Reviving an old thread which I think is really important!
Looks like the contacts/calendar/tasks are not encrypted! They are stored in the “database” (which can probably be read provided you have access to the server (?)). Maybe encryption would damage compatibility with carddav…
See the short thread [1] and the github issue [2] for further discussion.