When a company, through an application or website, communicates any of your personal data to a third-party provider, this should be mentioned in their privacy terms.

In the case of GIPHY that you mentioned, they are sending IP addresses, which is considered PII (according to GDPR), and this should be outlined in the terms and agreed to by the user prior to sending the data.

Signal's privacy terms were last updated in 2018. We are in 2025 now. It is unimaginable for any operational organization not to update their terms for 7 years.

All together, this is what I call "unacceptably poor" in terms of handling users' privacy.