I'm not labelling it open source yet, but it's vanilla javascript ran client side (the various encryption etc) so if you 'view page source' you can see the vast majority of the code and you can use network monitoring tools to see no data is being sent server side aside when logging in, 'heartbeats' for the active peer list, and the 'Ping' (push notification) feature for people using it as a progressive web application