# Sources: vendor declarations and other documents

Times in October 2026 are given in CEST with UTC in brackets; for the 8 Oct 2026 PDF captures the CEST time is the local time printed by the browser on the PDF. PDF metadata fields (Title, Author, Creator, Producer, creation and modification dates) are blank in all published PDFs (overwritten with spaces by `tools/clean_metadata.py`; page content unchanged). SHA-256 sums of every file in this directory, including this `README.md`, are in `SHA256SUMS.txt`.

| File | Declaration | Original file name | Source |
|---|---|---|---|
| D1_privacy-policy_strongboxsafe.com_2026-10-08.pdf | D1–D3 | Privacy - Strongbox.pdf | strongboxsafe.com/privacy/ (state "Last Update: 9 May 2024"), captured 8 Oct 2026, 22:35 CEST (20:35 UTC) |
| D4-D8_network-connections_reamaze_2026-10-08.pdf | D4–D8 | Support - Strongbox-08.10.pdf | strongbox.reamaze.com "What Network Connections Can Strongbox Make?", captured 8 Oct 2026, 22:39 CEST (20:39 UTC) |
| D1_privacy-policy_strongboxsafe.com_2026-10-16.txt | D1 (version of 15 Oct 2026) | – | strongboxsafe.com/privacy/ ("Last Update: 15 October 2026"), page text downloaded 16 Oct 2026 at about 18:20 CEST (16:20 UTC), without menu and footer |
| D1_privacy-policy_strongboxsafe.com_2026-10-16.pdf | D1 (version of 15 Oct 2026) | Privacy - Strongbox.pdf | strongboxsafe.com/privacy/, PDF from Safari, 16 Oct 2026 at about 19:20 CEST (17:20 UTC), 2 pages; Wayback Machine 16 Oct 2026, 19:16 CEST (17:16 UTC) |
| D4-D8_network-connections_reamaze_2026-10-16.pdf | D4–D8 (new version) | Strongbox Support Center.pdf | article "What Network Connections Can Strongbox Make?", PDF from Safari, 16 Oct 2026 at about 19:20 CEST (17:20 UTC), 4 pages; a Wayback Machine capture of the direct address strongbox.reamaze.com was requested on 16 Oct 2026, 19:34 CEST (17:34 UTC), but the archive resolves that address to its capture of 9 Jun 2026 (the old version; checked 19 Oct 2026), so the record of the new version is this PDF and the .txt file |
| D4-D8_network-connections_reamaze_2026-10-16.txt | D4–D8 (new version) | – | strongbox.reamaze.com "What Network Connections Can Strongbox Make?", page text downloaded 16 Oct 2026 at about 18:20 CEST (16:20 UTC), without menu and footer |
| D1_privacy-policy_strongboxsafe.com_wayback-20261001190802.txt | D1–D3 (version of 9 May 2024) | – | page text from the raw Wayback Machine capture https://web.archive.org/web/20261001190802id_/https://strongboxsafe.com/privacy/ (1 Oct 2026, 21:08:02 CEST (19:08:02 UTC)), downloaded 16 Oct 2026; main content only (from "Our Privacy Policy" to the end of the policy, without menu and footer), extracted with `tools/extract_html_text.py`; same method as `D1_…_2026-10-16.txt`. Content matches the PDF of 8 Oct 2026 (differences only: print headers and footers, menu). The Wayback Machine capture of 8 Oct 2026, 21:29:59 CEST (19:29:59 UTC), gives identical text |
| D1_privacy-policy_strongboxsafe.com_wayback-20261001190802.pdf | D1–D3 (version of 9 May 2024) | Privacy - Strongbox.pdf | the same Wayback Machine capture of 1 Oct 2026 (replay without the archive toolbar, `if_` address), whole page exported from Safari as a single-page PDF, 18 Oct 2026, 19:11 CEST (17:11 UTC); text identical with the `.txt` file above and with the PDF of 8 Oct 2026 |
| D4-D8_network-connections_reamaze_wayback-20261001191012.txt | D4–D8 (version before the change) | – | article text from the raw Wayback Machine capture of 1 Oct 2026, 21:10:12 CEST (19:10:12 UTC): the address of the Reamaze widget frame (the capture was made when the support page was archived on 1 Oct 2026, 21:10:06 CEST (19:10:06 UTC)); full capture address: https://web.archive.org/web/20261001191012/https://strongbox.reamaze.com/kb/security-and-privacy/what-possible-network-connections-can-strongbox-make?sso%5Bid%5D=&sso%5Banon_id%5D=&sso%5Bfirst_seen%5D=2026-10-01T19%3A10%3A12.738Z&sso%5Bname%5D=&sso%5Bavatar%5D=&sso%5Bemail%5D=&sso%5Bauthkey%5D=&sso%5Bauthpath%5D=&sso%5Bparent_url%5D=https%3A%2F%2Fstrongboxsafe.com%2Fsupport%2F%23reamaze%230%23%2Fkb%2Fsecurity-and-privacy%2Fwhat-possible-network-connections-can-strongbox-make&sso%5Btz_offset%5D=0&sso%5Btz_name%5D=Etc%2FUnknown&framed=1&no_subject=0&require_attachment=0&form_id=&category_id=. Article