It's client-side encrypted. So they are stored on their servers but only encrypted/decrypted on your client with a passphrase or key that doesn't ever get sent to the server.