[dastx]

> However, they know the encryption keys...and so will any attacker.

I might be mistaken, but my understanding is that they encrypt your encryption keys using your password within the browser. They only store the encrypted blob and thus they are unable to decrypt any emails.

Having said that, since emails come in unencrypted anyway, they can, in theory, log everything there. Including the sender, receiver and what the email contains.