code does and does not start is worth understanding first. Scanning a code and handing over data are not the same act.
- Open the store listing and find the data disclosure. On Google Play this is the Data safety section; on Apple it is the App Privacy label. Every developer has to complete one, even an app that collects nothing at all. Google states: “Even developers with apps that do not collect any user data must complete this form and provide a link to their privacy policy” (Google Play Console Help, 2026).
- Read what the label says it actually covers. Apple states the purpose directly: the label exists “to help your customers understand what data is collected from your app and how it is used” (Apple Developer, 2026). The developer, not the platform, is “responsible for keeping your responses accurate and up to date.”
- Open the developer’s own privacy policy, which is a legal document rather than a form, and compare its wording against the label. A mismatch does not prove wrongdoing on its own, but it is worth noting and worth a second read.
- For a UK-registered company, check the ICO’s public register for the company’s registration number. Being on the register confirms the company has registered as a data controller; it says nothing about how the company’s software actually behaves.
For Upd8All, setting up a channel step by step is covered in a separate walkthrough.
What Do Those Declarations Not Tell You?
Neither store checks the label against the software. Google says so about its own review: “Google’s review process is not designed to verify the accuracy and completeness of your data safety declarations” (Google Play Console Help, 2026). A further, independent review some developers go through adds little. Google states plainly: “This review does not verify the accuracy and completeness of the developer’s Data safety section disclosure.” (Google Play Console Help, 2026)
On both platforms, the developer alone answers for accuracy. Google states that developers alone are “responsible for making complete and accurate declarations” in their store listing (Google Play Console Help, 2026). They are also “solely responsible for deciding how to respond to Google Play’s Data safety form regarding their app’s data practices” (Google for Developers, 2026). Apple’s wording matches: developers are “responsible for keeping your responses accurate and up to date” (Apple Developer, 2026).
Two different kinds of study have looked at whether these declarations hold up, and they measured different things. A peer-reviewed study of 474,669 iOS apps compared each app’s privacy label against its own privacy policy. It found that 97% of the apps carrying a Data Not Collected label had a policy indicating otherwise (Kotzias et al., PoPETs 2024). That is a mismatch between two documents the same developer wrote, not proof of what the software transmits.
A different study exercised the software itself rather than comparing text against text. Researchers ran runtime traffic against each app’s own declaration across nearly five thousand Android apps:
“Our study on almost 5K applications uncovers a pervasive trend of incomplete disclosure, as 81% misrepresent their data collection and sharing practices in the Data Safety section. At the same time, 79.4% of the applications with incomplete disclosures do not ask the user to provide consent for the data they collect and share.” (Arkalakis et al., USENIX Security ’24, 2024)
| Check | What it establishes | What it cannot establish |
|---|---|---|
| Store data label | What the developer chose to declare, in the platform’s own categories | Whether that declaration matches what the software transmits |
| Developer’s privacy policy | The developer’s own free-text account of its practices | Independent confirmation of accuracy; it can also disagree with the store label |
| ICO or equivalent register | Whether the company has registered as a data controller | Anything about how the company’s software behaves |
What Actually Separates One App From Another
There is one question this article keeps landing on, and it is not whether an app collects data. Nearly all of them do, in some form, somewhere. It is who the other parties are, and what each of them declared.
A free app with an advertising SDK inside it will always carry that SDK’s footprint on a store label. That is what the label is designed to show. The developer’s own privacy policy is a separate document, written in its own words. It can describe something narrower without either document being false. Reading one and skipping the other is how a reader ends up surprised.
Three sources have been covered here: a store label, a developer’s policy, and a register entry. None of them was designed to answer the whole question on its own. Put together, they narrow the gap, and that is about as far as any outsider can get. Whether a channel with no reply route suits the job is a fair follow-up question once the data question is settled. Fit and disclosure are not the same decision.
Frequently Asked Questions
What does it mean when a store listing says an app collects no data?
A ‘Data Not Collected’ label means the developer filled in the platform’s form and selected that option, not that an independent check confirmed it. Neither Google nor Apple checks what a developer submits, so a label reflects one document’s claim rather than a tested result. A reader who wants more confidence has to compare that label against the developer’s separate privacy policy. The two are written apart, and they can describe different things.
Does an advertisement inside a free app mean the app is collecting data?
Usually yes, though the collector is the advertising software, not necessarily the developer’s own code. For example, the Google Mobile Ads SDK automatically collects data such as IP address and device identifiers for advertising and fraud prevention (Google for Developers, 2026). That collection can appear on the app’s own store label because it happens inside the app.
What happens to Upd8All messages after about 30 days?
A channel is deleted from the servers once it is older than about 30 days, but the purge is manual, so there is no exact date to count down to. A sender or receiver can also delete a channel by hand at any time. Because message content is end-to-end encrypted, there is no way for the company to recover it once it is gone.
Does ICO registration mean an app behaves a certain way?
No. Registration confirms a company appears on the ICO’s public register as a data controller, and nothing more. A reader, including one looking at Upd8All, cannot fully verify from outside how any app’s software behaves. A label and a policy are documents, and a document can be wrong for a long time before anyone notices.
Sources
- Google, “Provide information for Google Play’s Data safety section – Play Console Help”, retrieved 2026-09-01, https://support.google.com/googleplay/android-developer/answer/10787469
- Google, “Understand app privacy & security practices with Google Play’s Data safety section – Computer – Google Play Help”, retrieved 2026-09-01, https://support.google.com/googleplay/answer/11416267
- Google for Developers, “Google Play data disclosure | Android | Google for Developers”, retrieved 2026-09-01, https://developers.google.com/admob/android/privacy/play-data-disclosure
- Google, “Personalized and non-personalized ads – Google AdMob Help”, retrieved 2026-09-01, https://support.google.com/admob/answer/7676680
- Apple, “App Privacy Details – App Store – Apple Developer”, retrieved 2026-09-01, https://developer.apple.com/app-store/app-privacy-details/
- Apple, “User Privacy and Data Use – App Store – Apple Developer”, retrieved 2026-09-01, https://developer.apple.com/app-store/user-privacy-and-data-use/
- Kotzias, P. et al., “Honesty is the Best Policy: On the Accuracy of Apple Privacy Labels Compared to Apps’ Privacy Policies”, PoPETs 2024, retrieved 2026-09-01, https://arxiv.org/abs/2306.17063
- Arkalakis, N. et al., “Abandon All Hope Ye Who Enter Here: A Dynamic, Longitudinal Investigation of Android’s Data Safety Section”, USENIX Security ’24, retrieved 2026-09-01, https://www.usenix.org/conference/usenixsecurity24/presentation/arkalakis
- National Cyber Security Centre, “Secure communications principles”, retrieved 2026-09-01, https://www.ncsc.gov.uk/guidance/secure-communication-principles