Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

vexious

macrumors member
Original poster
Jul 16, 2008
87
1
I deleted Spotify, re-downloaded it, and it had all my data and was still logged in?

I checked under icloud and iPhone storage, spotify doesn't show up here.

What's the deal? How is it tracking or keeping this data somewhere?

Sketchy..

iOS12
Keychain is disabled
 
  • Like
Reactions: macfacts
I deleted Spotify, re-downloaded it, and it had all my data and was still logged in?

I checked under icloud and iPhone storage, spotify doesn't show up here.

What's the deal? How is it tracking or keeping this data somewhere?

Sketchy..

iOS12
Keychain is disabled
I’d speculate your device info is stored on Spotify servers, so when you access the app again, it recognizes your device and pulls your info.

I’m no dev., but that explanation makes more sense than secretive app info stored on your phone.
 
Several years ago apple banned app devs from using unique device ID's...
 
If your credentials are stored in the shared keychain then it will stay on the device even when you delete the app.

I’m guessing they store the oAuth token on the device and unless the token expires you’re able to be logged in with the same token. There’s nothing sketchy about it.
 
I was under the impression that when iPhone backup was made, then certain app data was also backed up. When you re-install an app, then the app data that was in a recent iPhone backup is brought back to the phone from iCloud backups and that alleviates the need to setup an app that you had previously used.

I wonder what you would see if you deleted the app, then deleted the iCloud backup for that phone then reinstalled the app and see how the app behaves.
 
If your credentials are stored in the shared keychain then it will stay on the device even when you delete the app.

I’m guessing they store the oAuth token on the device and unless the token expires you’re able to be logged in with the same token. There’s nothing sketchy about it.

Try reading my thread again. Keychain is disabled.
 
Try reading my thread again. Keychain is disabled.
Try reading his post again. :)

I’m guessing akash.nu did read your post and is talking about the local keychain on your device.

I had the same experience a few weeks ago. I deleted the Google search app without logging out, then when I reinstalled the app and ran it, I was already logged in.
 
Last edited:
  • Like
Reactions: akash.nu
OK stupid question, have you tried to force restart your phone after deleting the app? Any chance that smth was kept in RAM?

p.s. Agree with akash, should be something like a token with identifier.
 
  • Like
Reactions: akash.nu
Many apps store data in a different "place" than the app. When the app gets deleted, the data associated with it doesn't. If you download the app again- the data is all still there. This behavior has existed probably since iOS 1. I know it exists on iOS 9.
There's NOTHING you can do to prevent it, barring wiping your whole phone. And I don't know if that would do it either.
 
Many apps store data in a different "place" than the app. When the app gets deleted, the data associated with it doesn't. If you download the app again- the data is all still there. This behavior has existed probably since iOS 1. I know it exists on iOS 9.
There's NOTHING you can do to prevent it, barring wiping your whole phone. And I don't know if that would do it either.
That kind of seems like a rather big oversight to be there all these years later without much mention of it or any fixes relating to it.
 
That kind of seems like a rather big oversight to be there all these years later without much mention of it or any fixes relating to it.

It’s not an oversight. It’s programmed as the business wanted to. Developers have to specifically mention where to store the auth tokens.
 
  • Like
Reactions: Newtons Apple
It’s not an oversight. It’s programmed as the business wanted to. Developers have to specifically mention where to store the auth tokens.
Seems like there is an option to offload the app and keep the data or delete the whole app with the data--why would the data remain then when that option is used?
 
Seems like there is an option to offload the app and keep the data or delete the whole app with the data--why would the data remain then when that option is used?

There could be various technical / business reasons. It’s hard to tell what it was in specific cases. I’m just saying that it has to be programmed specifically. So it’s not an oversight. They wanted to make it happen, whatever the reason is.
 
Some apps likely do erase with all data but there are more that do not. Like Google, once on your device, they collect data from you no matter what.
What do you mean they collect data no matter what?
[doublepost=1548365341][/doublepost]
There could be various technical / business reasons. It’s hard to tell what it was in specific cases. I’m just saying that it has to be programmed specifically. So it’s not an oversight. They wanted to make it happen, whatever the reason is.
Seems like that would be an OS thing, to delete data associated with the app when the app is deleted, as is basically described in storage settings when you are given the option to offload an app or completely delete it.
 
