That's because otherwise the privacy property of the app hinges on a trust in vendor and the assumption that they won't serve some funny JS on the next page reload. The one and only way to address this is to provide a self-hosted, completely self-contained version. There's really no way around this. It's not a matter of encrypting things or storing them locally, it's a matter of divorcing yourself as a developer from users' data. Right now, it's a packaged deal.
PS. Looks very nice though. Clearly lots of thought went into the design and UX elements. This part is really well done!