I'm not 100% on the encryption scheme BBM uses, but currently all communications for Flip, between the client and the server, are done over https (which was a pain in the arse to get approval for in the App Store).
Also, every request from the client is authenticated with a key generated on the client side, and both key, phone numbers, are encrypted and salted on the server side.
From what I understood, for a long time whatsapp was plain text communications, and I remember there being a debacle where whatsapp passwords were just device UUIDs, which weren't encrypted or salted (so I made sure both these weren't the case with Flip).
As for Flip not being on Android, yes unfortunately I haven't had time to implement an Android version. I work full time, so it's taken me close to 9 months just to get the iPhone version released, so I'm hesitant to spend more time unless the iPhone version does well (and besides, Instagram was iPhone only for a long time :) )
Thanks Jerrold