After plugin activation hook

In the context of official plugin repository this is very explicitly forbidden by the guidelines (emphasis mine):

7. No “phoning home” without user’s informed consent. This seemingly simple rule actually covers several different aspects:

  • No unauthorized collection of user data. For example, sending the admin’s email address back to your own servers without permission of the user is not allowed; but asking the user for an email address and collecting if they choose to submit it is fine.

https://wordpress.org/plugins/about/guidelines/

Other than that it will risk you reputation (imagine what user will really like discovering you did it?) and might have legal implications.