What data do shopping apps collect?

Most shopping apps collect four things: who you are (name, email, and a shipping address if you order), what you bought, which device you are using, and what you did inside the app. On the App Store those appear under Apple's fixed category names: Contact Info, Identifiers, Purchases, and Usage Data. Many also collect Location, User Content such as photos you upload, and Diagnostics. The list itself is not a verdict, because a shipping address is a legitimate reason to hold your address. What changes the picture is whether any of it sits under Data Used to Track You, which means the app links what it learns about you with data from other companies for advertising, or hands it to a data broker. Every app's own answer is printed in the App Privacy section of its App Store page, above the reviews.

How do I check what data an app collects before I install it?

Open the app's App Store page and scroll to the App Privacy section, which sits below the screenshots and above the reviews. It sorts everything the developer declares into three buckets: Data Used to Track You, Data Linked to You, and Data Not Linked to You. Read the first bucket first, because that is the one that describes data leaving for advertising purposes. Tap See Details for the per-category breakdown and the developer's stated purpose for each. Then check the claim against behaviour: turn on Settings, Privacy and Security, App Privacy Report, and after a week it will list the domains each installed app has contacted and every sensor it has touched.

Can a share-sheet extension see everything in the app I shared from?

No. On iOS a share extension runs in its own process with its own sandbox, and it receives only the items the host app hands over through the extension context, typically a link, an image, or a piece of text. It cannot read the host app's storage, your feed, your direct messages, or your logged-in account, and it has no access to your camera roll beyond the specific images you pick. What it can do is take the link it was given and fetch that public page on its own servers, which is how a link becomes a product list. That is a real capability and worth understanding, but it is a long way from reading your account.

← All posts

What shopping apps collect, and what we collect

August 29, 2026 · 7 min read

Most shopping apps collect four things: who you are, what you bought, which device you are on, and what you tapped inside the app. The ones that also track you link that to data from other companies for advertising, or pass it to a data broker. That second group is a different category of thing, and you can tell which group an app is in before you install it.

Two places tell you. The App Privacy section on the app's App Store page, and the App Privacy Report buried in your own iPhone settings. Nearly every article written on this subject counts data points across a hundred apps and stops there. That number cannot help you with the one app in front of you.

The categories, in Apple's own vocabulary

Apple makes every developer sort what they collect into fixed buckets, which is the useful part: the words mean the same thing on every listing. These are the ones a shopping app can plausibly touch.

Contact Info. Name, email, phone, physical address. A shipping address is a real reason to hold your address. A newsletter is a thinner one.
Identifiers. User ID and Device ID. The user ID is your account. The device ID is the one that can follow you between apps, which is why it shows up in the tracking bucket so often.
Purchases. Purchase history. Obvious for a store, worth a second look on an app that is not one.
Usage Data. Product interaction and advertising data. What you opened, what you scrolled past, which ad you saw before you bought.
User Content. Photos, videos, audio, messages, anything you typed or uploaded.
Browsing History and Search History. What you searched inside the app, and in some cases what you looked at outside it.
Location. Precise or coarse. A store locator needs coarse. Precise, running in the background, is a decision somebody made on purpose.
Diagnostics. Crash and performance data. The dullest entry on the list and usually the most benign one.

A long list is not automatically a bad app and a short one is not automatically a good app. Financial Info on a store means it processes your payment. Financial Info on a tool that does not sell you anything is a question.

Three buckets, and the first one is the answer

The App Privacy section splits everything into three groups, and they are not equally important.

Data Used to Track You. Apple defines tracking as linking data collected in the app about you or your device with third-party data for targeted advertising or ad measurement, or sharing it with a data broker. This is the bucket that describes data leaving. Read it first. If it is empty, most of the rest is plumbing.
Data Linked to You. Tied to your account or device, but not declared as leaving for advertising. Almost every app with a login has entries here, and it is where the honest ones put the things they genuinely need.
Data Not Linked to You. Collected with the identity stripped before it arrives. Crash logs usually live here.

Tap See Detailsand you get the per-category breakdown plus the purpose the developer gave for each one. The purposes are the interesting reading. “App Functionality” against your email is unremarkable. “Third-Party Advertising” against your purchase history tells you what the business is.

The label is a declaration, not an audit

Here is the limit nobody mentions. Apple gives developers a questionnaire and publishes their answers. Nobody inspected the server. The label is a statement made under App Store rules, which makes lying costly, and it is still a statement rather than a measurement.

So check it against behaviour, which your phone will show you for free.

