Not true. The code is open source and everyone can trivially with minimal effort check that they are sending only the data they said they would send.