A look at their privacy policy by Mozilla was something of a mixed review. (https://foundation.mozilla.org/en/privacynotincluded/steam-d...). They said the policy didn't raise any huge privacy concerns, but that the policy was vague, Valve was unresponsive to questions ("We emailed Valve three times with our privacy and security questions and haven’t heard back from them"), and that ultimately Valve reserves the right to collect and share (read sell) "anonymous" data, aggregated or not, with third parties.
I expect them to track what games you play and when, but what about desktop mode? If you run applications or browse the web how much of that activity is collected by Valve? Anti-cheat software works with the steam deck and that too is often highly invasive recording files on your system or other running processes.
The device also comes with two internal microphones, and I'd probably want to remove them (hopefully that's as easy as it is for PS5 controllers) and has bluetooth which is hopefully easily disabled while traveling.