content only, link text without addresses; list markers ("1.", "-") and an indent of 3 spaces per level were added when extracting the text with `tools/extract_html_text.py` (HTML lists in the original). Content matches the PDF of 8 Oct 2026 (differences only: link addresses printed by Safari, list numbering, print headers, hyphenation). The same text is in the capture of the direct address of 9 Jun 2026 12:29:10 UTC (https://web.archive.org/web/20260609122910/https://strongbox.reamaze.com/kb/security-and-privacy/what-possible-network-connections-can-strongbox-make) |
| D4-D8_network-connections_reamaze_wayback-20260609122910.pdf | D4–D8 (version before the change) | What Network Connections Can Strongbox Make? - Strongbox.pdf | Wayback Machine capture of the direct article address of 9 Jun 2026, 12:29:10 UTC (replay without the archive toolbar, `if_` address; same text as the capture of 1 Oct 2026 above), whole page exported from Safari as a single-page PDF, 18 Oct 2026, 19:11 CEST (17:11 UTC) |
| D13_app-store-listing_2026-10-08.pdf | D13 | Strongbox - Password Manager App - App Store.pdf (the original name begins with an invisible left-to-right mark, U+200E, added by Safari) | App Store (listing page), captured 8 Oct 2026, 22:40 CEST (20:40 UTC) |
| D13_app-store-listing_2026-10-18.pdf | D13 (state on 18 Oct 2026) | Strongbox - Password Manager App - App Store.pdf | apps.apple.com/us/app/strongbox-password-manager/id897283731, whole page exported from Safari as a single-page PDF, 18 Oct 2026, 19:12 CEST (17:12 UTC). "App Privacy": "Data Not Linked to You" → "Purchases"; version 1.65.2 (Sep 1). Same label as on 8 Oct 2026 |
| D13-PL_app-store-listing_2026-10-18.pdf | D13 PL (state on 18 Oct 2026) | Aplikacja Strongbox - Password Manager, App Store.pdf (as saved by Safari, the name begins with U+200E and has an em dash, U+2014, in place of the comma) | apps.apple.com/pl/app/strongbox-password-manager/id897283731?l=pl (Polish storefront, interface in Polish), whole page exported from Safari as a single-page PDF, 18 Oct 2026, 19:09 CEST (17:09 UTC). "Prywatność" (App Privacy): "Dane, które nie są z Tobą powiązane" (Data Not Linked to You) → "Zakupy" (Purchases). Replaces the screenshot `D13-PL_appstore-privacy-label_2026-10-09.png` (same content; the screenshot showed parts of the browser window) |
| D16_post-text_2026-10-09.md | D16 | – | text of the post reddit.com/r/strongbox/comments/1qneaxm, extracted from a PDF capture made on 9 Oct 2026, 19:25 CEST (17:25 UTC) (the PDF, which also contains other users' comments, is not published) |
| D15_youtube-description_2026-10-18.pdf | D15 | The Password Manager that Took KeePass ... Level (Strongbox Interview) - YouTube.pdf | youtube.com/watch?v=lxCR8-YsuHU, browser capture 18 Oct 2026, 19:16 CEST (17:16 UTC), 4 pages; video description (channel Techlore, published 1 Aug 2026) with the sentence on the interviewee's role. Replaces the capture of 9 Oct 2026 (same description; the earlier file showed the browser's print header and a storefront indicator next to the YouTube logo) |
| D15_transcript-excerpts_2026-10-09.md | D15 | – | passages of segment 32:57–40:56 relevant to the study, transcribed by the authors by ear, 9 Oct 2026 |
| D15_transcript_32-57_2026-10-09.txt | D15 | – | full transcript of segment 32:57–40:56, transcribed by the authors by ear, 9 Oct 2026 |
| D14_github-readme_2026-10-08.pdf | D14 | GitHub - strongbox-password-safe/Strongbox … .pdf | github.com/strongbox-password-safe/Strongbox, captured 8 Oct 2026, 22:44 CEST (20:44 UTC) |
| D14_github-readme_2026-10-18.pdf | D14 (state on 18 Oct 2026) | GitHub - strongbox-password-safe/Strongbox … .pdf | the same page, whole page exported from Safari as a single-page PDF, 18 Oct 2026, 19:12 CEST (17:12 UTC); last commit still c70fc7b ("1.65.0", "3 months ago") |
| D15_transcript_43-50_2026-10-14.txt | D15 | – | transcript by the authors by ear, segment 43:50 – end of the recording, 14 Oct 2026; supplement to segment 32:57–40:56. Reason: the vendor's reply of 14 Oct 2026 links to timestamp 44:26 |

