I don't see how with that arrangement they could guarantee the app is also not collecting and uploading data in addition to the data saved on Microsoft's server

I don't see how with that arrangement they could guarantee the app is also not collecting and uploading data in addition to the data saved on Microsoft's servers. It would come down to trying to prove a negative which is not really possible outside of trivial cases. The only way to make that arrangement work would be to give Microsoft access to the source and ability/responsibility to review the source/releases. Not exactly a great Setup for either party.