Just let the user create something and make his creation dependent on the software. Then update the software to lock itself, unless he gives personal data/verification. Never trust auto-updates, literally a ticking bomb which will eventually turn into spyware if not already.
I mean, yeah. Generally, this is how it works. This is why you audit stuff you pull in, and at times locally fork to rip out telemetry, etc.