I also use the web interface and I believe it tethers your phone to the browser - so the phone is sending the unencrypted messages to the browser window.

If you delete a message on the phone the message disappears in the web interface too.