Hi! That's a great question.
JRNL was designed to save entries in a plaintext markdown language. All Entries are saved within a folder called "JRNL Entries" within your documents folder. While the files have the ".jrnl" extension, they are no different from ".html" or ".md" files. This allows them to be readable by the user even after they choose not to use JRNL (in another viewer like https://markdownlivepreview.com/).
That design, as well as my lack of knowledge on encryption, mean that your entries are only as secure as any other text file in your documents folder.
When it comes to online data, there are no metrics or data that I receive. While I honestly would love to have analytics data from users, the application never sends your information to me. I also use a number of code libraries to assist with development and I trust those packages to also not collect user data, but I am not 100% confident to explicitly state that they won't.
I hope that clarifies things,
- Saul