Can Android phones restrict background syncing to secure WiFi connections?
In general, you should never assume that any internet connection is secure. Not even if you owned the hotspot. Internet is built under the assumption that intermediary links are unreliable and not necessarily trustworthy (not even your service provider or the backbone operators should be considered trustworthy). That's why we have developed various authentication and encryption protocols which can ensure secure communication through these untrustworthy channels.

In short, use HTTPS or SSL when accessing informations that you don't want anyone snooping on and do not use apps that do not use HTTPS/SSL. Gmail always uses SSL when communicating with Google servers, although last time I checked not for Calendar or Contacts, though this may have changed since then.