Watch what the app actually does

Turn on the App Privacy Report.Settings, then Privacy & Security, then App Privacy Report. It records the last seven days: which sensors and data each app touched, and every domain it contacted. It starts empty, so switch it on now and read it next week.
Read the domains, not the count. An app talking to its own API and a CDN is an app working. An app talking to a stack of analytics and ad domains is doing something else as well, and now you know its name.
Check the paste permission.Since iOS 16 an app has to ask before reading your clipboard, after researchers showed dozens of popular apps quietly doing it in the background. Settings, then the app's name, then Paste from Other Apps gives you Ask, Deny or Allow per app.
Look at Tracking.Settings, Privacy & Security, Tracking lists every app that has asked to track you across other companies' apps and sites, and whether you said yes.

None of this requires a tool, an account, or a subscription. It requires about a minute and one week of patience for the report to fill up.

What a share-sheet app can and cannot see

This one is worth understanding properly, because sharing a post to an app feels like handing over an account, and it is not.

An iOS share extension runs in its own process with its own sandbox. It receives exactly what the host app passes through the extension context: a link, an image, a piece of text. It cannot reach into the app you shared from. It cannot read your feed, your saved posts, your direct messages, or your logged-in session, and it cannot open your camera roll beyond the specific images you pick. Extensions cannot even read their own parent app's files unless the developer deliberately opens a shared container between them.

What it can do is take the link it was handed and fetch that public post on its own servers. That is a genuine capability, and it is the honest thing to be specific about, because it is where a link turns into a product list. It is also a long way from reading your account. The same instinct applies to the shop links an app hands back, which are worth checking before you enter a card.

What Stealsy collects

Being vague here would undo the rest of the post, so specifics. All of this is in our privacy policy in the same words.

Your account. Sign in with Apple or Google gives us your email address, and your name if you allow it. That is what keeps your catches yours across devices.
What you deliberately share.The links, notes, screenshots and images you send in. We fetch and process the linked public post, meaning the video, the caption and the public comments, on our servers to identify products. Extraction runs through Google's Gemini models, and public post data may be fetched via Supabase, Apify and Vercel.
Your catches. The products, prices, links and images we find, stored on your device and backed up to your account so a new phone does not erase them.
Subscription status. Apple processes the payment. We use RevenueCat to know whether a subscription is active. We never see your card.
Diagnostics. Minimal technical logs recording whether a catch succeeded or failed, so we can fix what breaks.

And the other half, which matters more. We do not sell personal data. We do not read your camera roll, only the images you pick. We never ask for your TikTok or Instagram login and cannot post or act on your social accounts. We show no ads and share nothing with ad networks. We use no affiliate links, which means nothing in the app is picked because someone paid for the placement. Deleting your account in the app under You, then Delete account, permanently removes it and its backup from our servers.

Five questions worth asking any shopping app

Is anything in the tracking bucket? If yes, the business model includes you.
What does it collect that it does not need? Location on an app with no stores. Contacts on an app with no sharing.
Where does the money come from?Ads, affiliate commission, or a subscription. Each one points the app's incentives somewhere different, and only one of the three points at you being right about a purchase.
Can you delete the account from inside the app? Apple requires it of apps that let you create one. An app that makes you email support anyway is telling you something.
Does the policy name its processors?A policy that says “trusted third parties” and never names one has chosen that phrasing deliberately.

None of these need a lawyer. They need the App Store page, the Settings app, and five minutes you would otherwise spend reading a list of what a hundred other apps collect.

Get Stealsy for iPhone — share a video, get the products, prices and verified links.

Common questions

What data do shopping apps collect?: Most shopping apps collect four things: who you are (name, email, and a shipping address if you order), what you bought, which device you are using, and what you did inside the app. On the App Store those appear under Apple's fixed category names: Contact Info, Identifiers, Purchases, and Usage Data. Many also collect Location, User Content such as photos you upload, and Diagnostics. The list itself is not a verdict, because a shipping address is a legitimate reason to hold your address. What changes the picture is whether any of it sits under Data Used to Track You, which means the app links what it learns about you with data from other companies for advertising, or hands it to a data broker. Every app's own answer is printed in the App Privacy section of its App Store page, above the reviews.
How do I check what data an app collects before I install it?: Open the app's App Store page and scroll to the App Privacy section, which sits below the screenshots and above the reviews. It sorts everything the developer declares into three buckets: Data Used to Track You, Data Linked to You, and Data Not Linked to You. Read the first bucket first, because that is the one that describes data leaving for advertising purposes. Tap See Details for the per-category breakdown and the developer's stated purpose for each. Then check the claim against behaviour: turn on Settings, Privacy and Security, App Privacy Report, and after a week it will list the domains each installed app has contacted and every sensor it has touched.
Can a share-sheet extension see everything in the app I shared from?: No. On iOS a share extension runs in its own process with its own sandbox, and it receives only the items the host app hands over through the extension context, typically a link, an image, or a piece of text. It cannot read the host app's storage, your feed, your direct messages, or your logged-in account, and it has no access to your camera roll beyond the specific images you pick. What it can do is take the link it was given and fetch that public page on its own servers, which is how a link becomes a product list. That is a real capability and worth understanding, but it is a long way from reading your account.