https://softwareengineering.stackexchange.com/questions/2905... http://web.archive.org/web/20130326235146/http://www.theeuco... Basically from what I can tell, anything you are using to track the user from your server you need to disclose. If you are storing identity info to allow the user to login that needs to be disclosed as essential.