The source code for PureOS is available here: http://repo.pureos.net/pureos/pool/main/. Digging in the source code and\or installing the distro and analyzing network traffic are\is the best direct ways to determine distro security.
For most people this is not feasible so we'll have to adopt a heuristic approach.
PureOS is based on Debian, which has "many eyes" on the code, and although derivatives can theoretically make any modifications they want, with the code available and things like FSF compliance reviews occurring, while not impossible I'd say it's unlikely this distro is an exceptional threat to your privacy.
There's some recent-ish activity on the bug tracker: https://tracker.pureos.net/, which is a good thing. It might seem scary to see this big list of bugs, but with millions of lines of code in a distro, every one has 'em, and active attempts to eliminate bugs are a better sign than inactivity (which indicates indifference).
Unless you have exceptional security needs that would require a "hardened," security-focused distro likes Qubes, my bet would be PureOS is fine. Plus, it's main selling point is "All free software" so there's no undecipherable binary blobs in the thing.