What is the difference between an app and an app account?¶

An app is the software installed on the device.

What this means¶

An app account is the identity used to access the service behind it.

They are related, but they are not the same thing.

Deleting the app may remove the software from the handset.

One app can support several accounts.

One account can be used through several devices, browsers or app installations.

A device may also retain app data even after the user signs out, depending on the application and operating system.

This distinction matters for attribution.

Finding an app icon proves only that the software is installed.

Finding a signed-in account may show that the device had access to that account.

Neither automatically proves who used it or who performed a particular action.

Then establish how the account was used.

Which devices were linked?

Which session created the activity?

Was the content generated locally or synchronised from elsewhere?

Provider records may be more useful than the handset alone.

Likewise, the device may contain local artefacts that the provider no longer holds.

The operational takeaway is: the app is the local software; the app account is the service identity. Investigate both separately and establish the link between device, session, account and user at the relevant time.

What to check or do next¶

• Investigators should identify the account separately.
• Record usernames, email addresses, account IDs, profile names, linked numbers and recovery details where lawfully available.

Evidential limits¶

It does not necessarily delete the account, provider records, cloud content or activity on other linked devices.