Amazon Shopping app clearly still knows too much.

I'd like to add more context to anyone new finding the post.

Whether the answer is trivial or not, which I hope it is, I'd like anyone interested to understand this is actually very critical to me.
I'm in a country that is transitioning to a dictatorship and it's taking strong steps to have control of all communications and dismantling institutions, with explicit intentions of prosecuting dissidents (it's not Brazil or Venezuela but you get the gist). The military spends fortunes on pegasus and infiltration software and it is constantly monitoring every corner of the national network. District Attorneys and prosecutors are placing incredible efforts to prosecute opposition and even normal citizens who just cast critical opinions with digital traces, it's crazy how much they spend on digital intelligence.

Something like this really worries me. I'm setting up Tor bridges for a journalist and what not, VPN endpoints, etc, but if relaying traffic does nothing against being tracked (McAffe said something about this about how they gather data before it's even sent or encrypted) a vulnerability like this could cost someone's life, I hope you don't find this as an exaggeration.

So hopefully this will bring enough attention so that we can get to the bottom of this issue, hopefully it's something trivial as I said or some kind of overlook, but still, it's not something I was expecting after having taken so many steps, and when you use something like graphene you trust many of these steps to be enough, it is regarded as the best option for mobiles to have privacy.

Thanks.

GlytchMeister Hi @fid02, @Dumdum, @PaulDavis @angela @[deleted] @secrec @Dumdumdingdong @Xtreix @matchboxbananasynergy @Michiel

Thank you all for being so attentive.

I'll try to give reply to a few points that have been made.

@GlytchMeister I don't actually want to use Amazon Shopping on high security setups, this behavior is something I observed on 2 other devices without graphene on it, what I wanted to do was to test it on graphene by downloading the app to make sure this wouldn't persist, but it did. Other apps are important for this setup that could potentially do the same thing, so I want to rule out that vulnerability.
As I mentioned earlier, I did try amazon on vanadium which of course works on containing access for amazon to more data, and this would seem to fix the issue. All apps that can be used on Vanadium I use in Vanadium for this reason, however this doesn't address the problem, the fact that any app can correctly guess or know your location and who knows what else under conditions that shouldn't give it more access than a mere internet connection; it clearly has access to more.

@matchboxbananasynergy The only permission I give the Amazon Shopping app is Network; in this case, it's the only one necessary to be able to use the app since it needs internet access. If I remove all permissions, the all doesn't work at all, it either crashes or it shows an error screen that doesn't tell me anything about what the app still knows, which wouldn't be that important under those conditions I think.
Graphene has this great feature on showing app logs, what I'm going to do next in a few minutes is show you the crash logs when all permissions are removed, I found them very descriptive of what the app is trying to access and that should probably say something.

@fid02 I did uninstall and reinstall on new profiles after having made changes to the devices timezone but the app still correctly guesses my location. I'm replying to this before checking your links which I will do next, however it might still be necessary to address the issue in different ways since I am not using SIM cards.

angela I did pay with a credit card, the possibility you present sounds very extreme and too specific, which makes it all the more important to point out if all that tracking is being done just as you purchase a phone, because this could also imply device tampering, which would be all the more horrifying. However I need to rule out much more direct and civilized ways to track me first, Amazon in particular has no business at all guessing my location with so much power.
Indeed there shouldn't be a country code without a SIM in it. Upon further analysis however, I would also be able to make sure an app can't access that information even with a SIM card on it. However I'm not testing with SIM cards installed at the moment, so I will leave that as a next step.

Xtreix timezone was changed, network country code was sort of ruled out since I'm not using SIM, so I still need to find a different identifier and make sure that at the very least it isn't too revealing.

I may check if there's anything about my router that could tell something, however my router setup is already pretty specific and I don't anticipate for that to reveal a lot, who knows tho.

I would like to invite others to replicate these conditions, particularly of they're outside the US which I'm just guessing would make any guesses from the app more evident, and see if the issue is present.
Basically it is: No sim card, Mullvad or IVPN in very extensive configurations: relaying ipv6, lockdown mode, etc etc. Removing all permissions except of internet access, everything in a profile dedicated to just test the Amazon Shopping app, and then just about any variable you can remove.
This is something I observed across different restrictive setups and devices but I found it extraordinary to still happen on a graphene phone.

I will be pasting the apps logs in my next reply, thank you all again.