> I don't think the intent is malicious, but the system is definitely leaky. My homeserver config doesn't mention vector.im (perhaps it's a hidden default somewhere?), I checked.

IIRC, identity server is something primarily set on the client (element.io here) rather than the homeserver.

It really needn’t and shouldn’t ping an identity server as part of the sign-in process (esp before/without privacy policy agreement)

FWIW it seems the issue is that there’s a fallback process for identity server; if neither your account nor your homeserver has one set, it defaults to the client default. if you host your own Element-web instance you can change this.

https://github.com/vector-im/element-web/blob/develop/docs/c...

Or check out ma1sd. You don’t need to enable all the bells and whistles if you don’t want to.