> progressive web apps (PWA) as packages that can be shipped via repositories

Aah, wasn't aware this is possible now, thats cool.

But raises the question of how exactly to check and communicate to users what data are being collected.

With a PWA almost all of the code runs on the server. Even if that server is based on an open source project, there is no guarantee that there has been no modification (eg a plugin) that changes behavior.

Not sure there is a way to reconcile these demands in an automated way that doesnt ultimately fall back on trusting the developer.