What do you mean they collect data no matter what?
[doublepost=1548365341][/doublepost]
Seems like that would be an OS thing, to delete data associated with the app when the app is deleted, as is basically described in storage settings when you are given the option to offload an app or completely delete it.

I mean that even if you delete Google apps, they leave behind enough to keep collecting data for their use.
[doublepost=1548366375][/doublepost]
I mean that even if you delete Google apps, they leave behind enough to keep collecting data for their use.

You can delete Facebook and it still tracks your location weather you like of not.
 
I mean that even if you delete Google apps, they leave behind enough to keep collecting data for their use.
[doublepost=1548366375][/doublepost]

You can delete Facebook and it still tracks your location weather you like of not.
So if the app isn't there how would it be doing any of those things? (I mean there are certainly some things that can be done on cookie/browser level, which is basically unrelated to apps at all, but that's somewhat different/separate.)
 
Seems like that would be an OS thing, to delete data associated with the app when the app is deleted, as is basically described in storage settings when you are given the option to offload an app or completely delete it.

It’s not a OS thing because developers decide how to handle certain things.

For example a company that employs “single sign on” on their platform and also has multiple apps, would like to share their customer auth token amongst the apps so that as long as the user is signed into one app, they get automatically signed into other apps. In that case they’ll need to use the shared keychain to access the data.

Also, if a company wants to provide the convenience to the user that they will be automatically logged in when they change their device, they’d also need to use shared keychain.

These are just a couple of examples, but there are myriads of other technical and business situations that might require developers to implement functionality that uses the shared keychain.
 
It’s not a OS thing because developers decide how to handle certain things.

For example a company that employs “single sign on” on their platform and also has multiple apps, would like to share their customer auth token amongst the apps so that as long as the user is signed into one app, they get automatically signed into other apps. In that case they’ll need to use the shared keychain to access the data.

Also, if a company wants to provide the convenience to the user that they will be automatically logged in when they change their device, they’d also need to use shared keychain.

These are just a couple of examples, but there are myriads of other technical and business situations that might require developers to implement functionality that uses the shared keychain.
Well, what you are talking about is more in terms of login/authentication information, not so much application data stored with the application. But even with that, if I download Spotify let's say and sign in and use it and decide to delete the app, why would Spotify be allowed to keep some other data on my device if I decided to get rid of it all?
 
Well, what you are talking about is more in terms of login/authentication information, not so much application data stored with the application. But even with that, if I download Spotify let's say and sign in and use it and decide to delete the app, why would Spotify be allowed to keep some other data on my device if I decided to get rid of it all?

There’s no concept of why an app is “allowed” to keep data. Apple will allow apps as long as they’re not violating the developer agreements. It could be that the other data you’re talking about might just be something Spotify keeps for user convenience so that if you’re changing devices you get everything back as they were on your old device.

Basically, these things are there for a reason.
 
There’s no concept of why an app is “allowed” to keep data. Apple will allow apps as long as they’re not violating the developer agreements. It could be that the other data you’re talking about might just be something Spotify keeps for user convenience so that if you’re changing devices you get everything back as they were on your old device.

Basically, these things are there for a reason.
If Apple says that deleting an app deleted all associated data with it, as they do in storage settings for example, then that really should be the case. Whatever reasons developers might want to have to keep this or that around (whatever the reason they might have) that really shouldn't matter if the end user has decided to remove the app and all of its data, basically going to a state that things were in before the app was ever installed to begin with.
 
If Apple says that deleting an app deleted all associated data with it, as they do in storage settings for example, then that really should be the case. Whatever reasons developers might want to have to keep this or that around (whatever the reason they might have) that really shouldn't matter if the end user has decided to remove the app and all of its data, basically going to a state that things were in before the app was ever installed to begin with.

I’m sure if it was that straightforward and simple they’d have done it already. There might be other legitimate reasons why it’s not enforced like that. iOS mostly do delete anything from the core data of an app when they get deleted. You can specifically verify this by checking before and after storage usage with any app that’s using say about 1.5-2 GB storage.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.