Thanks, everyone, for your answers. I made the mistake of assuming that the web API would only give access to data related to a specific client device (thus on

Thanks, everyone, for your answers. I made the mistake of assuming that the web API would only give access to data related to a specific client device (thus only "leaking" info about that client). If their web API gives access to info of other clients, that is indeed a serious design fuck-up.