This is a wonderful write up. The part that isn't clear to me is how they're getting the geolocation data if location services are turned off. Are they just going off geo-ip lookups? If you grant access to Bluetooth or finding devices on your local network, they can get more information to track your location. Absent that, how would they get better than geo-ip?