Threat models matter.
When a platform/service/app tells you they are “private” or “secure” always ask “from whom?”
Criminals, domestic abusers, law enforcement, data brokers, and intelligence agencies are all different attackers with very different capabilities.
Follow
A good start is source code and a FOSS license. Unless it has both I don't trust it at all and look for other options.
