Night On your wrist
The watch never sleeps

You wore the smartwatch all night. That was intentional — sleep tracking. The watch recorded: when you fell asleep, how long you spent in each sleep phase, your heart rate during sleep, your skin temperature, your stress level via heart rate variability.

This data does not stay on the device. It travels to the manufacturer's cloud — almost nothing is stored locally. Which cloud depends on which watch you wear:

Manufacturer / Model System Data goes to
Fitbit Own OS Google (USA) — since acquisition in 2021 for $2.1bn; Google account mandatory from 2026
Samsung Galaxy Watch, Nothing Watch, Fossil Wear OS (Google) Google (USA) — Wear OS requires a Google account; sync via Google Fit
Xiaomi Mi Band, Redmi Watch Own OS / Mi Fitness Beijing Xiaomi Co., Ltd. (China)
Huawei Watch HarmonyOS Huawei Cloud (China)

Regardless of which watch: the data leaves your wrist. It ends up either in the USA or in China.

Heart rate, sleep patterns and stress values mean little on their own. Combined with name, age, weight and a user account, they form a detailed health profile. Insurers and employers have already begun exploring what possibilities such data opens up.

You just wanted to know whether you slept well.

6:47 Morning
The phone turns on

Ten minutes on Instagram before the day really begins. Google Timeline is already logging your location — the time, the position, the device. This happens regardless of whether you are actively doing anything.

Instagram shows you posts. You scroll. What you look at, for how long, what you skipped, what you looked at twice — all of it is stored. Including posts you did not like.

⚠️
In September 2024, researchers demonstrated that the Instagram app on Android builds a hidden connection between its internal browser and the app in order to link your browsing behaviour to your account — even in incognito mode, even when the app is not in the foreground.
Location Scroll behaviour Dwell time Browser tracking Posts not liked
7:30 School run
Taking the kids to school

Google Maps is running, or you simply have your phone with you. Google Timeline records: 7:38, nursery. 7:52, primary school. Every Tuesday. For years.

You never actively shared this. You just had your phone with you.

If you use Family Link to manage your children's phones, Google also knows when your children arrive and leave each location — the system sends corresponding notifications. Your children's locations are captured automatically.
Location history Routines & times Children's locations
8:15 WhatsApp
WhatsApp

You message a friend on WhatsApp. The content is encrypted — end-to-end. Meta cannot read it.

But Meta still knows: you wrote to someone this morning. Exactly when. How long the conversation lasted. From which location. Who communicates with whom, when, how often, from where — that is metadata. And metadata is available without limit.

From this metadata it is possible to reconstruct a complete social network: who your closest contacts are, when you are active, where you are located.
Communication partner Time & duration Location Content: encrypted ✓
10:00 Amazon
Amazon + PayPal

Quickly opened Amazon, searched, found something. Pay with PayPal because it's faster. Three clicks, done.

Amazon now knows: you buy gifts. You buy for specific age groups. Your purchase history stretches back years and paints a precise picture — from children's clothing sizes to household items to medicines.

💳
According to an independent expert report, PayPal compiles comprehensive profiles covering age, gender, income, creditworthiness and interests. This data is shared with around 600 external companies — including banks, debt collection agencies, market research firms and technology companies such as Google, Amazon and Facebook. Many of these companies are based outside Europe. PayPal retains this data for up to ten years after account deletion.
600+ external companies Creditworthiness Purchase history Device data 10-year retention
12:30 Supermarket
Supermarket with a loyalty card

Lunchtime shopping. Children's yoghurt, vegetables, cold remedy tea, vitamin supplements, a children's magazine. At the checkout: loyalty card.

The loyalty programme stores: which store you visited. What you bought. The exact price. The time. With 28 million active users in Germany, Payback is the third most used card after debit and credit cards.

The algorithms behind it analyse: how large is the household? What is the purchasing power? What can be inferred about health status? The data protection commissioner of Schleswig-Holstein: "You give away information across every area of your life."

Savings today: 37 cents.

Products & prices Household size (inferred) Health status (inferred) Buying rhythm
15:00 Google Pay
A game for the kids

In the Play Store: a game for the kids, £2.99. Paid with Google Pay.

Google Pay stores: name, address, phone number, device ID, purchase history. In 2018, Google acquired transaction data from Mastercard to link online behaviour with real-world purchasing behaviour.

What Google also gains from this purchase: in what rhythm digital purchases are made for the children — and at what time of day.
Purchase history Device ID Link with Mastercard data
19:30 YouTube
Lullaby on YouTube

A lullaby on YouTube. Perhaps the third time this week, always on Tuesdays or Thursdays.

Google stores: what was played. For how long. When. YouTube is a Google service. Usage behaviour feeds into the same profile that has been growing since morning.

