Reply from MetaMaskDec 1, 2022
Infura needs an IP to send requests back to your device. It needs wallet address to provide balances, etc. I suggest reading from the source, before articles that make money from ads. (those sites tend to log and sell your information to advertisers) https://consensys.net/blog/news/privacy-policy-update/
*edit* Not trying to lecture, sorry if that came off as combative. Certainly wasn't my intent. As a lawyer, you understand the importance of reading from the source, before second-hand accounts. (we live in an age where the majority cant be bothered to read past the headline anymore)
Any RPC will need, at bare minimum, an IP and wallet address. (depending on the specific query, I suppose. A wallet address is only nesc when querying info about that wallet. Balance, tokens/NFTs held, etc) so unless you are running your own node/running a full node wallet, you have to trust the provider that is servicing it to some extent. (only requires a rasberrypi4, 2tb SSD, and an internet connection to run your own)
You can use a VPN to obscure IP info, unfortunately "DIY" is the only option available to those who also wish to obscure address info from service providers like Infura/etc. (worth noting wallet addresses and contents are public, and a vpn is enough to address IP/wallet address linking concerns, assuming you trust your VPN, of course)
To help address these concerns at the higher level, we're working to build a decentralized Infura ecosystem (https://consensys.net/blog/press-release/infura-announces-plan-to-foster-a-decentralized-infrastructure-ecosystem/) Our CEO has thread on Twitter that goes through some of the points on the Privacy Policy: https://twitter.com/ethereumJoseph/status/1596198718339948552
TL;DR: We don't want data that isn't needed for the specific services you're requesting, and we don't want to keep it longer than needed to perform the requested operations. Keeping it makes us a target for malicious actors looking to monetize it.
