Strongbox

Departs from the wording

On every cold start the app connected to RevenueCat and to four Superwall hosts and sent Superwall 41 to 73 events with a device profile (from 1 s before to 20 s after launch), whether the user had an active entitlement, an expired one or none. The policy of 15 October 2026 names both services.

21 of 21 cold starts recorded in HAR; in the 3 starts recorded only in packet capture, 3 of the 5 host names are visible / devices A, B and C / 1, 3, 5 and 8 Oct 2026

Departs from the wording

The list covered the App Store, the duckduckgo.com connectivity test, favicons and Have I Been Pwned. It did not cover RevenueCat, Superwall, Google Fonts or Stripe, which the app contacted. The new version of the article names RevenueCat and Superwall, not Google Fonts or Stripe.

all 10 HAR files / 3 devices / 4 days

Departs from the wording

The events sent on start cover the app lifecycle (app_launch, app_open, session_start, app_close) and a device profile (device_attributes, 50 to 61 fields), not only paywall events.

41 to 73 events per cold start, from 1 s before to 20 s after launch / the HAR files with content

Open to interpretation

The "free app" is the in-app purchase variant, which paying subscribers use too. On device A, with an active subscription, the flow to RevenueCat and Superwall is the same as on B and C; under the configuration no paywall can be shown to A. The policy of 15 October 2026 says the integration "can run even when you already have an active Pro subscription".

device A: 11 cold starts with recorded content, no decision to display a paywall

Open to interpretation

In one of six database unlocks, the app sent the event Nudge and the configuration returned a decision to display a paywall; no display was recorded. In the app's public code Nudge follows a tap on the "Upgrade to Pro" banner, and a tap cannot be ruled out. In the other five unlocks, no event concerning the database.

1 of 6 unlocks: run T3, cycle 3, device B, 3 Oct 2026

Open to interpretation

The app sends the device identifier (IDFV) to both services and $appTransactionId to Superwall. Whether the vendor reads them cannot be determined with this method. The policy of 15 October 2026 says the services "may process device identifiers".

IDFV equal in both services in 9 of 9 files with both fields / SDK code, D17 and D18

Open to interpretation

The vendor's assessment. In the app's code no limiting option is set, three available ones are unused and two expanding ones are enabled; most of the traffic has no switch in these SDK versions. The vendor states that the user currently cannot turn the event collection off.

config_attributes in 20 of 20 starts / SDK code / app's public code, 1.65.0

Open to interpretation

Depends on the definition. The App Store label itself declares the purpose "Analytics"; session and paywall events go to Superwall, as does demandScore, computed according to Superwall's documentation from the number of app opens and paywall views. The policy of 15 October 2026 has the heading "Upgrade screens and related analytics".

all 10 HAR files / D13 / Superwall documentation

Open to interpretation

No database content is sent. The app sends the IDFV and $appTransactionId, and Superwall returns a location derived from the IP address. Whether these count as identifying information depends on how they are classified. The new version of the article names device identifiers and IP-derived location.

all 10 HAR files

Open to interpretation

RevenueCat receives the IDFV with every request and, on first launch, an Apple AdServices attribution token, which the app has to switch on. Apple receives such values within its own store; here they go to two third parties.

6 first launches: S01, S17, A5 (2), A8, C8

Open to interpretation

The label lists one type, "Purchases" (subtype "Purchase History", purpose "Analytics", as the App Store app on macOS shows it). It does not contain the types that match Apple's definitions of Device ID, Coarse Location and Product Interaction, all of which occur in the traffic. Whether Apple's exemptions apply, the authors do not decide. According to web archive snapshots the label has not changed since 8 January 2026, including after Superwall was added.

label snapshots of 8, 9, 10 and 18 Oct 2026 / Wayback Machine, 2025 to 7 Oct 2026 / Apple, App privacy details (D19)

Open to interpretation

No access to GPS location was observed. On every start Superwall returns a country, region and city derived from the IP address, and the app sends them back in later events. The policy of 15 October 2026 says Superwall "may derive approximate location from your IP address".

20 responses with content in 9 files; the values are replaced with labels