In regard to selling the data, I've seen businesses where they sell user info just as a side project to balance the sheets. It will b an issue only if one is caught. Somewhere there I looked around the website but I couldn't even find where is the HQ and under which jurisdiction they operate. The privacy policy had lots of technical details, but not legal one.
It would be interesting if like Signal they can validate an user but provenly cannot associate the account with any actions. This might be an issue for billing and tiered plans though.