How can you tell whether an app is sending your data somewhere?

Airplane mode, done properly

This is the cheapest test there is, and the one most people run wrong. The point is not to check that the app opens. It is to make the app do the thing you care about while it has no way to reach anything, and then to watch exactly which parts fail.

A feature that still works with radios off did not need a live connection during that test. It may be using cached data, queued actions, or local computation. The test cannot show whether data is stored or sent later. An app can work offline, hold what you typed, and send it the moment the network comes back.

• Turn airplane mode on, then confirm Wi-Fi is off as well. Phones commonly let Wi-Fi stay on inside airplane mode.
• Force-quit and reopen the app to test a fresh launch. Cached or downloaded data may still be present, so also try a new task.
• Use the features that touch your content: dictation, search, anything that summarizes or writes.
• Note how things fail. An immediate “no connection” message may indicate an offline path. A long spinner may indicate a timeout, but the screen alone does not identify its cause.
• If the app will not let you past a sign-in screen before you can run the test at all, you already have an answer of a different kind: a login is the loudest network dependency there is, since a credential has to be checked somewhere, and that somewhere is a server.

The operating system keeps its own record

iOS App Privacy Report is under Settings, Privacy & Security. It starts gathering information after you enable it; details accumulate as you use apps, and earlier activity is not shown. It can show sensitive-data access and network domains reported by apps and websites.

Android's Privacy Dashboard, on Android 12 and later, covers permission access rather than domains. Many Android devices expose per-app network usage, but details and available networks vary by manufacturer and OS version. Steady background traffic in an app you have not opened all week is the thing worth asking about.

A domain is a destination, not a payload. Seeing an app contact an analytics host tells you a connection happened, not what crossed it. An app checking for an update once a day sits in the same list as one reporting every screen you open. Frequency and volume are what separate them.

Watching the traffic shows where, not what

Router DNS logs can show visible name lookups. A traffic monitor may show destinations, timing, and byte counts for traffic it captures; coverage varies, and encrypted traffic usually does not reveal its contents.

It does not give you contents. App traffic is encrypted with TLS, so anyone watching the network sees the destination and the size, not the message. Encrypted DNS and encrypted client hello hide even the hostname from the middle of the path. Reading a payload means installing your own root certificate and running an intercepting proxy, and an app that pins its certificates will refuse the connection outright.

Volume still says a lot. Telemetry is kilobytes. A photo library, a folder of recordings, or a year of messages are megabytes, and they cannot move without showing up in a counter. Low observed traffic only describes the tested period, network, and app version; it does not establish what data was sent or what may happen later.

What none of these methods can prove

All of this is sampling. A quiet week means the app was quiet during the week you watched, on the network you watched it on, in the version you had installed. Behavior can differ by region, by account state, by update. Privacy labels and policies describe a provider’s stated practices; they are not measurements of what happened during a particular test, and they can change.

The one thing that holds when you stop watching is architecture. A design with no account or server component for a feature has fewer remote paths for that feature. Other app functions may still use a network, so assess them separately. That case is made in full on the privacy page. The point here is that it is the rare claim a test can corroborate instead of a promise you have to take on trust.