You're viewing a single thread.
Having an account registered to an email address and being able to post content is all that’s needed for these categories to be checked. Well, apart from the diagnostics.
The difference with Mastodon is that the third party server that you’re connecting to is handling this data.
If you compare it with an app like X, you’ll see that there is another category that shows which data is being used to track you, instead of just being processed for basic functionality.
They certainly don’t need the contact info
Your login is your contact info.
And, to be clear, that's collected by your Masto instance as well. Looking at the Android app right now it reads "This app may share these data types with third parties: Personal info". Presumably your login data with an instance, I guess?
That doesn't mean BS isn't storing more data about you, but man, people seem to assume Fedi apps are private and they really, REALLY are not. That's fine, it's not the point of them to be private, but something I learned during the whole Threads federation wars is that people assume their posts are much safer from mining than they actually are.
If you post anything online it should be under the assumption that it will be public and it will be traced back to you.
Just having a persistant, public user ID is arguably enough to tick the contact info box, it's very intentionally an oversensitive requirement. The idea, like california's lead-content warning, is to force so many things to use the label that it loses all meaning.