Browsing through the source on GitHub, one learns that it uses ZRTP.
From What are the vulnerabilities of VOIP-specific security protocols? :
Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of Voice-over-IP Protocols
We also demonstrate a man-in-the-middle attack on ZRTP which disables authentication and allows the attacker to impersonate a ZRTP user and establish a shared key with another user.
For encryption, it relies on Spongy Castle v.126.96.36.199-UNOFFICIAL-ROBERTO-RELEASE
The upstream of Spongy Castle, Bouncy Castle, has the following CVE against its head:
Summary: The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVSS Severity: 4.0 (MEDIUM)
The software uses Speex and G.711 codecs as per source. Depending on the codec, not only metadata, but also the language and contents of the dialogue may be inferred because the Speex codec uses Variable Bit Rate (VBR) encoding (combined with Any Activity Detection and Comfort Noise Generation, to be more precise) (see the linked Q&A for details).
I recommend looking through the source yourself, though, instead of relying on strangers...