It's on the person's Mac so it is a little more complicated. The person you send your data to is the Data Controller, and fails you by not publishing their privacy policy. But Apple isn't a Sub-Processor here, because they aren't sending the data to Apple.

I'm saying that because I wish the GDPR also covered the software providers who perform Data Processing against the will of all parties, but it isn't the case. Lastly, they're a person and not a business.

It is however clear that building a database of people which may contain race, religion or political opinions is illegal, even if it's just a person doing it.