yes, even without KYC, one opsec fail and they can get quite a info on you, things like usage patterns and eventually potentially a profile, upon which will probablycreate a “credit score” of sorts and probably sell advertising data too because why not!?