Very good question. Your private key and repo passphrase are encrypted then stored in keychain to keep it secure. We understand those are credentials and very important, it never leave your device, it's your responsibility to have a strong device password to protect your device. The app only communicates with your backup server, we don't collect any data to avoid extra communication to other servers and bring concern to our users. You can also check our privacy policy in app to see how we respect privacy and no data was collected. Next release we will also add threat modeling to clarify the data flow of app and app risk analysis.
You can verify the server app contacted by go through System Settings, App Privacy Report, App Network Activity, then find BorgLens, it will list all the domains contacted by BorgLen, you should see your backup server domain only. There maybe some subdomains from apple.com due to system functions.
For any questions or support can reach us through in app support.