I don't think you can ever trust closed source software that also requires network for other features that it really does on-device processing for something specific.

It might not even send the sensitive data immediately but bundle it with other traffic once it goes online.