I get your point on collecting data information, but the only data ive seen they are keeping is my name. 
What about KYC? is it not mandatory or is it only recommending to pass?
you all use a mobile app to mine Pi (even if there nothing similar to mining). You give this app permission to have access to your mobile device, where it can very easily pick up much more data than your name. but I guess you already know that.
I am surprised that they did not take advantage of the DeFi moment.