The author provided no evidence and it passed the Debian project auditing process, among several other distribution audits. I specifically mentioned Debian because their standards for privacy and open-source purism are just sightly below Richard Stallman level. Believe me, someone would have complained about it by now.