Your nsec stays encrypted on your device. Right now it's basic encryption in the app sandbox (each OS does that slightly differently) but I think it's still quite safe. Soon, it'll use the OS's secure storage instead.