Since you have access to raw data as it is being encrypted, you can know what material is being uploaded. You could in theory maybe claim that data is encrypted on the client but it is your client served from your domain.

Right, since the client is served from my domain, trust in the code is essential. Encryption happens in-browser, and nothing is logged or intercepted, but to back that up, I’m planning to open-source the website in the future so anyone can verify exactly what’s going on.