I would consider this more of a privacy issue than a security issue - but something that should nonetheless be communicated clearly to user. Maybe these terms don't seem worth differentiating, but I see privacy as "what info do they collect" and security as "how safe do they keep my info, after they collect it".