[nonane]

1. WebRTC is natively compiled into browsers. This app uses WebRTC's data channel to transfer files and WebRTC guarantees that the data channel is encrypted (via DTLS). So - tehcnically the crypto is not javascript based - it's native code similar to crypto over HTTPS.

2. WebRTC tries to create a P2P connection between the devices. The ISP is only involved in the initial bootstrapping of the P2P connection - the actual data packets travel over the LAN and not through your ISP. In the rare case a P2P connection can't be established, a relay might be used (though this is optional).

[erbbysam]

A minor note on 1. - rtccopy.com does use (optionally) OTR in javascript on top of the DTLS channel in order guarantee identity (something not currently guaranteed with the DTLS channel).