Re: The first thing we do, ...
0) What is the data use policy and consent being collected? Because the best case of the software audit is finding it upholds that, but you still have to ask what is going to be done with it.
Right now many people seem to be of the view that they'd be willing to compromise their privacy temporarily to help stop the spread of coronavirus. That's probably a reasonable and responsible choice. It would be quite wrong to take advantage of that altruism by conning them into accepting permanent retention of their data, or quietly continuing to track those who forget to remove the app after the crisis is over, or collecting more data for other purposes than is needed for coronavirus.