I‘m using a hosted Nextcloud instance from Hetzner and I have no idea what this is running on either. There’s a significant number of people who didn’t set up their Nextcloud instance, so people not knowing what it’s running on isn’t too surprising.

What works best for me is the web version on desktop with an ad blocker. Runs relatively smoothly, no annoying ads.

There are system specific encryption methods like keychain services on iOS to store exactly this kind of sensitive information.