# Report changelog

Before version 0.7 the repository also contained a Polish version of the report and Polish directory and file names; this changelog uses the current English names.

- 1.0 (19 Oct 2026) – first published version. Online from 19 Oct 2026 with access restricted to the vendor's e-mail domain (Cloudflare Access); public from 21 Oct 2026, 07:00 CEST (05:00 UTC). Content identical with draft 0.7.5 apart from the version line, this entry and the correspondence entry of 19 Oct 2026 (the correspondence file is renamed `correspondence/correspondence_2026-10-02_to_2026-10-19.txt` and holds the authors' message of 19 Oct 2026 as message 10). Later on 19 Oct 2026, before the address was sent to the vendor, after an independent check of the published set (version number unchanged): data: in `C8.pub.har` the two `$attr_demandScore` and `$attr_demandTier` parameters of the `paywall_open` event had been left in clear (one occurrence each); they now belong to the group `superwall_profile` and are masked as `<<MASKED_PROFILE>>`; the 10 HAR files were regenerated with `prepare_har_for_publication.py` 1.6.0 (`pseudonymise_har.py` 2.4.0; 54 tests, `tools/CHANGELOG.md`) from the same input and the same time offsets, so entries, order and all other values are unchanged apart from `log.comment`; check reports and `data/SHA256SUMS.txt` recomputed. Corrections: the Wayback Machine address given for the new version of the article D4–D8 resolves to the archive's copy of 9 June 2026 (the old version), so the record of the new version is the PDF and the text file of 16 Oct 2026 (3.1, `sources/README.md`, web page); the weekday of the authors' message of 19 Oct 2026 in `correspondence/` (Monday); "public access from 21 October 2026" in place of the past tense; 3.5: the demand score and tier, not the `ip*` fields, are sent back in `paywall_open`, and the values are "replaced with labels or masked"; the D16 quote in 3.2 and 3.12 with its capital letter; the sentence on the standard behaviour of the Superwall SDK in 3.2 marked I (from D) instead of D; section 5 of the full report: the clause relating the region code of B to the VPN exit country removed; this changelog, entry 0.4: the D19–D21 screenshots were not added. Short report (`README.md`): section 2 "How it was studied" separated from section 1, as in the full report; 4.1 says that the Sentry entries are not in the published files; 3.8 notes that the T3 recording continued for about 3 min; the R quote in 3.6 marked as cut with "[…]"; the header shortened. Layout of the short report, after the reviewer's proposals (findings, numbers, dates, quotes and labels unchanged): "In one minute" (five sentences) before the summary; two figures under the summary (`figures/data-flow.svg`, `figures/enrich-round-trip.svg`, drawn from the web page's Exhibits 2 and 8); a glossary of terms after section 2; a one-sentence lead above each of 3.1–3.11; the host list of 3.1 as a table and the fields of 3.2 as a grouped list; the declaration quotes of 3.1–3.11 left to table 3.12, which gains an "Assessment" column ("differs from the wording" or "open to interpretation") and is sorted by it; the inference paragraphs shortened, their qualifiers in the vendor's favour kept; section 4 item 12 refers to the R lines; "What cannot be established" in section 5 as a list; the two footnotes reduced to sources and file names; the prologue and the epilogue set as block quotes, text unchanged. Web page: the same corrections and layout; the "Finding" cards after the sections removed (the ledger at the head and table 3.12 remain), a table of contents, the "In one minute" box and the two figures under "In brief", the glossary as an expandable block, the history page with the times of the two acknowledgements of 5 Oct 2026 and with the public-access date.
