At least they seem to have addressed some of the security implications:

The database will be encrypted at rest and will require authentication (and periodic reauthentication)

The feature will also be off by default

But of course, nothing on the front of whether or not Microsoft will collect data on you using it. We can trust them there, I'm sure.