Android - sharedpreferences data is getting uploaded with the apk to play store

Question

You are reading right, I'm not kidding. I try to explain it very detailed:

The app is checking for userid in sharedpreferences, if there is any then the API is asking the user data for this userid

Now I clear the app data/cache and uninstall it

Then I create an app release and upload it to google play

Then I download this app and when it starts then somehow it has the userid which I used for testing stored as shared preferences and requests the user data from the server for this id, I'm NOT KIDDING.

How is this possible? Is the android OS just bugged and didn't really clear the sharedpreferences data properly?

I also repeated these steps and created a new release just to be sure that I didn't do any stupid mistake.

I used the google developer chat but they don't understand anything about programming but are only responsible for reviews etc.

Thanks in advance!

Answer 1

This Android behaviour is unusual because whenever you're setting your Android project with target version >= 23, the Auto Backup feature is enabled. You can see about it at Back up user data with Auto Backup. Here the excerpts:

Auto Backup for Apps automatically backs up a user's data from apps that target and run on Android 6.0 (API level 23) or later. Android preserves app data by uploading it to the user's Google Drive—where it's protected by the user's Google Account credentials. The amount of data is limited to 25MB per user of your app and there's no charge for storing backup data. Your app can customize the backup process or opt out by disabling backups.

Whenever you're creating a new project with Android Studio, the AndroidManifest.xml is always created with Auto Backup enabled. With android:allowBackup="true" attribute:

<manifest ... >
    ...
    <application android:allowBackup="true" ... >
        ...
    </application>
</manifest>

You need to set it to false with android:allowBackup="false" to disable the backup. When developing, you should turn it off. Only enable it when you're releasing the app in the Play Store.