The client is open source, so it doesn’t matter what the server code is, you can see everything the client sends and therefore tell what possible data is being collected.
It’s run by a non-profit so there’s no shareholders to please.
Your messages and decryption key are not stored on their servers.
It’s been independently audited.
They have publicly posted responses to user information requests where they only provide the account creation date and last access time.
The (admittedly incompetent) US government recommends using Signal (for non-classified information) and top officials have been caught using it (Houthi Working Group).
You can never be 100% sure, but it appears to have excellent security and privacy.
I solemnly swear that even in 26.3.1 it is not reading my keypresses properly.
I used to type like a fiend but for several years the typing experience is degraded. Is is multitouch somehow trying to read something between my two thumbs?
Also that period key that appears when I’m in the URL bar but typing a search with spaces that are all suddenly dots and it thinks it’s a malformed URL? OMG move it or kill it with fire.