Fuck AI

Like most things by Proton. The client side service is usually open source, but not server-side. I use & even pay for some services from Proton, but honestly they could probably decrypt your data if they had a reason to. They do pilot tests all the time. If you use Aurora Store, you'll frequently see some Google Play accounts get different versions of the app that haven't been rolled out to everyone.

I've noticed several times the "open-source" app on their GitHub is multiple versions behind what they're publishing on Google Store. I don't know of anyone doing automated testing for all the unpublished versions. If you use the browser—since the encryption is handled via JS—all it would take is a few small changes to get the information needed to decrypt your data.

There are some alternative open-source bridges for Proton that solve some of these issues, but most people using Proton are just using the stock apps. If you use Proton then you're prob. doing a lot more to protect your privacy from advertisers, but if you think it'll protect you from the government spying if they have a reason, then you might want to think again.