Watch history Time & duration Behavioural patterns (inferred)
21:00 Delivery
Pizza

Pizza. Tuesdays, this happens quite often.

The delivery app knows: your name, your address, your favourite restaurant, the time, the frequency. This creates a profile: when you are too tired to cook. Whether you order for one or for several. Whether it tends to be weekdays or weekends.

Address Order rhythm Lifestyle habits (inferred)
21:30 Fire TV
Amazon Fire TV

Amazon Fire TV Stick. A series, perhaps a film.

Amazon records: what you started, what you abandoned, what you searched for beforehand, which platforms you used, when the device was last active.

📡
A Princeton University study showed that 89 per cent of channels accessible via Fire TV send data to known trackers.
89% of channels = trackers Viewing behaviour Abandoned content Activity times
0–24h Alexa
Alexa — all day long

In the living room. In the kitchen.

After the wake word, everything audible is recorded and transmitted to a US cloud — including background noise, the voices of guests and children who may not know they are being recorded.

🎙️
Alexa occasionally activates on similar-sounding words without the wake word being spoken. Amazon employees manually review a portion of these recordings.
Voice recordings in US cloud Guests & children also captured Manual review by humans
Night Again
The watch keeps running

The smartwatch keeps running. It notices when your heartbeat grows quieter. When you fall asleep. By tomorrow morning, the server will know more about this night than you do.

A perfectly normal Tuesday

  • Where you live. And where your children are during the day.
  • Who your friends are. When you write to them and for how long.
  • What you buy — and what your body is going through right now.
  • How your nights unfold. Your heartbeat, your stress, your sleep.
  • What your home sounds like. Who came to visit. What was said.
You did nothing forbidden.
It was simply a normal Tuesday.
And somewhere an Apple user is smiling.
Sources & References
All statements fact-based and verifiable
01
Google Support — Timeline & Location History
Documents that Google stores location data even when apps are not actively in use
support.google.com/maps/answer/6258979
02
Google Support — Family Link: location sharing
Describes how Family Link automatically records children's locations and sends notifications
support.google.com/families/answer/7101623
03
DSIN study — Meta/Instagram hidden browser connection (September 2024)
Proof of hidden connection between Instagram browser and app to link browsing behaviour to account — even in incognito mode
mobilsicher.de
04
Kuketz IT-Security — WhatsApp metadata
Detailed analysis of what metadata WhatsApp stores: communication partners, timestamps, location, frequency
kuketz-blog.de
05
Mimikama — PayPal privacy expert report (December 2025)
Independent expert report: PayPal creates profiles on age, gender, income, creditworthiness; data shared with ~600 external companies; 10-year retention after deletion
mimikama.org
06
netzpolitik.org — PayPal list of data recipients (~1,000 companies)
46-page document listing the companies to which PayPal passes data
netzpolitik.org
07
ZDF / Verbraucherzentrale — Payback data protection (July 2025)
Algorithms infer household size, purchasing power, health status from shopping data; quote from Schleswig-Holstein data protection commissioner
verbraucherzentrale.de
08
Google Pay — Privacy terms & Mastercard cooperation 2018
In 2018, Google acquired Mastercard transaction data to link online and offline purchasing behaviour
support.google.com/pay
09
Princeton University — Smart TV / Fire TV tracker study
89% of channels accessible via Amazon Fire TV communicate with known tracking services; smart TVs collect data on health, family status, political interests
cs.princeton.edu
10
Dr. Datenschutz / connect.de — Alexa voice recordings & manual review
Amazon employees manually review portions of Alexa recordings; activation by similar-sounding words documented
dr-datenschutz.de
11
Google Support — Fitbit migration to Google account
Official documentation: from May 2026, a Google account is mandatory for Fitbit; all historical health data is migrated
support.google.com/fitbit/answer/14237024
12
winfuture.de — Google acquires Fitbit for $2.1bn
Acquisition completed in 2021; gradual integration into the Google ecosystem documented
winfuture.de/news,149956.html
13
Google Support — Wear OS: Google account & Google Fit sync
Setting up Wear OS requires a Google account; fitness data (steps, heart rate, workouts) synced via Google Fit
support.google.com/wearos/answer/7294653
14
Hessian Data Protection Authority — review of 16 wearables
Almost all manufacturers use US-based tracking tools; data sharing with third parties without clear legal basis; lack of deletion options
datenschutz.hessen.de
15
Apotheken Umschau — smartwatch health data & profiling
Individual health values only become profile-relevant when combined with user account data; risks for insurers and employers described
apotheken-umschau.de
16
SmartSpy.ch / VPNoverview — smartwatch data to insurers & employers
Analysis: health data can be shared with insurers and employers; workplace surveillance via wearables documented
smartspy.ch