Sync is optional*, end to end encrypted, and you can self host the server so you don't really need to trust anything if you don't want to

*: nothing syncs if you don't register, and you can even compile a version with the sync code flagged out if you REALLY don't want to trust anything