Proton's design is to only store your keys encrypted (by your browser or app) on their servers. The same privacy model you have with ProtonMail. The BDK based wallet code also runs locally in your browser (wasm) or phone app.
The code is open source so you're welcome to see exactly how it works. Certainly a trade off of user experience vs security, but better than the closed, fully custodial systems out there.
