No data collection for any other reason than security practices, and for reasons that pertain to public security (not necessarily legal). A 30 day retention policy would be more than enough. Without discovery, public profiles, advertising and usages targeted towards you engaging more with the platform, the data collection and telemetry becomes quite unnecessary.

If you are paying for the usage (mostly server and development costs), your data need not be used for anything other than actually improving the product and security.

Currently the data is purely to extract profits and keep you hooked. This is what they have made you believe social media is about. Its not. You aren't hooked on iMessage and FaceTime scrolling reels and wasting hours. It's actually used to connect with people.