The crypto appears to be fairly standard - it uses NaCl's crypto_box to encrypt and decrypt almost everything, with a per-session keypair authenticated by the user's long-term key. Code quality is a bit OpenSSL-esque though.