After peeking at it in Mitmproxy, I found out that it not end-to-end encrypted.
Current kb article: http://web.archive.org/web/20240621214336/https://culturedcode.com/things/support/articles/2803605/ Past kb article: http://web.archive.org/web/20201111212426/http://culturedcode.com/things/support/articles/2803605/
This part of the documentation was present in 2020 but removed at some point: