Since it's based on email, the same as email. You can encrypt the body but not (most of) the headers. So yes, there's a privacy concern there.