Protected customer data handling

[SteveF13]

We have an app I'm working on that will need access to protected customer data, including name, address, phone, and email.  We intend to make this available to many customers as an unpublished listing on the app store.  By my reading of this page, that means we _are not_ considered a custom app.  Presumably, since we would be in the app store, we therefore would be required to implement support for the mandatory webhooks.  Can anyone confirm this for me?