Thanks! The secret client key stays in the browser or app. It's used to encrypt queries, and decrypt the server responses.
And how is the data that was initially written encrypted/decrypted? who holds the key for that?
And this depends on the application - for example, for the private password checker, all the dumped passwords data is from a public dataset, so its not encrypted. In messaging, the data would be encrypted under the intended recipient's public key.