> Then you are collecting emails to identify users. I use it to authenticate users. I don't use it to "identify" users. I give zero fucks about the identity of

> Then you are collecting emails to identify users. I use it to authenticate users. I don't use it to "identify" users. I give zero fucks about the identity of users. > In other words, you are explicitly connecting a specific device to a specific account on your backend via that email. No, because I don't collect any more data about the device, I don't link anything. Users use the app. They can use multiple devices. I know nothing about the devices and don't care. Users themselves link their account to their device (on their device), but I don't get any information about this. I posted this in another comment, but it makes sense here too: I find it odd that Apple didn't choose words that are already clear with respect to privacy laws such as GDPR. The GDPR doesn't talk about identity. It defines personal data or personally identifiable information (PII). If you collect this data, you're subject to GDPR compliance. Apple has a weird phrasing of this. You apparently can collect an email address, but not link it to an identity, which is different from collecting an email address and linking it to an identity. It's unclear to me what they mean by this and what "identity" is supposed to mean.