nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqh0dld9ztskh70gyk4waknsd26fmhpjvfsxzksatpjmaka00syqaqs8dey5 (nprofile…dey5)
In the browser, in IndexedDB (one store per account), kept encrypted with a non-extractable AES-GCM key, and wiped on logout. The server only ever sees public keys and encrypted messages, never private keys.