It is local, the program use a sqlite db locally and does not talk to internet whatsoever.

In that it's not necessarily different than writing your todolist on a notebook - someone other than you could have got hold of that and read it - say if it's on a shared shelve.

I think GP isn’t complaining specifically about this program, but about others which may hang around and access this data. Notice that recall is specifically mentioned. I think the issue is more with the general lack of separation between applications’ data.