What the server learns: your username, and nothing else - your password is never sent. It is used here to derive an AES-256 key via PBKDF2, under parameters this page chooses and refuses to weaken, and the key itself is unextractable: this page can encrypt with it and cannot read it. Every record you save is sealed before it leaves the page, and carries those parameters with it so your next device can catch up.