alt Hacker NewsIt is local, the program use a sqlite db locally and does not talk to internet whatsoever.
In that it's not necessarily different than writing your todolist on a notebook - someone other than you could have got hold of that and read it - say if it's on a shared shelve.
I think GP isn’t complaining specifically about this program, but about others which may hang around and access this data. Notice that recall is specifically mentioned. I think the issue is more with the general lack of separation between applications’ data.