- 0.7.5 (18 Oct 2026) – after the final check of the draft. Data: server addresses are no longer published in clear; in the 10 HAR files (`serverIPAddress`, `_serverAddress`; 1268 entries) and in the address columns of the packet capture extracts they are replaced with labels `<<IP_n>>` from one map (the same address gives the same label in every file; 42 addresses), because the sets of CDN addresses in the runs with and without the VPN are disjoint and could have pointed to the exit country of the VPN. From `T2_tcp-conversations.txt` the 11 conversations with servers of other apps and services were removed (35 kept: the addresses of the hosts named in the report and the local network), as was done for `*_syn-quic.csv` in 0.7.4; the first line gives the number. Entries, their order and all other values of the HAR files unchanged apart from `log.comment`; checksums recomputed. Tools: `prepare_har_for_publication.py` 1.5.0 (`--server label --ip-map`), `shift_extract_times.py` 1.7; 52 tests (`tools/CHANGELOG.md`). Text: section 4 point 12: the vendor's reply of 16 Oct 2026 agrees with the documents on Superwall being named in no release note (D11), while post D16 and interview D15 did name it (the sentence said "named only in post D16", contradicting 3.1 and the epilogue); 3.1: separate TLS connections to `collector` 1 to 12 per capture with Proxyman (A0 1, S01 3, S02 5, S11b 12, S17 5, S18 4, T3 6; the text said 4 to 12); 4.5: the DNS query for `duckduckgo.com` also in S01 on B (as 4.4 already said); section 2: server address labels, "entries sorted by time" (the published entries are in time order; the Proxyman export is not) instead of "order within the file unchanged"; section 5: `T2_tcp-conversations.txt`. 3.9 and 3.12: the label unchanged in the snapshots of 18 Oct 2026 (US and Polish listings) in place of the authors' account of 17 Oct 2026. Sources: new snapshots of 18 Oct 2026: D13 (US listing) and D13 PL (Polish listing) as PDF; D11 as a screenshot of the version history in the App Store app on macOS (replaces the web screenshot of 9 Oct 2026, which showed the browser's address bar); D1 (version of 9 May 2024) and D4–D8 (version before the change) as PDF printed from the Wayback Machine captures already used for the text copies; D14 (same commit as on 8 Oct 2026); EP6 and EP7 as PDF next to the text copies. D15: the snapshot of 9 Oct 2026 replaced by one of 18 Oct 2026 (same description; the earlier file showed a storefront indicator next to the YouTube logo and a print header). The 9 Oct 2026 screenshot of the Polish label (browser window parts visible) removed. Changelog: the two 0.7.3 entries numbered 0.7.3 (text) and 0.7.3a (data and tools); the 0.7.3a entry corrected on `utcDate` (20 values in 9 files, 14 of them in 6 files differed by one day); 0.7.4 names the number of tests. `sources/README.md` and `sources/SHA256SUMS.txt` updated. Later the same day: EP7a, the release notes of Bartender 5.0.52 as archived on 18 May 2024 (text copy), which mention neither Amplitude nor Applause, added to the sources and to the epilogue footnote; one sentence after the vendor's statement on Strongbox Pro in the epilogue: the authors did not test Strongbox Pro, and the public code still contains a RevenueCat initialisation for the Pro bundle behind a build flag whose state cannot be determined (3.11); `data/SHA256SUMS_originals.txt` now also holds the checksums of the S01-install and T1 captures (all 10 HAR and 10 PCAP originals). Form audit of 18 Oct 2026 (independent review of links, consistency and wording): summary split into paragraphs (words unchanged); the label state in the summary is as of 18 Oct 2026; 3.9 names the Wayback Machine capture of the Polish listing of 9 Oct 2026 as the record for that day (its archived HTML also holds the subtype and the purpose behind "See Details"); file paths added at the first mention of D1, D4–D8, D13 and D16; a key to the document codes after the list of labels; `D21` for the Stripe documentation; dates of access to the Superwall "App Privacy Nutrition Labels" page unified (9, 10, 16 and 17 Oct 2026); the repeated sentence on the purpose "Analytics" in 3.9 removed; full Wayback Machine addresses of the label history; connection lifetime in T2 given as 60.7–65.3 s; references "4.n" written as "section 4, item n"; section 6 says how the 19 questions are numbered (the message does not number them), with the same note in `correspondence/`; `CHANGELOG.md` entry "0.7a" for the second entry of 16 Oct; `sources/README.md`: EP7a in the epilogue heading, the Polish label capture of 9 Oct checked, dates of access to D20 split by page; `sources/SHA256SUMS.txt` now also lists `README.md`. Tools: `prepare_har_for_publication.py` 1.5.1 (texts of `log.comment` and the report only; data regenerated, values unchanged); `extract_html_text.py` 1.0 added to `tools/` (the helper used for the text files in `sources/`, now in English). Shortened after the form audit: the list of unanswered questions is given once, in section 6 (the summary, the 14 October entry and the table 3.12 refer to it; the row "The vendor's replies (R)" of 3.12 removed); the method describes the address labels without the history of the decision; the inference paragraph of 3.9 split into three (words unchanged); "Changed documents" in section 5 reduced to one sentence referring to 3.1 and `sources/README.md`; the selected passages of the interview transcript (`sources/D15_transcript-excerpts_2026-10-09.md`) cited in the D15 note; on the web page the second declarations table renamed and set apart from the ledger, the appendix sections A.1–A.4 reduced to what the report does not say, and the history lines of the authors' later messages given a few words of content. Layout of the repository (18 Oct 2026, later): short report added as `README.md`; the full report renamed `FULL-REPORT.md` (one sentence added under its heading pointing to the short report); content unchanged. Entries below that name `README.md` as the report refer to the file now called `FULL-REPORT.md`. Wording: three sentences of the authors reworded after the form audit (summary header, epilogue), meaning unchanged. The web page numbers its sections as both reports do (1, 2, 3.1–3.12, 4–7).
