I recently watched a digital security training and I learned a few things about the software that I use on a day to day basis. One of the links listed for further readings included this link Beyond pen and paper: Secure note-taking apps for journalists.
Joplin has geo location information enabled by default and sync is not encrypted end to end by default.