I thought this sounded familiar. Combined with the acquisition of Fitbit by Google, for IoT devices you should therefore not only consider the current owner and its policies, but also future ownership?
This will make it even harder for me to buy anything from an IoT startup.