Tailscale is open source. Your data might route through their servers (e.g. STUN) but it's E2E encrypted, which you can verify easily.