Which this looks like it can be.

If you don't provide consent for the app stats, and don't create an account (which you don't actually have to) they don't have a basis to track anything.

Basically, what you want to look for in GDPR compliant privacy policies, is "we don't keep/use the data".

That's because of how GDPR defines "legitimate interest".

If you have a website, or handly ANY traffic, at all, under GDPR you actually cannot legally claim something like "we don't collect your IP address". Unless the user is behind a VPN, your server does at least for the duration of a users interaction, technically, know their IP. Which means you have to state you collect IPs as defined by "legitimate interest".

You can only then add that you don't do anything with that data. Which this privacy policy does do.

Basically, everything under "legitmate interest" is just "this is how the internet works" or otherwise self evident stuff, like if you write your email in a contact form, you're providing your email for the purpose of being contacted.

Everything that does not fall under "legitimate interest" under GDPR requires "explicit consent" meaning no such piece of data can be gathered without giving the user an explicit readable prompt, that either explains what is happening or links to the privacy policy.