- 0.7.4 (17 Oct 2026) – decisions of the authors after the review. Data: the `sw_cache_key` parameter of paywall resource URLs is masked in every place where it occurs (request URL and `queryString`, `Referer` header, `$paywall_url` in events, `url` fields of the configuration) as `<<MASKED_NUM>>` (1523 values in 9 files; until now 1463 of them were in clear as a documented exception to the time shift, and 60 were labels); section 2 describes this instead of the exception. From `data/pcap-extracts/*_syn-quic.csv` the rows of other apps and services (server addresses that no host of the report pointed to, empty `host` column) were removed: 930 rows dropped, 197 kept; in T1 and S01-install only the header remains; the other extracts are unchanged; section 5 and `data/pcap-extracts/README.md` describe the filter. Tools: `pseudonymise_har.py` 2.3.0, `prepare_har_for_publication.py` 1.4.0, `shift_extract_times.py` 1.6; 50 tests (`tools/CHANGELOG.md`). Text: 3.8, the `app_open`/`app_close` events: 79 (47 and 32; one `app_close` in S11b was sent twice, in two requests, and is counted once), not 80. 3.9 and 3.12: the label unchanged on the authors' check of 17 October 2026 (authors' account, no snapshot) in place of the placeholder. Section 6: the publication address was sent to the vendor on 18 October 2026. Section 7: contact address. Epilogue: "joined Applause" (the wording of the announcement, EP1) instead of "was acquired by Applause"; Superwall was named in a launch post (D16) and in an interview (D15) but in no release note (instead of "only in a post on Reddit"); "had been" for the state before 15 October 2026; the comparison is limited to Bartender (5.0.52 with Amplitude, 14 May 2024; 5.0.53 without it, 6 June 2024; apology of 10 June 2024), the Voice Dream Reader case was removed; one sentence on the vendor's statement of 14 October 2026 that RevenueCat was removed from Strongbox Pro after community feedback; the footnote cites only the sources used. Sources: new text copies EP6 (the two entries of the Bartender 5 update feed) and EP7 (release notes of 5.0.53), without PDF; EP4 (Voice Dream) removed from `sources/`, as it is no longer cited; `sources/README.md` and `sources/SHA256SUMS.txt` updated.
