> If I want to put an open source app in the App Store, that’s not a business model for me. It’s more just personal expression.

Try convincing a regulator of that.

But it doesn't matter, you're still logging PII. GDPR doesn't make any distinction of profit vs. non-profit vs. personal ownership. You're as liable as an individual as an organization.

Your personal expression is writing the open source software and putting it on GitHub. However, once you make it available as a service, you should be responsible for it.