We use Apple’s iCloud for sync. Apple encrypts all data in iCloud, so someone can only access your data with your Apple sign in.
As you point out, you have to trust Apple, because they do hold the encryption keys. Apple can access the data themselves if they need to, but hopefully that is very rare.
If you want stronger encryption, that is possible: You can choose the sync service “iCloud (E2E Encrypted)” inside of Agenda. If you do that on all devices, Agenda will store your data in a special place that is covered by Apple’s Advanced Data Protection (ADP).
To get the full encryption, you do have to turn on ADP on your devices in the settings. However, this should not be taken too lightly. Doing this means the only way to decrypt the data is a local device — Apple no longer have the keys. If you somehow forget how to sign in, all your data is effectively gone. So think it through carefully and take precautions.