- 0.7.3a (17 Oct 2026, data and tools) – data regenerated on 17 Oct 2026 from the same pseudonymised input and the same time offsets, with tools/prepare_har_for_publication.py 1.3.0 and tools/shift_extract_times.py 1.5. Time shift: in the `device` object of the `enrich` requests, `utcTime` (20 values in 9 files) had not been shifted, and `utcDate` (20 values in 9 files) had been shifted by whole days only, so that 14 of them, in 6 files, differed by one day from `utcDateTime` in the same object; both are now derived from the shifted `utcDateTime`, and any other bare time of day would be masked as `<<MASKED_CLOCK>>` (none occurs). CDN point of presence: the value repeated by CloudFront in the `Server-Timing` header (`cdn-pop`, 93 values in 9 files) is now masked like `X-Amz-Cf-Pop`. Entries, their order and all other values of the 10 HAR files unchanged apart from `log.comment`; check reports regenerated. PCAP extracts: `*_sni-new.txt` limited to the hosts named in the report plus `proxyman.com` (marker of Proxyman for iOS) and, in S18, `proton.me` (favicon); 82 names of other apps and services removed, their number given in the first line of each file; the CSV files are unchanged, and `*_syn-quic.csv` still lists connection starts of other apps by server address only, without host names (`data/pcap-extracts/README.md`, which also now describes the `host` column, QUIC rows as packets and the state of `T2_tcp-conversations.txt`). Tools: tools/pseudonymise_har.py 2.2.0 (the same `Server-Timing` masking at the source; the published files were not re-pseudonymised), tools/findings_table.py 1.2 (events counted in the window of the report, 1 s before to 20 s after `app_launch` or to the next `app_launch`; on `data/*.pub.har` 41–73); 47 tests (tools/CHANGELOG.md). `sources/sdk-options_2026-10-10.md`: `$appTransactionId` present in 28 of 37 `device_attributes` events (absent in 9: 7 with 50 fields, 2 with 58 fields; the file said 30/37 and 7); `shouldBypassAppTransactionCheck` described as a testing option in the SDK changelog and documentation, not in the code comment; the 4.16.0 event switch does not cover `enrich`. README: section 2 (masking of the point of presence, derived date and time fields), 3.2 (window of `tools/findings_table.py`), section 5 (how traffic of other apps was excluded from each kind of file). Checksums of `data/` and `sources/` recomputed.
- 0.7.3 (17 Oct 2026) – corrections after an independent review of the draft; epilogue unchanged. 3.6: connections to the resource hosts in the packet captures occur on every start only in T2 (without Proxyman); in S02, S11b and T3 (with Proxyman) only on the first start of the capture (the text said "on every start" for all five captures); about 5 kB received applies to `user-content` in T2, `fonts.googleapis.com` 6.8–8.2 kB, `fonts.gstatic.com` over QUIC; C8 first launch 160 resource entries (162 included 2 later CONNECT entries); A0 noted. 3.1: identical DNS addresses of `collector`/`api.superwall.me` and `subscriptions-api`/`enrichment-api` checked in 6 captures (not "all"); the 61–65 s is the lifetime of every app connection in T2; the HTTP/2 hypothesis limited to T2 (with Proxyman the app opens separate connections to `collector`). 3.2: `device_attributes` 50–61 fields with the full distribution; 9 events (not 7) without `$appTransactionId`; the `ip*`/`demand*` fields absent from events sent before the `enrich` response on first launches; `user_attributes` events (45, created by the SDK) named. 3.4: receipt posts per first launch 4 on A and B (S01: 5; 3 with initiation source `restore`), 1 on C, with the reason from the SDK code (3.10 said "a triple receipt restore … including without a purchase"); `denied` also possible with the ATT framework present, so the conclusion rests on the public code and the reply. 3.5: 20 `enrich` responses in 9 files (not 10); `ipV4ObservedAt` is a shifted timestamp; Demand Score quoted verbatim ("Some signals used include …"). 3.3: `appTransactionID` quote completed (Family Sharing). 3.6, section 4: entries for `m.stripe.*` and Sentry are not in the published files. 3.7, 3.10: the 4.16.0 event switch does not cover `enrich` (no switch up to 4.18.0); later Superwall releases before 1 Sep 2026 listed. 3.8: the published T3 file ends with the `Nudge` request; the 3 min rest on one later out-of-scope entry and the authors' account; one `app_close` in three cycles (H: unsent queue); full D15 wording "nothing like this". 3.9: subtype and purpose visible only in the macOS snapshot; caveat on the version shown in the 22 Apr 2025 snapshot; Apple's sentences on linked data and RevenueCat's conditional "Usage Data" entry added. 3.10: `shouldBypassAppTransactionCheck` described as a testing option in the SDK changelog (not in the code comment). 3.11: the role of `RCStrongboxBridge` marked as inference; RevenueCat initialisation for the Pro bundle under a build flag noted. Section 2: Proxyman for iOS runs named (A0, S02, S17, S18); TLS decryption of `js.stripe.com` only. Section 4: Sentry split into fact (S17, S18) and inference (A0, S02); DNS queries for `sentry.io` without a connection in S01, S02, S11b; the new policy on crash reporting quoted; "11 starts with recorded content" on A. Section 5: region of B does not depend on the VPN; effect of the tools specified. Section 6 and summary: legal basis (question 2) and question 15 added to the open points, partial answers to 8, 9, 14 and 15 marked; the follow-up of 14 Oct 2026 re-sent 11 questions with changed wording in 14, 17 and 19; "CET" in the message of 8 Oct 2026 noted; the 16 Oct 2026 reply shown with blank lines added for display; the authors' note now reads "not part of the message", as in `correspondence/`. Table 3.12: D2 (not defined in the report) replaced by the D8 quote. `sources/README.md`: access dates of external documentation, Superwall releases, an invisible character in an original file name made explicit. Correction to the 0.7.2 entry: EP1–EP3 were archived on 17 Oct 2026, 01:25–01:27 CEST (16 Oct 2026, 23:25–23:27 UTC).
