That is a common sense. They track everything, connecting ledger devise id with all the activity done in app, xpub is exported to the app and 100 % send to harvesting service.