By default Android application has no access to the phone resources. This includes internet access.

A developer has to specifically request a permission for his application to access these resources. When the application is being installed the user is asked to grant such permissions to the application.

When Secret Box is being installed it asks for no permissions whatsoever, so even if we wanted to upload your secrets to our server we wouldn't be able to because we have no internet access from your phone.

More can be found here http://developer.android.com/guide/topics/security/security.html#arch