The other interesting thing about Brutaldon is that it doesn't seem to store any user data in the local SQLite database. I'm poking around in there and only finding the access token and session tokens.
So it seems to act as a simple proxy – fetches your data from the Mastodon API, then immediately forgets it. Good from a privacy POV!