I'd say probably best to not trust apps at all. You could roll your own Matrix instance for example, but then who's to say that the client applications don't comply?

Trust no one, I suppose.