I share some of these concerns. While on the Matrix website and in presentations the words “End-to-End” and “Encrypted” are used frequently, the statistics draw a different picture (source):
Also I currently get the impression from the Matrix blog that fancy features, UX improvements and bridging between different messaging silos (WhatsApp, Telegram etc), have higher priorities at the moment than laying the foundations for a truly decentralised identity management (also see the “needs” here from less than a week ago).
Another interesting fact are the permissions the Riot.im Android app currently requires:
android.permission.INTERNET
android.permission.VIBRATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_CONTACTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_LOGS
android.permission.REORDER_TASKS
android.permission.GET_TASKS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.MANAGE_DOCUMENTS
android.permission.WAKE_LOCK
android.permission.RECEIVE_BOOT_COMPLETED
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
com.majeur.launcher.permission.UPDATE_BADGE
android.permission.BLUETOOTH
I understand it is still very early days for the Matrix project, so I hope that these things will improve significantly until the completion of the Librem 5. I also think we need to keep watching this space and keep asking for privacy if the situation doesn’t improve by itself.
As for the term “collect” Riot.im is using in its privacy statement, I think this just means that they get access to the respective data and may store it. Considering that they have the ability to bridge between messaging protocols, that’ll probably also mean they have (need) access to a user’s other instant messaging accounts… so users intending to use this feature may care even less about their privacy/security; something I do not understand at all.