No archive.today capture of D16 was made.

D4–D8, time of the change: the last records of the old version are the Wayback Machine capture of 1 Oct 2026 and the PDF of 8 Oct 2026; the first record of the new version is of 16 Oct 2026. The authors' account: on 14 Oct 2026 the article was still unchanged (checked without a record), so the change took place between 14 and 16 Oct 2026.

## D16 – publication time of the post

F: read in the Safari inspector on reddit.com on 9 Oct 2026 (the screenshot is not published): element `<time>` with `datetime="2026-01-26T12:08:06.402Z"` under the title "Strongbox 1.64.0", `post-id="t3_1qneaxm"`, author `u/strongbox-support`. The value corresponds to `created_utc` = 1769429286 (2026-01-26 12:08:06 UTC).
The authors' account (9 Oct 2026): the page shows no "edited" marker on the post.

## D11 – release notes of 1.64.0 (App Store, version history)

F: `D11_appstore-version-history-1.64.0_macAppStore_2026-10-18.png` – screenshot of the "Version History" window in the App Store app on macOS (listing of Strongbox, US text), 18 Oct 2026, 19:18 CEST (17:18 UTC); it replaces a screenshot of the web page apps.apple.com/us/app/strongbox-password-manager/id897283731 of 9 Oct 2026, 19:31 CEST (17:31 UTC), which showed the browser's address bar (same entries). Behind the window, the "App Privacy" section of the listing is visible ("Data Not Linked to You" → "Purchases"). Entry "1.64.0, Jan 26": "This update for Strongbox adds new import options, improves the upgrade experience & adds more options for crash reporting." / New: "Updated upgrade/onboarding flow and trial messaging.", "Added automatic opt-in crash reporting." Entry 1.63.2 (11/21/2025) is also visible. Current version on the page: 1.65.2, Sep 1.
D9 (1.60.39) is not in this screenshot; its text is in the extract described below.

