(Note: I have an iPhone and so can't test it myself, but I can read the client js code) My guess is that they are routed through the phone. That's certainly something that Apple would have a hard time allowing which might explain the android onlyness. They are clearly using WebSockets and the phone receives messages but only in so far as the phone. For a E2E encryption they would have to routed through the phone, which it seems they are from the look of their code. Again only guessing, someone should packet sniff it and lmk.