It shows up when you allow the app to filter your messages in iOS settings: https://imgur.com/zPhUdnL

This feels like a case where it'd be good if Apple had two different messages, one for SMS filters which have a ILMessageFilterExtensionNetworkURL configured (which should get the scary message you saw) and one for those that don't (which are sandboxed to be purely device-local).

That said, Apple doesn't really handle the case of permissions changing with an app update very well, so launching your app purely device-local then updating to add something server-side a year later would probably let you get around that.

This app seems to not have the key that'd indicate it's capable of sending anything to a server: https://github.com/afterxleep/Bouncer/blob/master/Bouncer/In... (though, you know, that assumes that the build on the App Store is directly from the source we can see...)

Well, that's pretty troubling considering https://shot.3e.org/ss-20220910_115329.png

Isn't App Store review supposed to at least catch things like that?

It's a boilerplate warning that applies to the maximum possible amount of data-collection that could be happening. The app says it doesn't collect anything, and its source on GitHub supports that claim... but a SMS app theoretically could and so Apple warns you of the worst case.

That's the default. There is nothing lower than that AFAIK.

Maybe there's a specific legal difference between "receiving" and "collecting" data? ("Collecting" makes me think the data is stored somewhere else with a 3rd party)