True, unless it's open source and maybe self hosted.

Edit: Nevermind, I'm right, I have no confidence in my own intelligence lol. If the key is on the phone and the phone stores the encrypted data to the server, that'll be secure