Companion app impersonates another phone

[lukaszswitaj]

Home Assistant Android app version(s):
2025.1.2-full

Android version(s):
14 (both phones)

Device model(s):
Xiaomi POCO F2 Pro (old), Motorola moto g54 5G (new)

Home Assistant version:
2025.1.2

Last working Home Assistant release (if known):
na.

Description of problem, include YAML if issue is related to notifications:
For a long time, on my phone (let's call it Phone_old) I has an HA app installed, on which I'm logged in and I use it.

I have also recently been using another Android phone (Phone_new). During the first launch of the phone, Android offered to restore apps and settings from a cloud backup (from Google Drive). I agreed. The phone also restored the HA app, which I had intended to use sometime in the future, but so far I haven't even run it on this new phone.

It turns out that the phone installed all the HA app settings from the old phone. I didn't enter my login, password or OTP on the new phone, because as I wrote - I didn't even launch the app. Shortly thereafter, in my dashboards, I discovered very strange indications of the phone's battery status (screenshot under description).

Only after some time did I associate that it was two apps reporting their battery status to one entity!

All indications are that when installing the HA app and restoring its settings from the cloud, access data, authentication tokens and god knows what else are also restored....

This has no right to happen!

The new phone impersonated the old phone, implicitly borrowing its name, which is the basis for the prefix of the names of entities created by this device (e.g.: phone_old_battery_level), hence these strange entity states.

Only being almost sure of the source of the problem, I ran the HA application on the new phone for the first time, which indeed already had the address of my HA server configured but only the main URL (in my case, the URL reachable via the Internet), missing, among other things, the name of the home Wi-Fi network, or the local connection URL (local IP).

But interestingly - the device name was not the same as in the old phone, but adequately referred to the manufacturer and model of the new phone. I was very surprised that despite the fact that I had not once launched the app and configured it, the app was using the identity of the old phone.

On the other hand, when launched, it was able to recognize that it was running on a different device after all, and as if nothing ever happened, it created new device and a set of entities in HA with a new name prefix (e.g.: phone_new_battery_level) on HA server.

I believe that this should not be the case. If you clone the app or restore it from a backup, the authentication should be canceled and the tokens should expire.

Companion App Logs:
na.

Screenshot or video of problem:

Additional information:
na.

[lukaszswitaj]

Related issue: #4650