Yes. Just because the app is hosted on a google domain tells us nothing about who developed it, what their intent might be, what data it might be gathering as/when you log in,...

It's basically a black box, and any suggestion that it ought to be trusted "because Google" is naive in the extreme.