I found a well-done blog post on this topic here:
Since the GDPR text is fairly ambiguous, as this blog post notes, determination of territorial scope requires an interpretation that may be different among reasonable people - so your mileage may vary.
The most salient text of this post is this (but the whole post is worth reading):
- Is the language of an EU Member State used if it is different from the companies language?
- Does the website or app offer payment options in the currency of the EU and country in question?
- Does the website appear on a country-specific domain associated with the EU such as .uk?
- Is language on the site or app directed at an audience of a country in the EU?
- Does the company use advertising targeting an audience in the EU?
- Does the company offer customer support phone numbers to an international audience?
If a commercial website meets none of these standards and has a few
incidental sales to people in the EU over the years or has a few
EU-specific email address on its mailing list, it is difficult to see
a court requiring GDPR compliance.
For me, with respect to my specific question, it seems that a fair extrapolation of this guidance is that GDPR applies if you expressly make your software available to any country in the EU.
For iOS, this would mean making your software available in EU App Stores - denoted by marking your app as available in an EU "territory".
But again, this is just my (non-lawyer) interpretation.