I’d second this. The organization behind it (https://calyxinstitute.org/about) is a long established non profit, their portfolio covers various cool projects. The vpn client itself is basically a rebranded version of https://f-droid.org/packages/se.leap.bitmaskclient, it it is nothing special.
Agreed. From a privacy perspective, it is a lot safer to run the app in an environment where you have admin control. E.g. disable when not in use, block access to sensitive device information, limit background and network activity as much as possible.