Reading the article, they collect the data necessary to federate with an instance. If you or I were to run our own instance we would have access to the same data.

If they were to do anything with that data that they don’t have permission to do, like selling it. They would be in breach of the GDPR and fined 4% of their global annual income, and as we’ve seen with Apple, it’s not profitable to have two wildly separate versions of your product.