I’ve been using Microsoft todo for a good while now after failing to find any decent private todo tools some while back. To my disappointment, there seems to be nothing much, perhaps with this one exception.
Everdo is one I recently ran into. It is focused on a the “Getting Things Done” Methodology, but if you are uninterested in that you could presumably ignore the extraneous stuff. It offers a local-network sync (pretty unique) as well a hosted E2EE (if I read it correctly) cloud sync service. You can see more here https://help.everdo.net/docs/sync
Privacy policy seems fine https://everdo.net/legal/#privacy-policy
It is local first, albeit on some internal database, not local files
It fails to include a libre software license text file, like AGPL, so we don’t control it, they do. So, how do you ever expect to enforce your privacy when it’s their computing, not yours?
I have a bit of a different set of standards than you.
(I was typing a longer answer but this is an old argument)