A security vendor claims many Android and iPhone apps are able to access sensitive data stored on the devices, and may be secretly sending it to remote servers.