Indeed. More like, the person that has recorded your encrypted message probably won't be able to read it until they're able to get a hold of the session key, perhaps by gaining physical access to yours or the receivers phone, or by installing malware on either phone, or because of a flaw in the (p)rng that was used to generate the key.

It is open source, so at least it is trivial to create a clone that interops flawlessly, while copying off plaintext to a third party (That's not a flaw with the project as such, but it is a risk with using "security" software in general -- how do you verify the security software? In some ways this is made worse by app stores -- because they delegate trust away from the user and into obscurity; the appstore assures you that the app you installed is the app someone uploaded -- not that it does what you think it does).