You have no proof that you aren't running a rootkit logging all your keystrokes right this second ;)
You have no proof that you're not living in the Matix right now!
^This disturbs me :(
Trust them with what? All you'd be telling 37signals with this is your development server's internal IP address and the names of any subdomains you might be using. No actual site traffic will go to them.
If they do switch where xip.io points, they could see what you're doing with your dev server if your local DNS lets the resolution expire.