... or so they say. I do happen to trust them (and use them), but they absolutely could read your files if they want to: all they have to do is release an updated version of the sync app that does save your password when you first sign in. Or they could start saving passwords when people sign in via their website.

Now, I don't believe that they'd do this maliciously (rogue employees aside), but there's always the possibility that a government agency could secretly require them to actively try to capture a particular user's password the next time they sign in.

If you enter your password into a system that they control at any time, they have potential access to your files and can be ordered by the government to change their code so that it does collect your password in order to enable decryption of your files.