If it was all running locally, I could see someone getting away with it, possibly. At this point, it's just a tool?

Yeah; self-hosted and open source I would be more open to it. This is just kinda sketchy.