I wouldn’t immediately assume malicious intent. Most likely a solo devs hobby project and they didn’t bother with a privacy policy. Nonetheless skepticism is warranted.