Does ColorNote secretly spy on me, like send those notes somewhere over the Internet without my permission?
Just to make things clear, when you install an app from Play Store or by tap and install you yourself agree to accept the permissions it demands including Full Network Access. So, this point of the app using Internet without my permission shouldn't arise, unless Android has native permission control/restrict system and app still violates it somehow.
Besides, those notes are part of the app too. It can exchange data on Internet if it is eligible and wants to, and I see nothing bad to do so at least for a closed source app!
Anyhow, the first thing before asking about spying is to check app's demanded permissions.
- If you have the app installed then go to Settings -> your app and see the permissions there.
- If you don't have the app installed then launch Play Store -> go to app -> and see Permissions. You can also use Web browser for the same.
See permissions related to Network/Wi-Fi and be warned (if it exists) from that time that the app may connect to Internet for something (mostly to fetch ads).
Is there a way to be sure or are we at the mercy of the app developers?
The defense against a closed-source software is to trust it and believe that it won't do anything bad. But much better is to use a Firewall, or not to let it connect to Internet at all.
You may also monitor network activities of the app and see the amount of data exchanged (you may see on-the-fly passing data if it's not encrypted).
If the app is open-source, then you may at least hire a code reviewer if you can't understand code. User reviews helps here better compared to closed-source apps.
Over and all, don't think much about spying and similar things unless your ROM is open-source and its code review passed as safe. Be wary of critical and big things first.