Desktop app and web client work the same way.
In both cases, an end-to-end encrypted connection is established between the computer and the mobile device. Synchronized messages are kept in volatile memory only. As soon as you end the session on your computer (e.g., by closing the desktop app / web client or by explicitly stopping or deleting the session), the messages are gone. The desktop app and the web client merely act as an extension of the mobile app and hence meet Threema’s high security standard.
The technical details are documented here.
