> or email addresses (for a sign-up flow)

How does this comply with privacy laws/requirements (e.g. GDPR)? Storing PII is a liability and you expose yourself to legal risks.

Edit: Just to clarify: it's not an aggressive question, I'm mostly curious what is your strategy about this.