- 0.7.2 (17 Oct 2026) – the authors' epilogue in place of the placeholder, after section 6: the authors' opinions and impressions, marked as such; the vendor's statement of 14 Oct 2026 quoted verbatim; a comparison with two earlier cases at Applause (Voice Dream Reader, April 2024; Bartender, June 2024), with a note on its sources. New sources EP1–EP4 (epilogue sources): the announcement "Strongbox Joins Applause" of 13 Mar 2025, Applause's post "Let's Try This Again" on the Bartender blog of 10 Jun 2024, the TidBITS article of 5 Jun 2024, and the Voice Dream page "Pricing Update for One-time Purchasers" in its versions of 26 Mar and 6 Apr 2024; for each, the main text from the raw Wayback Machine capture and a PDF without metadata (`sources/EP*`, description and capture addresses in `sources/README.md`, sums in `sources/SHA256SUMS.txt`). The first three pages were archived in the Wayback Machine on 17 Oct 2026; the Voice Dream captures are from 2024. Findings and assessments unchanged.
- 0.7.1 (17 Oct 2026) – correspondence from the authors' mailbox: `correspondence/correspondence_2026-10-02_to_2026-10-16.txt` now holds all nine messages, each in full and unchanged, with date, time in CEST and UTC, sender and subject (previously the authors' message of 8 Oct 2026, 23:46 CEST (21:46 UTC), was only summarised, blank lines in several messages differed from the messages as sent, and the message of 2 Oct 2026 contained link markup that is not in the message). Corrected times: the authors' message of 5 Oct 2026 was sent at 19:22 CEST (17:22 UTC), not 19:20 CEST (17:20 UTC); the authors' message with corrections and the new deadline was sent on 8 Oct 2026 at 23:46 CEST (21:46 UTC) (previously without a time). Corrected quote: the vendor's reply of 14 Oct 2026 in section 6 ends with a line that was missing ("Also just a heads up, your alias tool is leaking emails", followed by an emoji); the vendor's reply of 16 Oct 2026 now also carries its subject line in `correspondence/`. Section 6 lists every message: two vendor messages of 5 Oct 2026, 17:36 CEST (15:36 UTC) and 19:41 CEST (17:41 UTC); the authors' messages of 5 Oct 2026, 19:22 CEST (17:22 UTC), and 8 Oct 2026, 16:13 CEST (14:13 UTC). Findings and assessments unchanged. The vendor's reply of 14 Oct 2026 is followed, outside the quoted text, by an authors' note in square brackets (section 6 and `correspondence/`): "the last line refers to the authors' e-mail setup and is unrelated to the subject of this report"; the message itself is unchanged. Times of the correspondence and of the document captures in this changelog and in `sources/README.md` are given as CEST with UTC in brackets. Time of the change of article D4–D8 narrowed from "between 8 and 16 Oct 2026" to "between 14 and 16 Oct 2026", according to the authors' account (on 14 Oct 2026 the article was still unchanged; checked without a record); last records of the old version: Wayback Machine 1 Oct 2026 and PDF 8 Oct 2026; first record of the new version: 16 Oct 2026 (report: header, summary, 3.1, section 4 item 13, section 5, section 6; `sources/README.md`).
