That is quite the assumption. You may wish to check it.
Also a GDPR statement to that effect delineating the data, which is being collected and how it is to be handled rather than "IDk, keep it on a server in Germany?" Might be helpful.
Secrecy around a project that will be scraping people's profiles on an "opt out" basis seems... sketchy.