There is, or at least was, a notable feature that synced data can be encrypted with a separate password, client-side. I can't vouch for its strength, but it's there.