## D9, D11 – App Store version history (page source)

F: the page source of apps.apple.com/us/app/strongbox-password-manager/id897283731 was saved in Safari on 9 Oct 2026 at about 19:39 CEST (17:39 UTC) (the saved HTML file is not published). Extract of 25 version history entries (1.60.23 … 1.65.2) in `D9-D11_appstore-version-history_2026-10-09.txt` (verbatim text, release date from the `secondarySubtitle` field).
- D9: 1.60.39, 2025-05-12 09:12:55 UTC – "Purchases in the app are now processed using RevenueCat. … The exact same information is provided to RevenueCat as it would be directly to Apple, and no extra analytics or tracking is added as a result of this change."
- D11: 1.64.0, 2026-01-26 11:35:02 UTC – "Added automatic opt-in crash reporting.", "Updated upgrade/onboarding flow and trial messaging."
- Current: 1.65.2, 2026-09-01 13:52:29 UTC.
Note: the 1.64.0 release notes do not mention Superwall; post D16 (26 Jan 2026 12:08 UTC, 33 minutes after the release) does.

## Wayback Machine captures (web.archive.org)
- D1: https://web.archive.org/web/20261001190802/https://strongboxsafe.com/privacy/ (1 Oct 2026, 21:08 CEST (19:08 UTC); the text extracted from this capture is `D1_privacy-policy_strongboxsafe.com_wayback-20261001190802.txt`)
- D4–D8: https://web.archive.org/web/20261001191006/https://strongboxsafe.com/support/#reamaze#0#/kb/security-and-privacy/what-possible-network-connections-can-strongbox-make (1 Oct 2026, 21:10 CEST (19:10 UTC); the article content loads through the Reamaze widget; its text is in the separate capture used for `D4-D8_network-connections_reamaze_wayback-20261001191012.txt`)
- D13 PL: https://web.archive.org/web/20261009193211/https://apps.apple.com/pl/app/strongbox-password-manager/id897283731?l=pl (9 Oct 2026, 21:32 CEST (19:32 UTC))
- D16: https://web.archive.org/web/20261009192508/https://www.reddit.com/r/strongbox/comments/1qneaxm/strongbox_1640/ (9 Oct 2026, 21:25 CEST (19:25 UTC))
The authors' account (9 Oct 2026): the D16 (Reddit) and D4–D8 (article) captures were checked in a browser and show the content. F (checked 18 Oct 2026 on the raw copy of the D13 PL capture, `id_` address): the archived HTML contains the privacy section with "Zakupy" (Purchases) and, behind the "Zobacz szczegóły" (See Details) control, "Analizy" (Analytics) and "Historia zakupów" (Purchase History). No captures were made of D13 US and D14 (authors' decision).

## D13 PL – App Store privacy label (Polish storefront)
F: `D13-PL_app-store-listing_2026-10-18.pdf` – the App Store web page for the Polish storefront, apps.apple.com/pl/app/strongbox-password-manager/id897283731?l=pl, exported from Safari on 18 Oct 2026, 19:09 CEST (17:09 UTC); it replaces a screenshot of the same page of 9 Oct 2026, 21:39 CEST (19:39 UTC), which showed parts of the browser window (same content). The interface is in Polish because this is the state of the Polish storefront. Section "Prywatność w aplikacji" (App Privacy): "Dane, które nie są z Tobą powiązane" (Data Not Linked to You) → "Zakupy" (Purchases). Version 1.65.2 ("1 wrz", 1 Sep). Same content as the US label (D13). "PL" in the file name is the country code of the storefront.

## D13 mac – privacy label, App Store app on macOS (10 Oct 2026)
F: `D13-macAppStore_2026-10-10.png` – screenshot of "App Privacy" in the App Store app on macOS, 10 Oct 2026 (Polish storefront; the authors' account). The only item: "Data Not Linked to You" → purpose "Analytics" → "Purchases: Purchase History". PNG metadata removed (`tools/clean_metadata.py`). Comparison with Apple's definitions: report, section 3.9.

## sdk-options_2026-10-10.md
Table of the Superwall-iOS 4.15.3 and purchases-ios 5.21.1 options that affect data sent from the device: default value in the code (path and line at the pinned tag), effect on the traffic, value observed in `data/*.pub.har` (counts), verdict. Basis of section 3.10 of the report.

