Not really, they are testing your passwords against have I been pawnd. I agree that transparency should apply here, and also an upfront question to skip.
But it’s not “unsafe” or a privacy breach per se. No password has actually been “sent” anywhere only a partial hash that is useless for accessing your home assistant.


Reverse proxy my friend…
Using one static IP per service feels so much like … 1990s…
… As well as owing a /24, I admit.