- 0.7 (16 Oct 2026) – English only: the Polish version of the report is no longer part of the repository; `README.md` is the English report. Directories, files, scripts, script options, field groups and label types renamed to English: `data/`, `data/pcap-extracts/`, `tools/`, `sources/`, `correspondence/`; check reports `data/*.pub.report.txt`; label types `DATE`, `PRICE`, `CURRENCY`, `VERSION`, `BUILD`, `PROFILE`, `LOCALTIME` (the hash and `_L` part of every label unchanged, so labels stay comparable between files). PCAP extracts named by run code (`A0_…` … `T3_…`, installation phase before S01: `S01-install_…`) with English suffixes and column names. Data files regenerated with tools/prepare_har_for_publication.py 1.2.0 and tools/shift_extract_times.py 1.4 from the same pseudonymised input and the same time offsets: entries, values, times and order unchanged; changed only `log.comment`, the comment on removed static content, label type names, file names and the `*_syn-quic.csv` header. Tools translated (tools/CHANGELOG.md); tools/findings_table.py added. Texts in `sources/` and `correspondence/` (the authors' headers, descriptions and notes) translated; quoted documents unchanged. `data/pcap-extracts/README.md`: note on the decimal comma in `T2_tcp-conversations.txt`. PDF Title metadata in `sources/` blanked like the other metadata fields (page content unchanged). Checksums recomputed.
- 0.7a (16 Oct 2026, corrections of the same day) – section 6: the vendor's second reply came after the deadline of 15 October 2026, 23:59 CEST (21:59 UTC), set in the authors' message of 8 October (the text wrongly said "after the 8 October deadline"). Time shift: the published offsets are at least 3 and less than 31 days, forward or backward (the text said "3 to 30 days"); the same correction in `log.comment` of the 10 HAR files, which were re-run with tools/prepare_har_for_publication.py 1.2.1 and the unchanged offsets (entries, values and times unchanged; only `log.comment` and the version in the check reports changed). The script now draws new offsets in that range (tools/CHANGELOG.md). Two local variable names in tools/prepare_har_for_publication.py and tools/clean_metadata.py replaced with English words (no change in behaviour). tools/pseudonymise_har.py: an English comment on the fixed Polish string used for the salt fingerprint, kept unchanged so that the published fingerprint `ab1aa7958ba0` stays valid. New `.gitignore` for the repository (private files: salt, time-shift map, `*_LOCAL*`, original HAR and packet captures). Checksums of `data/` recomputed.
- 0.6.1 (16 Oct 2026) – the authors' prologue (Polish and English) in place of the placeholder: the authors' personal experience and feelings, marked as such; the circumstance that started the study (iOS App Privacy Report, 30 Sep 2026). Sources: P0 – two screenshots of the App Privacy Report of 30 Sep 2026, device A, times of day covered, no metadata (`sources/P0_app-privacy-report_domains_2026-09-30.png`, `sources/P0_app-privacy-report_most-contacted_2026-09-30.png`, sums in `sources/SHA256SUMS.txt`; description in `sources/README.md`), linked from the prologue. Prologue: gender-neutral wording. Polish and English versions 328 lines each. Sources: the colour profile containing a monitor model name removed from `sources/D11_appstore-version-history-1.64.0_2026-10-09.png` and `sources/D13-PL_appstore-privacy-label_2026-10-09.png` (image converted to sRGB, content unchanged), sums in `sources/SHA256SUMS.txt` updated. Sources: texts of the document versions before the changes, from Wayback Machine captures of 1 Oct 2026 – the privacy policy ("Last Update: 9 May 2024", `sources/D1_privacy-policy_strongboxsafe.com_wayback-20261001190802.txt`) and the article on network connections (`sources/D4-D8_network-connections_reamaze_wayback-20261001191012.txt`); content matches the PDF of 8 Oct 2026; description in `sources/README.md`, sums in `sources/SHA256SUMS.txt`.
