The connection from your phone to the cloud server is through secure channels, the connection from the device to the cloud is currently not secured, though someone would have to know your 32-byte authorization token in order to cause any problem. For that reason, the authorization token should be kept for yourself.
If you don’t want the cloud connection, you can disable it by setting ‘accessibility’ to ‘Local only’.