Yes, absolutely. This is a classic man-in-the-middle attack. All traffic (encrypted or not) runs through the server before being passed to you. It would be trivial to read (and modify) unencrypted traffic (so anything over HTTP).
HTTPS is different. As long as it's not a web based proxy, I think you'll be fine as long as you check the certificate is correct and valid for the site you're visiting. This is because to view your traffic, they would have to be able to unencrypt the traffic and then reencrypt it to you. This means they would have to present you with a certificate signed for a domain they own and not signed for say, https://Google.com.