Although heavily redacted, part of their claim is that US user data is stored on servers leased by a PRC state owned enterprise located in Virginia (China Telecom?).

TikTok has repeated said American user data is safe because it's stored in the US, and it would never give data to the PRC government. This arrangement could (depending on the specifics) be a circumvention around both of those promises.

Maybe it’s not nefarious, but certainly not good optics.