These devices trade convince for privacy.
The minute you allow a device you do not 100% control to send data to a service provider, you should not consider that information private. The service provider has no legal obligation to keep the information or data private- I assume somewhere buried in the Terms of Service it says as much.