@tinker basically, it communicates with a server hosted in the US, where it sends at least:

- every public toot seen by the app
- every OAuth token of its users