The encryption protects the stored relay log and passive disclosure of the server's data (a database dump, a backup, a log file).
It does not protect against a malicious application server (the server ships the JavaScript and could ship code that reads the key), a compromised phone, a browser extension, or the other participant.
What the server observes: for every frame, the ciphertext, its size, its timing, the room id, the frame type, the sender role, message ids, counters, epoch and sequence numbers; per connection, the IP address and a per-room device id; per clarify call, the plaintext of the message, the language pair, the relationship and address context, and the user's shorthand, all of which it can correlate with that room's ciphertext traffic.
The model provider sees the same clarify plaintext and retains it under its standard 30-day policy.
Each phone holds a decrypted copy of the conversation.
Anyone holding the full invite link, including whatever channel the link was sent through, can decrypt the room's history, join it, and clear it.
The server, or anyone holding the room's join credential, can force a clear and wipe both phones' mirrors.
Clearing deletes the server log and the phones' mirrors; it cannot recall copies, screenshots, backups, or provider-retained requests, and an offline phone is not cleared until it reconnects.