There are some calls that joplin makes, one to download dictionaries, a few to github and github mirrors for plugins etc. and one to check if it is able to sync but it doesn't expose any of the actual data online.
This thread pretty much discussed all of this and why if you are interested.
You can also check the privacy policy