- 0.6 (16 Oct 2026) – both versions of the vendor's documents: the privacy policy of 15 Oct 2026 and the rewritten article on connections (accessed 16 Oct 2026) next to the versions of 8 Oct 2026 in 3.1, 3.3, 3.4, 3.5, 3.6; past tense for the versions in force during the study. R lines from the reply of 16 Oct 2026 in 3.1 (Superwall only in post D16), 3.2 (conversion reporting), 3.5 (location from IP and demand score not used), 3.6 (preloading for subscribers), 3.7 (no opt-out for the user), 3.8 (lifecycle events), 3.9 (label), 3.11 (repository). New F: paywall rules do not use `demandScore`, `demandTier` or the `ip*` fields (3.5); `app_open`/`app_close` contain only a session identifier and the event name (3.8). New D: history of the App Store label from the Wayback Machine (3.9: "Data Not Collected" until 04.2025, change after RevenueCat was added, no change after Superwall was added up to 7 Oct 2026); Apple on the IP address (3.5); Apple `appTransactionID` – constant for an Apple account on all devices (3.3); RevenueCat guidance (3.9). Correction in 3.9: the guidance of both providers does not require the types Device ID (other than advertising identifiers), Coarse Location or Product Interaction – the requirement follows from Apple's definitions. Table 3.12 with a column "after the changes of 15 Oct 2026"; section 4 items 1–3, 12, new 13; section 5 (changed documents, declarations about purposes); summary and heading. After an independent review (24 comments, all applied): date of the article change "between 8 and 16 Oct 2026" instead of 15 Oct; the R quote on opting out with "currently" and limited to event collection; a single list of unanswered questions; remaining present tense about D4–D8 (3.1, 3.4, 4.4, 4.5, 4.10, 3.12); more cautious wording of the label history (interval of the change); innocent explanation in 3.9 (pseudonymous data and "Not Linked", Superwall guidance); agreements with the new documents in 4.11 and 3.1; "ATT consent" instead of "consent to tracking". Sources: texts of the new policy and the new article in `sources/` (`*_2026-10-16.txt`, sums in `sources/SHA256SUMS.txt`). Polish and English versions 324 lines each.
- 0.5.1 (16 Oct 2026) – section 6: the vendor's second reply of 16 Oct 2026, 12:37 CEST (10:37 UTC), a short answer under each question of the follow-up, in full; list of questions still unanswered; information that the privacy policy ("Last Update: 15 October 2026") and the article on network connections changed after the questions were sent. Placeholder "[to be added: further reply…]" removed. Correspondence: thread renamed to `correspondence_2026-10-02_to_2026-10-16.txt` and extended with the reply of 16 Oct. Description of both document versions in section 3 – in the next version. Polish and English versions 309 lines each.
- 0.5 (14 Oct 2026) – the vendor's reply of 14 Oct 2026, 18:49 CEST (16:49 UTC), general and not to each of the 19 questions, in full in section 6, with the list of unanswered questions; new marker **R** (vendor's reply) and one R line with a conclusion each in 3.1, 3.2, 3.3, 3.4, 3.8, 3.9; new row in table 3.12; section 4 item 12 (what the reply confirms); section 5 (declarations about purposes cannot be checked with this method); summary extended; D15 footnote – transcript of the segment from 43:50 to the end (`sources/D15_transcript_43-50_2026-10-14.txt`), to which the reply refers. Correspondence: thread renamed to `correspondence_2026-10-02_to_2026-10-14.txt` (month in the headers corrected from "11" to "10", CEST added, summary of the authors' message of 8 Oct, reply of 14 Oct, the authors' follow-up of 14 Oct, 20:29 CEST (18:29 UTC)). Section 6: entry on the follow-up. In 3.1, how the vendor's communication channels divide (D9 RevenueCat, D11 without Superwall, D16 Superwall; label without an earlier state). Polish and English versions 241 lines each.
