The data is stored in Firebase, they are protected by https encryption in transit and firebase encrypts them at rest. Like most cloud services, I can access the notes but it is my policy never to do so and I never have.
I'm hoping to implement a full offline mode and end to end encryption in the future.