I would hope that they add a clarification in that page because if I did not contact them then I would not have know about the sync feature and also would not have thought anything about GDPR issue. This is just a reminder note, not saying that Postman is hiding about it.
So I guess the story here is: if you use postman for anything sensitive don't use an account as well, as the sync feature can no longer be disabled.
It's also worth pointing out that AFAICT Insomnia's equivalent feature may be more secure though I haven't dug into it: it sounds like all that data is encrypted by the client and not recoverable by the Insomnia team if you lose your password.
I had a feeling of a twist just because initially I found https://support.getpostman.com/hc/en-us/articles/203815791-W... which gave me impression that they do not collect payload under any circumstances.
I would hope that they add a clarification in that page because if I did not contact them then I would not have know about the sync feature and also would not have thought anything about GDPR issue. This is just a reminder note, not saying that Postman is hiding about it.