Don't forget you are still using their binaries on your phone and running their binaries as your server even when you self-host, let's be frank: very few ever do. In my opinion NOSTR has far more verifiable security and privacy than SimpleX for the reason that the protocol is like email, where you can quickly write your own implementation for both the client and the servers while you can use hundreds of volunteer-run servers today and now. The encryption algorithm used on NOSTR provides solid privacy since 30 years. Those things make NOSTR a far more solid choice. I'm picky so I'd prefer to see NOSTR relays being able to fetch notes from each other when they have people interested on notes from a specific user and this would eliminate the need for both users to visit the same server and therefore make even harder to trace IP addresses. Another thing is that I2P should be the standard on safe/private communication between relays and users. These are small things with already existing tech that have more privacy than any solution provided by a single vendor which receives funding capital investors in the US which are there to make 10x profit for every dollar they put inside.