Cake's Lighting support is (as far I understand it), dependent on LightSpark's API -- so LightSpark (a Lightning "compliance" company), gets to suck up all of your transaction data and associate it with your IP address. There is some discussion of this here, where the creator of Cake seems to say "it's ok, we trust LightSpark with our user's data": https://github.com/buildonspark/spark/issues/64