That's a good question. Our storage is in local indexeddb. And the site is https, so no one should see your flow if you don't share it. That said there's nothing stopping you from reaching out to another secure service or plugin before making requests.