My understanding of what you just said - status and contacts are stored locally, and the user will manually mark themselves as "infected" after a test. Presumab

My understanding of what you just said - status and contacts are stored locally, and the user will manually mark themselves as "infected" after a test. Presumably the receiver of that notification will have a local status saying "get tested". But when you mark yourself to infected, how does that resolve to notifications for all your contacts? At some point that must hit the cloud and fan out to everyone, meaning the contact list is shared at that point, and with a large enough network becomes identifiable info. Esp if you combine that with skimming contacts. Is the GDPR compliance and on the wire encryption what keeps it private?