Oh -- but also -- if you pay a Lightning invoice -- even on Coinbase... they CAN NOT and DO NOT know the recipient of that invoice. (Unless, of course, the recipient is LightSpark, Coinbase, or I guess another KYC-oriented company, and they share data.)
Great minds like nostr:npub1yxp7j36cfqws7yj0hkfu2mx25308u4zua6ud22zglxp98ayhh96s8c399s have spent years explaining this -- the Lightning Network, used properly, is a privacy superpower.
I fully accept that Spark (and probably Ark?) just aren't good for privacy. And that's cool and 98.5% of people don't care and it doesn't matter. But it should also be DISCLOSED to users. Lightspark should put this on their docs page, just something like "All payments made through Spark go through our servers via a GraphQL endpoint."