It seems they are at least aware of this, as their repo page says, "Privacy-focused: Your data is stored locally on your device, and you have the option (soon to be implemented) to encrypt it with a password for added security. No cloud integration is required." So, it appears they haven't implemented security yet, but plan to.