BlueToad, the little-known app company that lost at least a million Apple iPhone and iPad identification numbers gathered the data from devices without protecting it and was still sending the data as of Monday, a Wall Street Journal investigation found.