The
Landscape

How did we arrive at these results?

We ran several AI agents and human researchers to find out who owns, manages, and builds each app, using publicly available information such as websites, EULAs, terms of service, or privacy policies. Every source consulted is on the app's dedicated page, with the day it was read, ready to be fact-checked by others. Protocol is who writes the rules; shared services are the parts of the wider network, run by someone else, that the app relies on to work.

Servers and edges were also directly measured. Between 24 Sep and 18 Oct 2026, each host was resolved, and the network answering for it was named, along with the company behind that network. What a privacy policy says and what the network shows did not always agree. Where they differ, both were recorded.

The questions are read the same way, from each app's terms, privacy policy, help pages and, for the listed companies, their annual reports. Each has a closed set of answers, so the apps can be grouped by any of them, and every answer is on the app's own page with its sources. Three labels mark what is missing, the same everywhere: None, where an app has nothing at that layer; Not disclosed, where the company does not say; and Not established, where the sources did not settle it. For size, we use the monthly EU figure the DSA requires very large platforms to publish; for the others, it is whatever they publicly state, even if we could not verify it ourselves.

Two conventions are ours. The W3C counts as an international body — for example, for a protocol like ActivityPub — not an American one. A European subsidiary of a US group that holds a layer for someone else, as AWS Luxembourg does for wedium's ID checks, counts as American because US law reaches it. Europe here means the EU, the EEA, Switzerland and the UK.