The "Privacy" link is generic and also doesn't explain anything.
How in hell do you think you can launch a social service without answering any of these questions in this day and age? Have you learned nothing from the Hello rollout?
https://github.com/mozilla/webmaker-android
[EDIT] - Had the wrong link up before, was to the repo for the website
Which is open source https://github.com/mozilla/api.webmaker.org
It's obviously not being stored on the phone, since it's meant for other people to be able to access. It seems unlikely that it wouldn't be mentioned if it were using any non-Mozilla hosting.
But maybe I'm wrong, and it's stored in an encrypted hash-addressed data store, where shared links include the necessary keys.
There are levels of security; it's fine for Webmaker not to be suitable for, e.g., human-rights activists in Burma. But it should not be possible for one data breach to reveal everyone's activity everywhere.