Can they transfer any user data when I don't give them permission or is it just about the chat conversation which obviously they transfer??
They just have to pretend they didn’t know what they did and it’s legal.
The only way to not leak your data is to run it locally.