> I'm guessing the police simply reached out to all the analytics companies Ngrok ends up indirectly/directly sending data to, which ends up saving everything they get their hands on.

But those companies would have no way of knowing the GDID. It's not sent in a header, I assume.