## sdk-source-notes_2026-10-09.md
Source code lines and documentation of both SDKs (D17, D18, D18a) with permalinks: IDFV as `vendorId`/`deviceId` (Superwall) and `X-Apple-Device-Identifier` (RevenueCat); the AdServices token is sent only after the app enables it.

## D19–D21 – external documentation cited in the report (accessed 10 Oct 2026, some pages again on 16 and 17 Oct 2026 as stated in the report; no screenshots in this archive)
- D19: Apple, "App privacy details on the App Store", https://developer.apple.com/app-store/app-privacy-details/ (accessed 10, 16 and 17 Oct 2026)
- D20: Superwall, "App Privacy Nutrition Labels", https://superwall.com/docs/ios/guides/app-privacy-nutrition-labels (accessed 9, 10, 16 and 17 Oct 2026); "Demand Score", https://superwall.com/docs/dashboard/dashboard-demand-score/demand-score.md (accessed 10 and 17 Oct 2026)
- RevenueCat, "Apple App Privacy", https://www.revenuecat.com/docs/platform-resources/apple-platform-resources/apple-app-privacy (accessed 16 and 17 Oct 2026)
- Apple, `appTransactionID`, https://developer.apple.com/documentation/storekit/apptransaction/apptransactionid (accessed 3, 16 and 17 Oct 2026)
- D21: Stripe, "Advanced fraud detection", https://docs.stripe.com/disputes/prevention/advanced-fraud-detection
- Vendor's code: https://github.com/strongbox-password-safe/Strongbox (branch `master`, commit c70fc7b, 17 Jul 2026); Superwall-iOS releases 4.15.3 (18 May 2026), 4.15.4 (26 Jun 2026), 4.16.0 (30 Jun 2026), 4.16.1 (1 Jul 2026), 4.16.2 (15 Aug 2026), 4.16.3 (19 Aug 2026) and 4.18.0 (15 Oct 2026): https://github.com/superwall/Superwall-iOS/releases (accessed 17 Oct 2026)

## P0 – iOS App Privacy Report, 30 Sep 2026
- Both screenshots were taken on device A (see section 2 of the report).
- `P0_app-privacy-report_domains_2026-09-30.png` – iPhone screenshot of the App Privacy Report entry for Strongbox ("Owned by Phoebe Code Limited"), section "Domains contacted directly by app" (top five domains with contact counts), state on 30 Sep 2026.
- `P0_app-privacy-report_most-contacted_2026-09-30.png` – iPhone screenshot of the "Most Contacted Domains" list for the same app (scrolled), same day.
- Dates are visible; times of day are covered with plain grey boxes (first file; the second file shows no times). Nothing else is covered. Converted to sRGB and re-saved as PNG; all metadata (EXIF, XMP, colour profile, text chunks) removed.

## EP1–EP3, EP6, EP7, EP7a – sources of the epilogue (accessed 17 Oct 2026)
"EP" marks the sources of the epilogue (the authors' opinions); they are not declarations about the app studied. Only the sources cited in the epilogue are included (EP1–EP3, EP6, EP7, EP7a); the codes EP4 and EP5 belong to sources the authors consulted but do not cite. For EP1–EP3: the main text extracted from the raw Wayback Machine capture (`id_` address; headings, paragraphs and list items as blocks separated by a blank line, list markers "-" and an indent of 3 spaces per level added when extracting the text, link text without addresses; menu, footer, related posts and comments not included; extracted with `tools/extract_html_text.py`), downloaded 17 Oct 2026 at about 01:28 CEST (16 Oct 2026, 23:28 UTC); and a PDF printed with Google Chrome (headless, A4, without browser headers and footers) from the Wayback Machine replay of the same capture without the archive toolbar (`if_` address), 17 Oct 2026 between 01:32 and 01:36 CEST (16 Oct 2026, 23:32–23:36 UTC). PDF metadata blank as for the other PDFs (Title included).

