Mostly, but to be logically consistent I have to be even darker about it and say that any app on iOS or Google'd Android is effectively compromised. Even your desktop or laptop keyboard, as long as you type on it with microphone range of those phones, is having its keystrokes logged.

Correct that we host a PWA version or your can run it yourself locally from Github. Next version we'll probably push to F-Droid (I haven't been able to get through Google's retarded KYC process to get it in the app store)