It's end-to-end encrypted using AES. The hubs only forward the encrypted messages, they can't see anything. To deliver your message, your wallet connects to the recipient's hub (if it's different from your home hub).
The encryption keys are constantly rotated for
perfect forward secrecy. This has a side effect that if you restore from an old backup or try to use the same wallet on two devices (which rotate the keys independently), the keys get out of sync and your wallet can't decrypt a received message. This is one of the common reasons for not receiving blackbytes, which are delivered through chat messages.
Thank you for answering. After posting the questions, I've read in the first post that it is end-to-end encrypted. Sorry that I didn't mark the question as answered for me, but it might help other people.
Also: Thanks for giving some details. The more I know about the working principles of blackbytes, the more I like it.
Keep up the great work!