ok ive dug a little in github and yes, alby extension is encrypting with password and only storing to browser.storage.local so then it should only cross via cloud sync of the browser which is out of albys hands