- 0.4 (10 Oct 2026) – new sections 3.9 (the App Store label and Apple's definitions: types Device ID, Coarse Location, Product Interaction; the minimum from the Superwall documentation), 3.10 (options of both SDKs and the "most limited state": 3 unused restricting Superwall options, 2 enabled extending RevenueCat options, the rest without a switch; Superwall 4.16.0 with a full switch from 30 Jun 2026), 3.11 (public app code: configuration only StoreKit 1, no RevenueCat initialisation file, no ATT, placements `Onboarding`/`Settings`/`Nudge`, `database-unlock` not registered); the former 3.9 is now 3.12. Corrections: `isExternalDataCollectionEnabled` in 4.15.3 disables only some events (3.7); `$attConsentStatus = denied` results from the absence of the ATT framework (3.4, 4.7); `device_attributes` with 50 fields in 7 events (3.2); Demand Score computed from the number of app opens and paywall views (3.5); Stripe: `stripe.js` from the paywall webview and connections to `m.stripe.com`/`m.stripe.network`, documentation "advanced fraud detection" (3.6); `Nudge` called from the banner in the code (3.8); flow for a subscriber with an active entitlement (4.3, 5); new rows in table 3.12 (D16 "free app", D15 "analytics"). Sources: D13 mac (PNG without metadata), D19–D21 (addresses; screenshots to be added, not added, see `sources/README.md`), `sources/sdk-options_2026-10-10.md` (table of the options of both SDKs against the traffic, English). Summary extended.
- 0.3.2 (10 Oct 2026) – method (section 2, Polish and English): sentence on the unshifted parameter `sw_cache_key` in the addresses of paywall resources. Tools: prepare_har_for_publication.py 1.1.4 (time shift also found by run code; a conflict in the map is an error), shift_extract_times.py 1.3 (error instead of silently skipping when files are missing); HAR data unchanged except the version number in `log.comment`, `data/SHA256SUMS.txt` regenerated. Changelog addition: shift_extract_times.py 1.2 (10 Oct 2026) replaced the Proxyman export names in the script with a map to run codes (output unchanged).
- 0.3.1 (10 Oct 2026) – data: in the files `data/*.pub.har` the RevenueCat headers `X-RC-Last-Refresh-Time` (request) and `x-revenuecat-request-time` (response), which contain a time in milliseconds, were not covered by the time shift (127 values in 9 files). Fixed in prepare_har_for_publication.py 1.1.3; files regenerated, unchanged apart from these values and the version number in `log.comment`; reports `*.pub.report.txt` with a new section on shifted headers; `data/SHA256SUMS.txt` regenerated.
- 0.3 (9 Oct 2026) – time zone of the correspondence (CEST, with UTC); Strongbox Zero also on A from 3 Oct; licence CC BY 4.0 (text, data) and MIT (scripts); screenshot of the D15 video page; places for the authors' prologue and epilogue. After translation: C8 162 and the convention for counting resources (3.6); sample "4 days of tests" instead of "9 days"; app name with a hyphen as in the App Store; checksums only for published files; no word "tracking" outside quotes. English version `README.en.md` (translation + independent review: 1 correction of fact, 6 of meaning, 20 of form; markers F/D/I/H). SHA-256 sums of the originals under run codes: `data/SHA256SUMS_originals.txt`. Metadata review: PDF/PNG in `sources/` without metadata (clean_metadata.py 1.0); extracts `*_syn-quic.csv` and `T2_tcp-conversations.txt` without local network addresses (shift_extract_times.py 1.1); HAR reports regenerated (prepare_har_for_publication.py 1.1.1, `--run-code`; HAR data unchanged); `data/SHA256SUMS.txt` now also covers the reports, the `.sha256` files and the extracts.
- 0.2 (9 Oct 2026) – after two independent reviews: summary; quotes D1 (location) and D4 (Wireshark); the AdServices token must be enabled by the app (SDK code); softened conclusion on `Nudge`; sections 4 and 5 extended; timestamps in the published files shifted per run (prepare_har_for_publication.py 1.1.0, shift_extract_times.py); the message of 8 Oct in the correspondence.
- 0.1 (9 Oct 2026) – working draft, not public. Data: 10 HAR files (pseudonymise_har.py 2.0.2, prepare_har_for_publication.py 1.0.2), 10 PCAP recordings as extracts (extract_pcap.sh 2.0.0).