Riot only ever talks to identity servers (which simply maintain a directory of matrix users by phone number or email address) if you actually try to look up a user by one of those identifiers, and if you actually opt in to it. We used to do it without opt-in when you searched, but this was fixed at https://matrix.org/blog/2019/09/27/privacy-improvements-in-s....

For Push, whatever app you use needs to have a push server that talks through to Apple/Google if you use their push. For Riot, that server is run by the New Vector (vector.im), the outfit which makes Riot.

The network traffic should make this very clear.

It does not appear that your statement is accurate.

I just fired up Riot 1.6.2, the latest available from the site.

It makes three connections, one each to matrix.org, vector.im, and riot.im on startup.

Even after removing application settings and preferences, it connects to all three of those on startup, just sitting at the login screen, not signed in to anything. I didn't opt in, and I didn't look anything up; it was automatic (and silent!) on a blank install.

That's completely unacceptable, and counts as telemetry to three separate parties, whether intentional or not.

The local app should not send any traffic whatsoever when launched and sitting at the login/signup screen. It should make a connection to the homeserver chosen to log in to, and that server alone.

I just filed it as a bug again: https://github.com/vector-im/riot-web/issues/13942

Okay - thanks for refiling and spelling it out; it's a legit thinko which we're fixing.