Right, since the client is served from my domain, trust in the code is essential. Encryption happens in-browser, and nothing is logged or intercepted, but to back that up, I’m planning to open-source the website in the future so anyone can verify exactly what’s going on.