You have to trust and/or monitor and apply active pressure to (something that virtually nobody does) the developers to some extent either way. The difference wi

You have to trust and/or monitor and apply active pressure to (something that virtually nobody does) the developers to some extent either way. The difference with a paid distribution is that there's at least some revenue that helps keep the project afloat, and with a free distribution there's not. e.g. if you have a CEO/lead developer that's initially acting responsibly, but has a "bankruptcy threshold" beyond which they'll start selling your data, a revenue stream will stave that point off.