Great question! I'd never actually checked, but opening up the SQLite database, it looks encrypted. I see a table `batch_upload_items` full of ciphertexts.
I'm running the old Python sync server for the time being.
Sync can be self-hosted but the equally necessary auth-service is centralised at Mozilla. This does not make sense from a technical perspective and is reason for me to not use Firefox sync. I used to run is predecessor and liked the services it provided so I'd like to run the whole current stack as well but alas.