The climate activist thing they did pursuant to a warrant, which every company will do, and the only thing of interest they turned over was the person's recovery email...which was personally identifiable. From there the authorities got everything else. IIRC, they got access to the person's iCloud. None of the person's emails or anything like that was given out. If you are strictly concerned about privacy you shouldn't use a recovery email so that your login can't be tied back to you.
As far as the service, I am using Mail and Pass daily and like both. I use the VPN and Drive sparingly, but I have enough space on it to stop using my Google Drive. Calendar is useless for me because of the lack of CalDAV support... and also because I can't have many calendars on the free plan.
It hits the sweet spot between privacy and ease of use for me. YMMV.