OK, but here’s something I don’t understand. You said, “The NIP05 should only be created if one does not exist.” Even in that case, why would the app be designed to make that change to a user’s profile without their consent? Signing into an app does not automatically mean the user intended to change their profile to advertise for your brand. You have to be transparent about this and ask them if they agree to this first.