[mindfulhack]

This is probably off-topic but on a very broad level, from a privacy point of view I think it is important to separate 'service provider' (controlling the instance of your data) from 'software' developer / 'hardware' maker (controlling the mechanisms of your data privacy), no matter who and how open-source they are.

I'm not sure this instinct applies much to this situation, but it immediately came to mind. Vertical integration is where user privacy (from service providers) starts to erode.

Ideally, we should have competing but inter-operable service providers on common platforms and protocols which have nothing to do with the service providers.