This was prior to their bad press so it was not obvious to me at the time. I think I saw they used anonymized data from commercial emails which seemed like a reasonable tradeoff given the state of things. My mom does not use email for personal data - it's primarily just subscriptions and the account had become unusable.