Data is encrypted (or not) by the client. The server is a zero-knowledge sync service.

I have an open source client that does client side encryption. I hope that once released people will use it, or ideas from it, to create their own clients.