I researched a bit and apparently they had a bug which made the cloud sync leak the personal data of others: https://www.theverge.com/platform/amp/2016/7/29/12326152/swi...
That being said, using a closed source application packed with features (also known as "attack surface") as your main input method clearly isn't ideal.