Valid concern. I thought a little bit about this, but the only solution would be an e2e encryption (where the same person is both ends actually). And in this situation, you risk losing all your data if you forget your password. There is a solution that you can think with no such trade-off?

Create a file format for the data and connect to the user's Google Drive or Dropbox.

That's an awesome idea for this kind of applications. Does anybody know a sample app using this feature?

Just make it a part of the default UX flow to print out a paper key -- like the paper wallets that consist of a dozen random key words that let you back into your account.

I guess if the user accepts this risk they can opt to do it or go for unencrypted otherwise.

Saving on Dropbox etc (can be done from client) might be a middle road if one trusts them more.

Or a local app with the data stored locally. Or even a web based app, but with the data stored in browser storage.