Proton's design is to only store your keys encrypted (by your browser or app) on their servers. The same privacy model you have with ProtonMail. The BDK based wallet code also runs locally in your browser (wasm) or phone app. The code is open source so you're welcome to see exactly how it works. Certainly a trade off of user experience vs security, but better than the closed, fully custodial systems out there.

GitHub

GitHub - ProtonWallet/andromeda: The andromeda libraries aims to provide logical blocks to build a privacy-focused, cross-platform, self-custody Bitcoin and Lightning wallet, integrated in Proton's ecosystem

The andromeda libraries aims to provide logical blocks to build a privacy-focused, cross-platform, self-custody Bitcoin and Lightning wallet, integ...