Yes I've Auto-unlock enabled.
So after I posted my OP one year ago, I did disable the app from using WiFi by using an Android firewall, and Auto-unlock still worked. The app was using BT to connect, not WiFi, so I'm not sure how WiFi usage could be affected.
Now that I've the WiFi adapter, I've to let the app use WiFi, but Auto-unlock isn't working at all, while it was working half the time a year ago.
I'm starting to deny the app connections to certain hosts by host names in the Android firewall app.
My suspicion is that either CandyHouse or one of the 3rd-party libraries they use is collecting our information.