The passphrase is the key. Everything you see is ciphertext from a public GitHub release — your passphrase decrypts it in your browser. Nothing is uploaded; nothing is stored.