If the public app and API works as-designed, then there is simply no information made available to be uploaded that could be personally identifying. So what the

If the public app and API works as-designed, then there is simply no information made available to be uploaded that could be personally identifying. So what the server is doing, in a way, doesn't matter. edit: The risk would be breaking into the backend and spamming exposure notifications. In that case, just take down the server and restore from backup.