| File | Source | Wayback Machine capture |
|---|---|---|
| EP1_strongbox-joins-applause_strongboxsafe.com_wayback-20261016232547.txt, .pdf | Applause, "Strongbox Joins Applause", strongboxsafe.com/strongbox-joins-applause/ ("Posted on March 13, 2025") | https://web.archive.org/web/20261016232547/https://strongboxsafe.com/strongbox-joins-applause/ – made by the authors on 17 Oct 2026, 01:25:47 CEST (16 Oct 2026, 23:25:47 UTC) |
| EP2_lets-try-this-again_macbartender.com_wayback-20261016232701.txt, .pdf | Applause, "Let's Try This Again", Bartender blog, macbartender.com/B5blog/Lets-Try-This-Again/ ("June 10, 2024") | https://web.archive.org/web/20261016232701/https://www.macbartender.com/B5blog/Lets-Try-This-Again/ – made by the authors on 17 Oct 2026, 01:27:01 CEST (16 Oct 2026, 23:27:01 UTC) |
| EP3_bartender-quiet-acquisition_tidbits.com_wayback-20261016232732.txt, .pdf | Adam Engst, "Bartender Developer Explains and Apologizes for Quiet Acquisition", TidBITS, 5 June 2024, tidbits.com/2024/06/05/bartender-developer-explains-and-apologizes-for-quiet-acquisition/ | https://web.archive.org/web/20261016232732/https://tidbits.com/2024/06/05/bartender-developer-explains-and-apologizes-for-quiet-acquisition/ – made by the authors on 17 Oct 2026, 01:27:32 CEST (16 Oct 2026, 23:27:32 UTC). Article only: before printing the PDF, the readers' comments, the cookie notice and the "Skip to content" link were hidden; the article itself is unchanged |
| EP6_bartender-5-update-feed_macbartender.com_wayback-20251116051042.txt, .pdf | Bartender 5 update feed (Sparkle appcast), macbartender.com/B2/updates/AppcastB5.xml: the two entries for versions 5.0.52 ("May 14, 2024") and 5.0.53 ("June 06, 2024"), copied verbatim from the raw capture (`id_` address); the other 55 entries of the feed are omitted. The dates are entered by the publisher (all entries of the feed carry the time 09:45:00 +0000), not recorded by a server. The `.pdf` file: the whole feed as displayed by Safari from the replay of the same capture (`if_` address), exported as a single-page PDF on 18 Oct 2026, 19:12 CEST (17:12 UTC) | https://web.archive.org/web/20251116051042/https://www.macbartender.com/B2/updates/AppcastB5.xml – existing capture of 16 Nov 2025, 05:10:42 UTC; downloaded 17 Oct 2026, 22:49 CEST (20:49 UTC) |
| EP7a_bartender-5.0.52-release-notes_macbartender.com_wayback-20240518170255.txt | Release notes of Bartender 5.0.52, macbartender.com/B2/updates/5-0-52/rnotes.html (the page linked from the 5.0.52 entry of the feed): text of the page, extracted from the raw capture as for EP1–EP3. The notes mention neither Amplitude nor Applause. Text only, no PDF | https://web.archive.org/web/20240518170255/https://macbartender.com/B2/updates/5-0-52/rnotes.html – existing capture of 18 May 2024, 17:02:55 UTC; downloaded 17 Oct 2026 |
| EP7_bartender-5.0.53-release-notes_macbartender.com_wayback-20250614191649.txt, .pdf | Release notes of Bartender 5.0.53, macbartender.com/B2/updates/5-0-53/rnotes.html (the page linked from the 5.0.53 entry of the feed): text of the page, extracted from the raw capture as for EP1–EP3. The `.pdf` file: the page as displayed by Safari from the replay of the same capture (`if_` address), exported as a single-page PDF on 18 Oct 2026, 19:13 CEST (17:13 UTC) | https://web.archive.org/web/20250614191649/https://macbartender.com/B2/updates/5-0-53/rnotes.html – existing capture of 14 Jun 2025, 19:16:49 UTC; downloaded 17 Oct 2026, 22:49 CEST (20:49 UTC) |