Reading App Store Data Labels as a Funding Signal

A store listing’s data-disclosure section is a self-reported claim, which makes it a floor rather than a ceiling — but it is a structured claim, and the gap between what is declared and what a VPN needs in order to work is one of the fastest funding signals available. It takes about two minutes to read, on the page you are already on when you are about to install something.

The declarations are not an audit and should not be treated as one. They are a statement the developer has made, in categories the platform defined, which is enough to be useful.

What the section actually is

Both major mobile platforms require developers to declare what data their app collects, in fixed categories, with a stated purpose. The formats differ in detail but the shape is the same: a list of data types, grouped by how they are used.

Two structural properties matter for reading them:

They cover third-party components. A developer is expected to declare collection performed by SDKs it embeds, not only by its own code. This is why the section can be more revealing than a privacy policy’s headline claims — it is supposed to include the advertising or analytics component described in what an ad-funded VPN is actually selling.

They distinguish purpose, not just type. “Location” declared for functionality and “location” declared for advertising are the same data type with completely different implications.

The three groupings, and which one is the tell

Roughly, declarations fall into three buckets:

Not linked to you. Collected but, per the developer, not associated with your identity or account. Analytics and crash reporting typically sit here. Least concerning, and often genuinely necessary.

Linked to you. Associated with your identity, account, or device. An account identifier and a data-usage counter belong here legitimately — a capped free tier cannot enforce a cap without counting bytes against something.

Used to track you. This is the one to read carefully. On the platform that uses this wording, it means data linked to your identity or device is combined with data from other companies’ apps and sites for advertising or shared with a data broker. That is a declaration about cross-company linkage, which is the definitional shape of an advertising or data-monetisation revenue line.

A privacy tool declaring data used to track you is not automatically a scandal — it usually means an ad SDK is present, which the app may also tell you about plainly. But it is the developer’s own statement that a revenue mechanism of that kind exists in the app.

The comparison that makes it useful

Read the declared list against what a VPN needs to function. Needed:

An account or device identifier, if there are accounts.
Bytes transferred, for cap enforcement.
Connection diagnostics, aggregate and ideally not linked.
Payment information, where there is payment.
Support correspondence, if you contact support.
Coarse region, at most, to suggest a nearby server.

Not needed to route packets:

An advertising identifier.
Precise location.
A list of installed apps.
Contacts, photos, calendar, health, or messages.
Browsing or search history retained over time.
Purchase history.
Anything declared as used for third-party advertising.

The mismatch is the signal, and it is the same operate-versus-monetise test as in do free VPNs sell your data — the store listing just presents it in a tidier format than a policy document does.

Reading the rest of the listing while you are there

The data section is not the only economic information on the page:

The developer name. Tap it. A portfolio of unrelated free utilities is a monetisation signal, per why who owns the app tells you the business model.

In-app purchase listings. These enumerate the paid tiers. Their presence establishes a subscription business; their absence removes the most benign funding explanation. You do not need the prices to draw the inference.

The stated permissions, on platforms that list them. A VPN needs the network extension permission by construction. It does not need contacts.

Update history. A steadily maintained app costs money to maintain, which implies revenue.

Whether the listing was recently published under a familiar-sounding name. Copycat listings are a real problem in this category; the safer route is to reach the store page from the provider’s own site rather than from a search.

What the description promises. “Unlimited and free forever” is a claim about economics — see the arithmetic of an unlimited free VPN.

The limits of this method

Being honest about how much weight the labels bear:

Self-reported. Nobody verifies each declaration before publication. Platforms enforce after the fact and imperfectly.
Coarse categories. A category can cover a wide range of practices.
Ambiguity about purpose. “App functionality” is broad enough to shelter a lot.
Silent drift. Declarations can change with an update you did not read.
Not present outside app stores. Desktop apps, browser extensions, and direct downloads have no equivalent, though extension stores have their own disclosures — see why a free browser VPN costs less to run.

So a clean declaration is weak positive evidence, while a declaration showing tracking or wildly excessive collection is strong evidence, because the developer volunteered it against its own interest.

The two-minute routine

Open the data-disclosure section before installing.
Look for a “used to track you” grouping or third-party advertising purposes.
Compare the declared list to the needed list above and note the gap.
Tap the developer name and see the portfolio.
Check for in-app purchases to establish whether a subscription business exists.
If the declaration and the app’s marketing disagree, believe the declaration — it is the one with a compliance obligation attached.

Two minutes, no technical skill, done on the page you were already looking at. It will not tell you everything, but combined with the patterns in how free VPNs make money it usually tells you which model you are about to sign up for.