It's fine that the app on your phone can read your messages, for that reason. It's not fine that it can then send them to its developer or anyone else. (I know it claims it doesn't. My point is that it can, so you have to trust that the developer is telling the truth, and that an update will never make it start to.)