Comment by kaashif

I doubt the guy is malicious, but it should really be obvious why people are nervous about this stuff. If I put a password into a home automation tool, is my default expectation that it's going to phone home and send any information (even if it's just a bit of information about a hash) about my passwords?

Which option will minimize the feelings of betrayal and violation: making this feature opt-in or opt-out?

Any level of understanding of humans will produce the right answer.