Android & iOS both phone home your GPS location combined with things like wifi points that were visible in that area. And on iOS also things like nearby bluetoo

Android & iOS both phone home your GPS location combined with things like wifi points that were visible in that area. And on iOS also things like nearby bluetooth devices - this is how eg. AirTags work. Apple re-purposed their entire userbase to be GPS & bluetooth phone-home minions to power that network, and nobody was asked if they were OK with that. For both Android & iOS there's an "off" setting buried somewhere to disable this phone-home tracking. As for "phones home" app data... I mean, that's what cloud sync & backups are. It doesn't necessarily mean that Google or Apple have access to that data, the device could encrypt it with your user passphrase before sending it. In theory. In practice they probably both do because otherwise password recovery systems kinda don't really work. If you can do a password reset and still access your data, then so could the company hosting that data. But for both of those this is that awkward spot where very useful features necessarily require something that can sound very malicious depending on how it's described (and could actually be very malicious depending on how it's actually used)