fwiw I’m pretty sure in several countries it would be illegal for them to gather/sell your data if they’ve explicitly said they don’t do that. I might actually trust that fact more than I’d trust the code, since they could easily build from a slightly different code base than the one shared online, if they wanted.